(RHSA-2024:0247) Important: OpenJDK 21.0.2 security update

2024-01-1714:12:45

access.redhat.com

openjdk

security

update

red hat

cve-2024-20918

cve-2024-20952

cve-2024-20919

cve-2024-20921

cve-2024-20945

java

runtime

environment

development kit

linux

cve page

7.3 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

36.8%

JSON

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

This release of the Red Hat build of OpenJDK 21 (21.0.2) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 21 (21.0.1) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.

Security Fix(es):

OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)
OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)
OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)
OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)
OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.