Security update for java-1_8_0-openj9 (important)

An update that fixes 15 vulnerabilities is now available.

Description:

This update for java-1_8_0-openj9 fixes the following issues:

Update to OpenJDK 8u312 build 07 with OpenJ9 0.29.0 virtual machine
including Oracle July 2021 and October 2021 CPU changes

• CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in
  ProcessBuilder on Windows (bsc#1185056).
• CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled
  algorithms (bsc#1185055).
• CVE-2021-2341: Fixed flaw inside the FtpClient (bsc#1188564).
• CVE-2021-2369: Fixed JAR file handling problem containing multiple
  MANIFEST.MF files (bsc#1188565).
• CVE-2021-2388: Fixed flaw inside the Hotspot component performed range
  check elimination (bsc#1188566).
• CVE-2021-35550: Fixed weak ciphers preferred over stronger ones for TLS
  (bsc#1191901).
• CVE-2021-35556: Fixed excessive memory allocation in RTFParser
  (bsc#1191910).
• CVE-2021-35559: Fixed excessive memory allocation in RTFReader
  (bsc#1191911).
• CVE-2021-35561: Fixed excessive memory allocation in HashMap and HashSet
  (bsc#1191912).
• CVE-2021-35564: Fixed certificates with end dates too far in the future
  can corrupt keystore (bsc#1191913).
• CVE-2021-35565: Fixed loop in HttpsServer triggered during TLS session
  close (bsc#1191909).
• CVE-2021-35567: Fixed incorrect principal selection when using Kerberos
  Constrained Delegation (bsc#1191903).
• CVE-2021-35578: Fixed unexpected exception raised during TLS handshake
  (bsc#1191904).
• CVE-2021-35586: Fixed excessive memory allocation in BMPImageReader
  (bsc#1191914).
• CVE-2021-35603: Fixed non-constant comparison during TLS handshakes
  (bsc#1191906).

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.3:

  zypper in -t patch openSUSE-SLE-15.3-2021-3615=1