SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3665-1
Container Tags        : bci/openjdk-devel:17 , bci/openjdk-devel:17-12.57 , bci/openjdk-devel:latest
Container Release     : 12.57
Severity              : important
Type                  : security
References            : 1196647 1214790 1216339 1216374 CVE-2023-22025 CVE-2023-22081
-----------------------------------------------------------------

The container bci/openjdk-devel was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4289-1
Released:    Tue Oct 31 09:15:08 2023
Summary:     Security update for java-17-openjdk
Type:        security
Severity:    important
References:  1214790,1216339,1216374,CVE-2023-22025,CVE-2023-22081
This update for java-17-openjdk fixes the following issues:

- Updated to JDK 17.0.9+9 (October 2023 CPU):

  - CVE-2023-22081: Fixed a partial denial of service issue that could
    be triggered via HTTPS (bsc#1216374).
  - CVE-2023-22025: Fixed a memory corruption issue in applications
    using AVX-512 (bsc#1216339).

Please visit the Oracle Release Notes page for the full changelog:

https://www.oracle.com/java/technologies/javase/17all-relnotes.html

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4310-1
Released:    Tue Oct 31 14:10:47 2023
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1196647
This Update for libtirpc to 1.3.4, fixing the following issues:
    
Update to 1.3.4 (bsc#1199467)

 * binddynport.c honor ip_local_reserved_ports
   - replaces: binddynport-honor-ip_local_reserved_ports.patch
 * gss-api: expose gss major/minor error in authgss_refresh()
 * rpcb_clnt.c: Eliminate double frees in delete_cache()
 * rpcb_clnt.c: memory leak in destroy_addr
 * portmapper: allow TCP-only portmapper
 * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
 * clnt_raw.c: fix a possible null pointer dereference
 * bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
* _rpc_dtablesize: use portable system call
* libtirpc: Fix use-after-free accessing the error number
* Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
* rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
* Eliminate deadlocks in connects with an MT environment
* clnt_dg_freeres() uncleared set active state may deadlock
* thread safe clnt destruction
* SUNRPC: mutexed access blacklist_read state variable
* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses
* blacklist: Add a few more well known ports
* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h
  The unsupported  AUTH_DES authentication has be
  compiled out since commit d918e41d889 (Wed Oct 9 2019)
  replaced by API routines that return errors.
* svc_dg: Free xp_netid during destroy
* Fix memory management issues of fd locks
* libtirpc: replace array with list for per-fd locks
* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
* __rpc_dtbsize: rlim_cur instead of rlim_max
* pkg-config: use the correct replacements for libdir/includedir


The following package changes have been done:

- libtirpc-netconfig-1.3.4-150300.3.20.1 updated
- libtirpc3-1.3.4-150300.3.20.1 updated
- java-17-openjdk-headless-17.0.9.0-150400.3.33.1 updated
- java-17-openjdk-17.0.9.0-150400.3.33.1 updated
- java-17-openjdk-devel-17.0.9.0-150400.3.33.1 updated
- container:bci-openjdk-17-15.5.17-12.28 updated

SUSE: 2023:3665-1 bci/openjdk-devel Security Update

November 2, 2023
The container bci/openjdk-devel was updated

Summary

Advisory ID: SUSE-SU-2023:4289-1 Released: Tue Oct 31 09:15:08 2023 Summary: Security update for java-17-openjdk Type: security Severity: important Advisory ID: SUSE-RU-2023:4310-1 Released: Tue Oct 31 14:10:47 2023 Summary: Recommended update for libtirpc Type: recommended Severity: moderate

References

References : 1196647 1214790 1216339 1216374 CVE-2023-22025 CVE-2023-22081

1214790,1216339,1216374,CVE-2023-22025,CVE-2023-22081

This update for java-17-openjdk fixes the following issues:

- Updated to JDK 17.0.9+9 (October 2023 CPU):

- CVE-2023-22081: Fixed a partial denial of service issue that could

be triggered via HTTPS (bsc#1216374).

- CVE-2023-22025: Fixed a memory corruption issue in applications

using AVX-512 (bsc#1216339).

Please visit the Oracle Release Notes page for the full changelog:

https://www.oracle.com/java/technologies/javase/17all-relnotes.html

1196647

This Update for libtirpc to 1.3.4, fixing the following issues:

Update to 1.3.4 (bsc#1199467)

* binddynport.c honor ip_local_reserved_ports

- replaces: binddynport-honor-ip_local_reserved_ports.patch

* gss-api: expose gss major/minor error in authgss_refresh()

* rpcb_clnt.c: Eliminate double frees in delete_cache()

* rpcb_clnt.c: memory leak in destroy_addr

* portmapper: allow TCP-only portmapper

* getnetconfigent: avoid potential DoS issue by removing unnecessary sleep

* clnt_raw.c: fix a possible null pointer dereference

* bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc

- replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch

* _rpc_dtablesize: use portable system call

* libtirpc: Fix use-after-free accessing the error number

* Fix potential memory leak of parms.r_addr

- replaces 0001-fix-parms.r_addr-memory-leak.patch

* rpcb_clnt.c add mechanism to try v2 protocol first

- preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch

* Eliminate deadlocks in connects with an MT environment

* clnt_dg_freeres() uncleared set active state may deadlock

* thread safe clnt destruction

* SUNRPC: mutexed access blacklist_read state variable

* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses

* blacklist: Add a few more well known ports

* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h

The unsupported AUTH_DES authentication has be

compiled out since commit d918e41d889 (Wed Oct 9 2019)

replaced by API routines that return errors.

* svc_dg: Free xp_netid during destroy

* Fix memory management issues of fd locks

* libtirpc: replace array with list for per-fd locks

* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf

* __rpc_dtbsize: rlim_cur instead of rlim_max

* pkg-config: use the correct replacements for libdir/includedir

The following package changes have been done:

- libtirpc-netconfig-1.3.4-150300.3.20.1 updated

- libtirpc3-1.3.4-150300.3.20.1 updated

- java-17-openjdk-headless-17.0.9.0-150400.3.33.1 updated

- java-17-openjdk-17.0.9.0-150400.3.33.1 updated

- java-17-openjdk-devel-17.0.9.0-150400.3.33.1 updated

- container:bci-openjdk-17-15.5.17-12.28 updated

Severity
Container Advisory ID : SUSE-CU-2023:3665-1
Container Tags : bci/openjdk-devel:17 , bci/openjdk-devel:17-12.57 , bci/openjdk-devel:latest
Container Release : 12.57
Severity : important
Type : security

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo