CLSA-2023-1689009395

    Dashboard / Vulnerabilities / CLSA-2023-1689009395

    CLSA-2023-1689009395

    Published: 10 Jul 2023Last Modified: 4 Jun 2026

    Summary: Fix of 9 CVEs

    Details: * Backport upstream releases 8u372 to 16.04 LTS * CVEs fixed in 8u372: - CVE-2023-21930: Improper connection handling during TLS handshake - CVE-2023-21937: Missing string checks for NULL characters - CVE-2023-21938: Incorrect handling of NULL characters in ProcessBuilder - CVE-2023-21939: Swing HTML parsing issue - CVE-2023-21954: Incorrect enqueue of references in garbage collector - CVE-2023-21967: Certificate validation issue in TLS session negotiation - CVE-2023-21968: Missing check for slash characters in URI-to-path conversion * CVEs fixed in 8u362: - CVE-2023-21830: Improper restrictions in CORBA deserialization - CVE-2023-21843: Soundbank URL remote loading * debian/rules: remove IcedTeaPlugin.so reference (LP: #2016396) * debian/JB-jre-headless.postinst.in: trigger ca-certificates-java after jre is set up * Drop applied jdk8u-get-datetime-string.patch

    References: https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1689009395

    Affected packages

    Package

    Name: openjdk-8-demo

    Purl: pkg:deb/tuxcare/openjdk-8-demo?distro=ubuntu-16.04

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -8u372-ga-0ubuntu1~16.04+tuxcare.els1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CLSA-2023-1689009395 | CVE-DB