alsa-2024:0265
Vulnerability from osv_almalinux
Published
2024-01-17 00:00
Modified
2024-03-05 10:02
Summary
Important: java-1.8.0-openjdk security and bug fix update
Details
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
- OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)
- OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)
- OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)
- OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)
- OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)
- OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637)
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-accessibility"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-accessibility-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-accessibility-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-demo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-demo-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-demo-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-devel-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-devel-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-headless"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-headless-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-headless-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-javadoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-javadoc-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-src"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-src-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "java-1.8.0-openjdk-src-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-demo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-demo-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-demo-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-devel-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-devel-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-headless"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-headless-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-headless-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-javadoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-javadoc-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-src"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-src-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-1.8.0-openjdk-src-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.8.0.402.b06-2.el9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.\n\nSecurity Fix(es):\n\n* OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)\n* OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)\n* OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)\n* OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)\n* OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)\n* OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, \"Requires: java-headless 1:1.8.0\"). This change has now been reverted to the old \"1:1.8.0\" value. (AlmaLinux-19636, AlmaLinux-19637)",
"id": "ALSA-2024:0265",
"modified": "2024-03-05T10:02:30Z",
"published": "2024-01-17T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2024:0265"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20918"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20919"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20921"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20926"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20945"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2024-20952"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257728"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257837"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257850"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257853"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257859"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/2257874"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2024-0265.html"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2024-0265.html"
}
],
"related": [
"CVE-2024-20918",
"CVE-2024-20952",
"CVE-2024-20919",
"CVE-2024-20921",
"CVE-2024-20926",
"CVE-2024-20945"
],
"summary": "Important: java-1.8.0-openjdk security and bug fix update"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…