A java-1.8.0-openjdk security and bug fix update has been released for Red Hat Enterprise Linux 8.
RHSA-2022:0307-03: Moderate: java-1.8.0-openjdk security and bug fix update
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: java-1.8.0-openjdk security and bug fix update
Advisory ID: RHSA-2022:0307-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:0307
Issue date: 2022-01-27
CVE Names: CVE-2022-21248 CVE-2022-21282 CVE-2022-21283
CVE-2022-21293 CVE-2022-21294 CVE-2022-21296
CVE-2022-21299 CVE-2022-21305 CVE-2022-21340
CVE-2022-21341 CVE-2022-21360 CVE-2022-21365
=====================================================================
1. Summary:
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* OpenJDK: Incomplete deserialization class filtering in ObjectInputStream
(Serialization, 8264934) (CVE-2022-21248)
* OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP,
8270492) (CVE-2022-21282)
* OpenJDK: Unexpected exception thrown in regex Pattern (Libraries,
8268813) (CVE-2022-21283)
* OpenJDK: Incomplete checks of StringBuffer and StringBuilder during
deserialization (Libraries, 8270392) (CVE-2022-21293)
* OpenJDK: Incorrect IdentityHashMap size checks during deserialization
(Libraries, 8270416) (CVE-2022-21294)
* OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
(CVE-2022-21296)
* OpenJDK: Infinite loop related to incorrect handling of newlines in
XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299)
* OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
(CVE-2022-21305)
* OpenJDK: Excessive resource use when reading JAR manifest attributes
(Libraries, 8272026) (CVE-2022-21340)
* OpenJDK: Insufficient checks when deserializing exceptions in
ObjectInputStream (Serialization, 8272236) (CVE-2022-21341)
* OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
(CVE-2022-21360)
* OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
(CVE-2022-21365)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Bug Fix(es):
* Previously, OpenJDK would crash when running the Java Flight Recorder
(JFR) on PowerPC 64 (ppc64) machines. This was found to be due to missing
crash protection in the ppc64 port. With this update, JFR should be run
without crashing on ppc64. (BZ#2038935)
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of OpenJDK Java must be restarted for this update to
take effect.
5. Bugs fixed ( https://bugzilla.redhat.com/):
2038935 - OpenJDK crashes when using JFR [rhel-8.5.0.z]
2041400 - CVE-2022-21283 OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
2041417 - CVE-2022-21293 OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
2041427 - CVE-2022-21294 OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
2041435 - CVE-2022-21282 OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
2041439 - CVE-2022-21296 OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
2041472 - CVE-2022-21299 OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
2041491 - CVE-2022-21360 OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
2041785 - CVE-2022-21365 OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
2041801 - CVE-2022-21248 OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
2041878 - CVE-2022-21305 OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
2041884 - CVE-2022-21340 OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
2041897 - CVE-2022-21341 OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.src.rpm
aarch64:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.aarch64.rpm
noarch:
java-1.8.0-openjdk-javadoc-1.8.0.322.b06-2.el8_5.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.322.b06-2.el8_5.noarch.rpm
ppc64le:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.ppc64le.rpm
s390x:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.s390x.rpm
x86_64:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.x86_64.rpm
Red Hat CodeReady Linux Builder (v. 8):
aarch64:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
ppc64le:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
x86_64:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-21248
https://access.redhat.com/security/cve/CVE-2022-21282
https://access.redhat.com/security/cve/CVE-2022-21283
https://access.redhat.com/security/cve/CVE-2022-21293
https://access.redhat.com/security/cve/CVE-2022-21294
https://access.redhat.com/security/cve/CVE-2022-21296
https://access.redhat.com/security/cve/CVE-2022-21299
https://access.redhat.com/security/cve/CVE-2022-21305
https://access.redhat.com/security/cve/CVE-2022-21340
https://access.redhat.com/security/cve/CVE-2022-21341
https://access.redhat.com/security/cve/CVE-2022-21360
https://access.redhat.com/security/cve/CVE-2022-21365
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
