USN-5388-2

Dashboard / Vulnerabilities / USN-5388-2

USN-5388-2

Summary: openjdk-17 vulnerabilities

Details: It was discovered that OpenJDK incorrectly verified ECDSA signatures. An attacker could use this issue to bypass the signature verification process. (CVE-2022-21449) It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-21426) It was discovered that OpenJDK incorrectly handled converting certain object arguments into their textual representations. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-21434) It was discovered that OpenJDK incorrectly validated the encoded length of certain object identifiers. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-21443) It was discovered that OpenJDK incorrectly validated certain paths. An attacker could possibly use this issue to bypass the secure validation feature and expose sensitive information in XML files. (CVE-2022-21476) It was discovered that OpenJDK incorrectly parsed certain URI strings. An attacker could possibly use this issue to make applications accept invalid of malformed URI strings. (CVE-2022-21496)

References: https://ubuntu.com/security/notices/USN-5388-2, https://ubuntu.com/security/CVE-2022-21426, https://ubuntu.com/security/CVE-2022-21434, https://ubuntu.com/security/CVE-2022-21443, https://ubuntu.com/security/CVE-2022-21449, https://ubuntu.com/security/CVE-2022-21476, https://ubuntu.com/security/CVE-2022-21496