Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Java 17 OpenJDK may let attackers execute code
published 2 years ago
Summary
Red Hat’s Java 17 OpenJDK packages (including the runtime, development, and debugging versions) contain a flaw that could let a malicious user run code on your system. This could lead to loss of data or control of the server. Install the latest Red Hat update for these packages as soon as possible to protect your environment.
What to do
- Update redhat java-17-openjdk to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-debugsource to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-demo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-javadoc to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-javadoc-zip to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-jmods to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-src to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-static-libs to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-demo-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-demo-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel-fastdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-devel-slowdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-fastdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless-fastdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-headless-slowdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-jmods-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-jmods-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-slowdebug-debuginfo to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-src-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-src-slowdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-static-libs-fastdebug to version 1:17.0.3.0.6-2.el8_5.
- Update redhat java-17-openjdk-static-libs-slowdebug to version 1:17.0.3.0.6-2.el8_5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-debugsource |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-demo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-devel |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-devel-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-headless |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-headless-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-javadoc |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-javadoc-zip |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-jmods |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-src |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::appstream | redhat | java-17-openjdk-static-libs |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-debugsource |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-demo-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-demo-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-devel-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-devel-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-devel-fastdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-devel-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-devel-slowdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-fastdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-headless-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-headless-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-headless-fastdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-headless-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-headless-slowdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-jmods-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-jmods-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-slowdebug-debuginfo |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-src-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-src-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-static-libs-fastdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
| Red Hat:enterprise_linux:8::crb | redhat | java-17-openjdk-static-libs-slowdebug |
< 1:17.0.3.0.6-2.el8_5 Fix: upgrade to 1:17.0.3.0.6-2.el8_5
|
Original advisory text
Red Hat Security Advisory: java-17-openjdk security and bug fix update
References
- https://access.redhat.com/errata/RHSA-2022:1445 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2018189 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2055396 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075788 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075793 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075821 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075836 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075842 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2075849 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1445.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-21426 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21426 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21426 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-21434 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21434 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21434 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-21443 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21443 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21443 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-21449 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21449 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21449 Vendor Advisory
- https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/ Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-21476 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21476 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21476 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-21496 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-21496 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21496 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Sep 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
RHSA-2022:1445 · OSV
Track software like this
Free during beta