Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux Java 8 can let attackers run code
published 2 years ago
Summary
The OpenJDK 8 packages for AlmaLinux have several flaws that could let a malicious program run arbitrary code, bypass security checks, or expose private keys. This puts any systems using these Java packages at risk of compromise. Update the java-1.8.0-openjdk packages to the latest version as soon as possible to apply the security and bug fixes.
What to do
- Update almalinux java-1.8.0-openjdk to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-accessibility to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-accessibility-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-accessibility-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-demo to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-demo-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-demo-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-devel to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-devel-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-devel-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-headless to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-headless-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-headless-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-javadoc to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-javadoc-zip to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-src to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-src-fastdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk-src-slowdebug to version 1:1.8.0.402.b06-2.el8.
- Update almalinux java-1.8.0-openjdk to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-demo to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-demo-fastdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-demo-slowdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-devel to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-devel-fastdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-devel-slowdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-fastdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-headless to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-headless-fastdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-headless-slowdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-javadoc to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-javadoc-zip to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-slowdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-src to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-src-fastdebug to version 1:1.8.0.402.b06-2.el9.
- Update almalinux java-1.8.0-openjdk-src-slowdebug to version 1:1.8.0.402.b06-2.el9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-accessibility |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-accessibility-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-accessibility-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-demo |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-demo-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-demo-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-devel |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-devel-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-devel-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-headless |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-headless-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-headless-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-javadoc |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-javadoc-zip |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-src |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-src-fastdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:8 | almalinux | java-1.8.0-openjdk-src-slowdebug |
< 1:1.8.0.402.b06-2.el8 Fix: upgrade to 1:1.8.0.402.b06-2.el8
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-demo |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-demo-fastdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-demo-slowdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-devel |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-devel-fastdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-devel-slowdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-fastdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-headless |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-headless-fastdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-headless-slowdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-javadoc |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-javadoc-zip |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-slowdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-src |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-src-fastdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
| AlmaLinux:9 | almalinux | java-1.8.0-openjdk-src-slowdebug |
< 1:1.8.0.402.b06-2.el9 Fix: upgrade to 1:1.8.0.402.b06-2.el9
|
Original advisory text
Important: java-1.8.0-openjdk security and bug fix update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
* OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)
* OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)
* OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)
* OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)
* OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)
* OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637)
Security Fix(es):
* OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)
* OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)
* OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)
* OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)
* OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)
* OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637)
References
- https://access.redhat.com/errata/RHSA-2024:0265 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-20918 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-20919 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-20921 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-20926 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-20945 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-20952 Third Party Advisory
- https://bugzilla.redhat.com/2257728 Third Party Advisory
- https://bugzilla.redhat.com/2257837 Third Party Advisory
- https://bugzilla.redhat.com/2257850 Third Party Advisory
- https://bugzilla.redhat.com/2257853 Third Party Advisory
- https://bugzilla.redhat.com/2257859 Third Party Advisory
- https://bugzilla.redhat.com/2257874 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2024-0265.html Vendor Advisory
- https://errata.almalinux.org/9/ALSA-2024-0265.html Vendor Advisory
Timeline
Published17 Jan 2024
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2024:0265 · OSV
Track software like this
Free during beta