RHSA-2023:4171: Moderate: java-17-openjdk security update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.Security Fix(es): OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:4171?
The severity of RHSA-2023:4171 is considered important due to vulnerabilities found in the OpenJDK packages.
How do I fix RHSA-2023:4171?
To fix RHSA-2023:4171, update the affected packages to the latest version using the command relevant to your system's package manager.
What vulnerabilities are addressed in RHSA-2023:4171?
RHSA-2023:4171 addresses vulnerabilities such as the ZIP file parsing infinite loop (CVE-2023-22036) and weaknesses in AES implementation.
Which packages are affected by RHSA-2023:4171?
The affected packages by RHSA-2023:4171 include various OpenJDK 17 packages such as java-17-openjdk, java-17-openjdk-devel, and others.
Is it safe to continue using the affected version of OpenJDK outlined in RHSA-2023:4171?
It is not safe to continue using the affected version of OpenJDK as it contains known vulnerabilities that may be exploited.