Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
CentOS Java 1.8 OpenJDK may allow code execution
published 4 years ago
Summary
Several components of the Java 1.8 OpenJDK packages for CentOS (including the standard, debug, demo, and development versions) contain coding errors that could let an attacker run unwanted code or cause a crash. Updating to the latest openjdk-shenandoah-jdk8u332-b09 package removes these problems. Apply the update as soon as possible and verify the older patch files have been removed.
What to do
- Update centos java-1.8.0-openjdk to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-demo to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-demo-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-devel to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-devel-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-headless to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-headless-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-javadoc to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-javadoc-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-src to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
- Update centos java-1.8.0-openjdk-src-debug to version 1:1.8.0.332.b09-1.el6.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-demo |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-demo-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-devel |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-devel-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-headless |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-headless-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-javadoc |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-javadoc-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-src |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
| TuxCare:CentOS:6 | centos | java-1.8.0-openjdk-src-debug |
< 1:1.8.0.332.b09-1.el6.tuxcare.els1 Fix: upgrade to 1:1.8.0.332.b09-1.el6.tuxcare.els1
|
Original advisory text
Fixed CVEs in java-1.8.0-openjdk: CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, CVE-2022-21426, CVE-2022-21496
- Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b09. That fixes following CVEs:
- CVE-2022-21476: Defective secure validation in Apache Santuario
- CVE-2022-21496: URI parsing inconsistencies
- CVE-2022-21434: Improper object-to-string conversion in AnnotationInvocationHandler
- CVE-2022-21426: Unbounded memory allocation when compiling crafted XPath expressions
- CVE-2022-21443: Missing check for negative ObjectIdentifier
- Remove patch files from previous change due to their presence in newer versions
- CVE-2022-21476: Defective secure validation in Apache Santuario
- CVE-2022-21496: URI parsing inconsistencies
- CVE-2022-21434: Improper object-to-string conversion in AnnotationInvocationHandler
- CVE-2022-21426: Unbounded memory allocation when compiling crafted XPath expressions
- CVE-2022-21443: Missing check for negative ObjectIdentifier
- Remove patch files from previous change due to their presence in newer versions
References
- https://errata.cloudlinux.com/els6/CLSA-2022-1654174749.html Vendor Advisory
Timeline
Published2 Jun 2022
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2022-1654174749 · OSV
Track software like this
Free during beta