SUSE Security Update: Security update for java-1_8_0-openj9
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:4250-1
Rating:             important
References:         #1204471 #1204472 #1204473 #1204475 #1204703 
                    
Cross-References:   CVE-2022-21619 CVE-2022-21624 CVE-2022-21626
                    CVE-2022-21628 CVE-2022-3676
CVSS scores:
                    CVE-2022-21619 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21619 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21624 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21624 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21626 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21626 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21628 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21628 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-3676 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-3676 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products:
                    openSUSE Leap 15.3
                    openSUSE Leap 15.4
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   This update for java-1_8_0-openj9 fixes the following issues:

   - Update to OpenJDK 8u352 build 08 with OpenJ9 0.35.0 virtual machine,
     including Oracle October 2022 CPU changes.

   - CVE-2022-21619: An unauthenticated attacker with network access via
     multiple protocols to compromise Oracle Java SE (bsc#1204473).
   - CVE-2022-21626: An unauthenticated attacker with network access via
     HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
     (bsc#1204471).
   - CVE-2022-21624: An unauthenticated attacker with network access via
     multiple protocols to compromise Oracle Java SE, Oracle GraalVM
     Enterprise (bsc#1204475).
   - CVE-2022-21628: An unauthenticated attacker with network access via HTTP
     can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
     (bsc#1204472).
   - CVE-2022-3676: Fixed interface than calls can be inlined without a
     runtime type check (bsc#1204703).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.4:

      zypper in -t patch openSUSE-SLE-15.4-2022-4250=1

   - openSUSE Leap 15.3:

      zypper in -t patch openSUSE-SLE-15.3-2022-4250=1



Package List:

   - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

      java-1_8_0-openj9-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.4 (noarch):

      java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.3 (ppc64le s390x x86_64):

      java-1_8_0-openj9-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.3 (noarch):

      java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1


References:

   https://www.suse.com/security/cve/CVE-2022-21619.html
   https://www.suse.com/security/cve/CVE-2022-21624.html
   https://www.suse.com/security/cve/CVE-2022-21626.html
   https://www.suse.com/security/cve/CVE-2022-21628.html
   https://www.suse.com/security/cve/CVE-2022-3676.html
   https://bugzilla.suse.com/1204471
   https://bugzilla.suse.com/1204472
   https://bugzilla.suse.com/1204473
   https://bugzilla.suse.com/1204475
   https://bugzilla.suse.com/1204703

SUSE: 2022:4250-1 important: java-1_8_0-openj9

November 28, 2022
An update that fixes 5 vulnerabilities is now available

Summary

This update for java-1_8_0-openj9 fixes the following issues: - Update to OpenJDK 8u352 build 08 with OpenJ9 0.35.0 virtual machine, including Oracle October 2022 CPU changes. - CVE-2022-21619: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE (bsc#1204473). - CVE-2022-21626: An unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204471). - CVE-2022-21624: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise (bsc#1204475). - CVE-2022-21628: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204472). - CVE-2022-3676: Fixed interface than calls can be inlined without a runtime type check (bsc#1204703). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.4: zypper in -t patch openSUSE-SLE-15.4-2022-4250=1 - openSUSE Leap 15.3: zypper in -t patch openSUSE-SLE-15.3-2022-4250=1 Package List: - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.4 (noarch): java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.3 (ppc64le s390x x86_64): java-1_8_0-openj9-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1 java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1 - openSUSE Leap 15.3 (noarch): java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1

References

#1204471 #1204472 #1204473 #1204475 #1204703

Cross- CVE-2022-21619 CVE-2022-21624 CVE-2022-21626

CVE-2022-21628 CVE-2022-3676

CVSS scores:

CVE-2022-21619 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21619 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21624 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21624 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21626 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21626 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21628 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21628 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-3676 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVE-2022-3676 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products:

openSUSE Leap 15.3

openSUSE Leap 15.4

https://www.suse.com/security/cve/CVE-2022-21619.html

https://www.suse.com/security/cve/CVE-2022-21624.html

https://www.suse.com/security/cve/CVE-2022-21626.html

https://www.suse.com/security/cve/CVE-2022-21628.html

https://www.suse.com/security/cve/CVE-2022-3676.html

https://bugzilla.suse.com/1204471

https://bugzilla.suse.com/1204472

https://bugzilla.suse.com/1204473

https://bugzilla.suse.com/1204475

https://bugzilla.suse.com/1204703

Severity
Announcement ID: SUSE-SU-2022:4250-1
Rating: important

Related News

30.Lock Globe Motherboard Esm H320
1 - 2 min read
The SPDX 3.0 release marks a significant milestone in software management, particularly for Linux admins, infosec professionals, internet security
11.Locks IsometricPattern Esm H320
2 - 3 min read
Open Source maintainers and developers have been warned about the continued wave of attacks aimed at project maintainers similar to those recently
28.Lock Globe Esm H320
1 - 2 min read
A resurgence of cyberattacks targeting Linux systems in Asian campaigns through the utilization of the Pupy Remote Access Trojan (RAT) has been
27.Tablet Connections Blocks Lock Esm H320
2 - 4 min read
Canonical has recently announced the Beta release of Ubuntu Linux 24.04 LTS , codenamed "Noble Numbat." This release aims to continue Ubuntu's
21.Globe RadiatingCode Esm H320
2 - 3 min read
The open-source movement has come a long way, from its origins in the 1960s and 1970s to becoming an integral part of organizations worldwide.
13.Lock StylizedMotherboard Esm H320
2 - 3 min read
The Rust-based Edera project demonstrates a unique approach to container security that addresses cloud-native computing challenges. Let's examine
8.Locks HexConnections CodeGlobe Esm H320
2 - 3 min read
Canonical has launched Ubuntu Pro for Devices , a comprehensive offering emphasizing security and compliance for IoT device deployments. This
2.Motherboard Esm H320
2 - 3 min read
The recently uncovered "Native Branch History Injection (BHI)" exploit against the Linux kernel marks a significant milestone in the ongoing battle

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved