Lucene search
AmazonALAS2-2022-1836HistorySep 01, 2022 - 9:09 p.m.
Important: java-1.8.0-openjdk
2022-09-0121:09:00
alas.aws.amazon.com
66
java
openjdk
security issue
package update
amazon linux 2
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AI Score
7.5
Confidence
High
EPSS
0.002
Percentile
53.3%
Issue Overview:
Generated code produced by C1 may leak a package-private class to a class from a different package. (CVE-2022-21540)
MethodHandle.invokeBasic() method can be accessed on byte code level from an arbitrary class. (CVE-2022-21541)
The Xalan Java XSLT library has an integer truncation issue when processing malicious stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. (CVE-2022-34169)
Affected Packages:
java-1.8.0-openjdk
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update java-1.8.0-openjdk to update your system.
New Packages:
aarch64:
java-1.8.0-openjdk-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-headless-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-headless-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-devel-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-devel-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-demo-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-demo-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-src-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-src-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-accessibility-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-accessibility-debug-1.8.0.342.b07-1.amzn2.0.1.aarch64
java-1.8.0-openjdk-debuginfo-1.8.0.342.b07-1.amzn2.0.1.aarch64
i686:
java-1.8.0-openjdk-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-headless-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-headless-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-devel-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-devel-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-demo-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-demo-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-src-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-src-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-accessibility-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-accessibility-debug-1.8.0.342.b07-1.amzn2.0.1.i686
java-1.8.0-openjdk-debuginfo-1.8.0.342.b07-1.amzn2.0.1.i686
noarch:
java-1.8.0-openjdk-javadoc-1.8.0.342.b07-1.amzn2.0.1.noarch
java-1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-1.amzn2.0.1.noarch
java-1.8.0-openjdk-javadoc-debug-1.8.0.342.b07-1.amzn2.0.1.noarch
java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.342.b07-1.amzn2.0.1.noarch
src:
java-1.8.0-openjdk-1.8.0.342.b07-1.amzn2.0.1.src
x86_64:
java-1.8.0-openjdk-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-headless-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-headless-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-devel-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-devel-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-demo-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-demo-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-src-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-src-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-accessibility-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-accessibility-debug-1.8.0.342.b07-1.amzn2.0.1.x86_64
java-1.8.0-openjdk-debuginfo-1.8.0.342.b07-1.amzn2.0.1.x86_64
Additional References
Red Hat: CVE-2022-21540, CVE-2022-21541, CVE-2022-34169
Mitre: CVE-2022-21540, CVE-2022-21541, CVE-2022-34169
Related
redhat
redhat
amazon
amazon
Important: java-11-amazon-corretto
2022-07-19 01:18:00
Important: java-11-amazon-corretto
2022-07-19 00:38:00
Important: java-17-amazon-corretto
2022-07-19 01:19:00
nessus
nessus
Oracle Linux 9 : java-11-openjdk (ELSA-2022-5695)
2022-07-26 00:00:00
Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2022-5698)
2022-07-25 00:00:00
Amazon Linux 2022 : (ALAS2022-2022-111)
2022-09-06 00:00:00
oraclelinux
oraclelinux
java-1.8.0-openjdk security, bug fix, and enhancement update
2022-07-25 00:00:00
java-11-openjdk security, bug fix, and enhancement update
2022-07-26 00:00:00
java-1.8.0-openjdk security, bug fix, and enhancement update
2022-07-26 00:00:00
openvas
openvas
Fedora: Security Advisory for java-latest-openjdk (FEDORA-2022-e573851f56)
2022-08-04 00:00:00
CentOS: Security Advisory for java (CESA-2022:5698)
2022-08-03 00:00:00
Fedora: Security Advisory for java-11-openjdk (FEDORA-2022-d26586b419)
2022-08-04 00:00:00
suse
suse
Security update for java-11-openjdk (important)
2022-08-09 00:00:00
Security update for java-1_8_0-openjdk (important)
2022-08-19 00:00:00
Security update for java-1_8_0-ibm (important)
2022-08-31 00:00:00
altlinux
altlinux
almalinux
almalinux
Important: java-1.8.0-openjdk security, bug fix, and enhancement update
2022-07-25 00:00:00
Important: java-11-openjdk security, bug fix, and enhancement update
2022-07-25 00:00:00
Important: java-1.8.0-openjdk security, bug fix, and enhancement update
2022-07-25 00:00:00
redos
redos
ROS-20240522-05
2024-05-22 00:00:00
osv
osv
Important: java-11-openjdk security, bug fix, and enhancement update
2022-07-25 00:00:00
openjdk-11 - security update
2022-07-22 00:00:00
Important: java-11-openjdk security, bug fix, and enhancement update
2022-07-21 13:41:28
rocky
rocky
java-11-openjdk security, bug fix, and enhancement update
2022-07-21 13:41:28
java-1.8.0-openjdk security, bug fix, and enhancement update
2022-07-25 13:45:21
java-17-openjdk security, bug fix, and enhancement update
2022-07-26 17:15:53
centos
centos
java security update
2022-08-02 19:13:38
java security update
2022-08-02 19:14:32
cloudlinux
cloudlinux
fedora
fedora
[SECURITY] Fedora 35 Update: java-latest-openjdk-18.0.2.0.9-1.rolling.fc35
2022-08-03 01:49:31
[SECURITY] Fedora 36 Update: java-latest-openjdk-18.0.2.0.9-1.rolling.fc36
2022-08-03 01:27:35
[SECURITY] Fedora 36 Update: java-17-openjdk-17.0.4.0.8-1.fc36
2022-07-28 01:28:22
debian
debian
[SECURITY] [DSA 5188-1] openjdk-11 security update
2022-07-22 20:58:41
[SECURITY] [DSA 5192-1] openjdk-17 security update
2022-07-26 20:13:06
kaspersky
kaspersky
KLA12588 Multiple vulnerabilities in Oracle Java SE and GraalVM
2022-07-19 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect Liberty for Java for IBM Cloud due to July 2022 CPU
2022-10-07 16:09:39
broadcom
broadcom
rosalinux
rosalinux
Advisory ROSA-SA-2023-2138
2023-04-04 15:18:16
f5
f5
mageia
mageia
Updated java packages fix security vulnerability
2022-11-25 01:21:24
cvelist
cvelist
CVE-2022-21540
2022-07-19 00:00:00
prion
prion
Design/Logic Flaw
2022-07-19 22:15:00
ubuntucve
ubuntucve
CVE-2022-21540
2022-07-19 00:00:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AI Score
7.5
Confidence
High
EPSS
0.002
Percentile
53.3%
Related for ALAS2-2022-1836