USN-7254-1: OpenJDK 21 vulnerability
Published Feb 5, 2025
·Updated
It was discovered that the Hotspot component of OpenJDK 21 did not properly handle API access under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information.
Affected Software
40 affected componentsFixes available
All of the following
ubuntu/openjdk-21-jdk<21.0.6+7-1~24.10.1
21.0.6+7-1~24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/openjdk-21-jdk-headless<21.0.6+7-1~24.10.1
21.0.6+7-1~24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/openjdk-21-jre<21.0.6+7-1~24.10.1
21.0.6+7-1~24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/openjdk-21-jre-headless<21.0.6+7-1~24.10.1
21.0.6+7-1~24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/openjdk-21-jre-zero<21.0.6+7-1~24.10.1
21.0.6+7-1~24.10.1
Ubuntu Ubuntu=24.10
All of the following
ubuntu/openjdk-21-jdk<21.0.6+7-1~24.04.1
21.0.6+7-1~24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openjdk-21-jdk-headless<21.0.6+7-1~24.04.1
21.0.6+7-1~24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openjdk-21-jre<21.0.6+7-1~24.04.1
21.0.6+7-1~24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openjdk-21-jre-headless<21.0.6+7-1~24.04.1
21.0.6+7-1~24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openjdk-21-jre-zero<21.0.6+7-1~24.04.1
21.0.6+7-1~24.04.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openjdk-21-jdk<21.0.6+7-1~22.04.1
21.0.6+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-21-jdk-headless<21.0.6+7-1~22.04.1
21.0.6+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-21-jre<21.0.6+7-1~22.04.1
21.0.6+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-21-jre-headless<21.0.6+7-1~22.04.1
21.0.6+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-21-jre-zero<21.0.6+7-1~22.04.1
21.0.6+7-1~22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/openjdk-21-jdk<21.0.6+7-1~20.04.1
21.0.6+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-21-jdk-headless<21.0.6+7-1~20.04.1
21.0.6+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-21-jre<21.0.6+7-1~20.04.1
21.0.6+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-21-jre-headless<21.0.6+7-1~20.04.1
21.0.6+7-1~20.04.1
Ubuntu Ubuntu=20.04
All of the following
ubuntu/openjdk-21-jre-zero<21.0.6+7-1~20.04.1
21.0.6+7-1~20.04.1
Ubuntu Ubuntu=20.04
Event History
Feb 5, 2025
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-7254-1?
USN-7254-1 has a critical severity rating due to the risk of unauthorized access to sensitive information.
2
How do I fix USN-7254-1?
To fix USN-7254-1, update your OpenJDK packages to version 21.0.6+7-1~24.10.1 or later.
3
What versions of OpenJDK are affected by USN-7254-1?
USN-7254-1 affects various versions of OpenJDK 21 included in Ubuntu 20.04, 22.04, and 24.04.
4
Who is at risk from the vulnerability identified in USN-7254-1?
Unauthenticated attackers can exploit the vulnerability in USN-7254-1 to gain unauthorized access to resources.
5
Is it safe to use OpenJDK versions prior to the fix for USN-7254-1?
Using OpenJDK versions prior to the fix for USN-7254-1 poses a security risk and is not recommended.