A java-1.8.0-openjdk security update has been released for Oracle Linux 9.

ELSA-2023-5733 Moderate: Oracle Linux 9 java-1.8.0-openjdk security update

Oracle Linux Security Advisory ELSA-2023-5733

http://linux.oracle.com/errata/ELSA-2023-5733.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
java-1.8.0-openjdk-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-javadoc-1.8.0.392.b08-3.0.1.el9.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.392.b08-3.0.1.el9.noarch.rpm
java-1.8.0-openjdk-src-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-3.0.1.el9.x86_64.rpm

aarch64:
java-1.8.0-openjdk-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-javadoc-1.8.0.392.b08-3.0.1.el9.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.392.b08-3.0.1.el9.noarch.rpm
java-1.8.0-openjdk-src-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-3.0.1.el9.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates//java-1.8.0-openjdk-1.8.0.392.b08-3.0.1.el9.src.rpm

Related CVEs:

CVE-2022-40433
CVE-2023-22067
CVE-2023-22081

Description of changes:

[1:1.8.0.392.b08-3.0.1]
- Update to shenandoah-jdk8u392-b08 (GA)
- OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433)
- OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067)
- OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)
- A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (RHEL-13593)