Lucene search

K
osvGoogleOSV:RLSA-2023:0208
HistoryJan 26, 2023 - 8:49 p.m.

Moderate: java-1.8.0-openjdk security and bug fix update

2023-01-2620:49:48
Google
osv.dev
8
openjdk
java
vulnerabilities
bug fixes
security fix
soundbank url
remote loading
deserialization
corba
cve-2023-21830
cve-2023-21843
file descriptors
resolverlocalfilesystem
bz#2139705
bz#2159910
bz#2163595

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

  • OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830)

  • OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Leak File Descriptors Because of ResolverLocalFilesystem#engineResolveURI() (BZ#2139705)

  • Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) [rhel-8] (BZ#2159910)

  • solr broken due to access denied (“java.io.FilePermission” “/etc/pki/java/cacerts” “read”) [rhel-8, openjdk-8] (BZ#2163595)

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%