MGASA-2023-0272

    Dashboard / Vulnerabilities / MGASA-2023-0272

    MGASA-2023-0272

    Published: 30 Sept 2023Last Modified: 30 May 2026

    Summary: Updated java packages fix security vulnerabilities

    Details: The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. (CVE-2023-21930) Incorrect enqueue of references in garbage collector. (CVE-2023-21954) Certificate validation issue in TLS session negotiation. (CVE-2023-21967) Swing HTML parsing issue. (CVE-2023-21939) Incorrect handling of NULL characters in ProcessBuilder. (CVE-2023-21938) Missing string checks for NULL characters. (CVE-2023-21937) Missing check for slash characters in URI-to-path conversion. (CVE-2023-21968) Array indexing integer overflow issue. (CVE-2023-22045) Improper handling of slash characters in URI-to-path conversion. (CVE-2023-22049) O(n^2) growth via consecutive marks. (CVE-2023-25193) HTTP client insufficient file name validation. (CVE-2023-22006) ZIP file parsing infinite loop. (CVE-2023-22036) Modulo operator array indexing issue. (CVE-2023-22044) Weakness in AES implementation. (CVE-2023-22041)

    References: https://advisories.mageia.org/MGASA-2023-0272.html, https://bugs.mageia.org/show_bug.cgi?id=32203, https://www.cve.org/CVERecord?id=CVE-2023-21930, https://www.cve.org/CVERecord?id=CVE-2023-21954, https://www.cve.org/CVERecord?id=CVE-2023-21967, https://www.cve.org/CVERecord?id=CVE-2023-21939, https://www.cve.org/CVERecord?id=CVE-2023-21938, https://www.cve.org/CVERecord?id=CVE-2023-21937, https://www.cve.org/CVERecord?id=CVE-2023-21968, https://www.cve.org/CVERecord?id=CVE-2023-22045, https://www.cve.org/CVERecord?id=CVE-2023-22049, https://www.cve.org/CVERecord?id=CVE-2023-25193, https://www.cve.org/CVERecord?id=CVE-2023-22006, https://www.cve.org/CVERecord?id=CVE-2023-22036, https://www.cve.org/CVERecord?id=CVE-2023-22044, https://www.cve.org/CVERecord?id=CVE-2023-22041, https://access.redhat.com/errata/RHSA-2023:1904, https://access.redhat.com/errata/RHSA-2023:1880, https://www.oracle.com/security-alerts/cpuapr2023.html#AppendixJAVA, https://access.redhat.com/errata/RHSA-2023:4178, https://access.redhat.com/errata/RHBA-2023:4374, https://access.redhat.com/errata/RHSA-2023:4169, https://www.oracle.com/security-alerts/cpujul2023.html#AppendixJAVA

    Affected packages

    Package

    Name: java-1.8.0-openjdk

    Purl: pkg:rpm/mageia/java-1.8.0-openjdk?arch=source&distro=mageia-8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.8.0.382.b05-1.mga8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2023-0272 | CVE-DB