RHSA-2021:2775: Important: java-1.8.0-openjdk security update
Published Jul 21, 2021
·Updated
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.<br>Security Fix(es):<br><li> OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066) (CVE-2021-2388)</li> <li> OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432) (CVE-2021-2341)</li> <li> OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967) (CVE-2021-2369)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
58 affected componentsFixes available
redhat/java<1.8.0-openjdk-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-javadoc-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-javadoc-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-javadoc-zip-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-javadoc-zip-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1
redhat/java<1.8.0-openjdk-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-accessibility-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-debugsource-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-demo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-demo-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-devel-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-devel-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-headless-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-headless-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-slowdebug-debuginfo-1.8.0.302.b08-0.el8_1.aa
redhat/java<1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1.aa
1.8.0-openjdk-src-1.8.0.302.b08-0.el8_1.aa
Remediation
Event History
Nov 7, 2024
Advisory Published
via Red Hat·02:24 AM
Frequently Asked Questions
1
What is the severity of RHSA-2021:2775?
RHSA-2021:2775 is classified as a moderate severity vulnerability.
2
How do I fix RHSA-2021:2775?
To fix RHSA-2021:2775, update the affected OpenJDK packages to version 1.8.0-openjdk-1.8.0.302.b08-0.el8_1 or later.
3
What is the main vulnerability addressed in RHSA-2021:2775?
The main vulnerability in RHSA-2021:2775 involves an incorrect comparison during range check elimination in OpenJDK, potentially leading to security issues.
4
Which packages are affected by RHSA-2021:2775?
RHSA-2021:2775 affects multiple packages including java-1.8.0-openjdk, java-1.8.0-openjdk-headless, and related demo and debug packages.
5
What should I do if I cannot update my packages for RHSA-2021:2775?
If you cannot update your packages for RHSA-2021:2775, consider implementing alternative security measures to mitigate the risks.