openSUSE-SU-2021:1455-1

    Dashboard / Vulnerabilities / openSUSE-SU-2021:1455-1

    openSUSE-SU-2021:1455-1

    Published: 5 Nov 2021Last Modified: 4 Feb 2026

    Summary: Security update for java-1_8_0-openj9

    Details: This update for java-1_8_0-openj9 fixes the following issues: Update to OpenJDK 8u312 build 07 with OpenJ9 0.29.0 virtual machine including Oracle July 2021 and October 2021 CPU changes - CVE-2021-2161: Fixed incorrect handling of partially quoted arguments in ProcessBuilder on Windows (bsc#1185056). - CVE-2021-2163: Fixed incomplete enforcement of JAR signing disabled algorithms (bsc#1185055). - CVE-2021-2341: Fixed flaw inside the FtpClient (bsc#1188564). - CVE-2021-2369: Fixed JAR file handling problem containing multiple MANIFEST.MF files (bsc#1188565). - CVE-2021-2388: Fixed flaw inside the Hotspot component performed range check elimination (bsc#1188566). - CVE-2021-35550: Fixed weak ciphers preferred over stronger ones for TLS (bsc#1191901). - CVE-2021-35556: Fixed excessive memory allocation in RTFParser (bsc#1191910). - CVE-2021-35559: Fixed excessive memory allocation in RTFReader (bsc#1191911). - CVE-2021-35561: Fixed excessive memory allocation in HashMap and HashSet (bsc#1191912). - CVE-2021-35564: Fixed certificates with end dates too far in the future can corrupt keystore (bsc#1191913). - CVE-2021-35565: Fixed loop in HttpsServer triggered during TLS session close (bsc#1191909). - CVE-2021-35567: Fixed incorrect principal selection when using Kerberos Constrained Delegation (bsc#1191903). - CVE-2021-35578: Fixed unexpected exception raised during TLS handshake (bsc#1191904). - CVE-2021-35586: Fixed excessive memory allocation in BMPImageReader (bsc#1191914). - CVE-2021-35603: Fixed non-constant comparison during TLS handshakes (bsc#1191906). This update was imported from the SUSE:SLE-15-SP2:Update update project.

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/GRBHNCR5KDMAYD3N3CDRPQWW3T6HIBNY/, https://bugzilla.suse.com/1185055, https://bugzilla.suse.com/1185056, https://bugzilla.suse.com/1188564, https://bugzilla.suse.com/1188565, https://bugzilla.suse.com/1188566, https://bugzilla.suse.com/1191901, https://bugzilla.suse.com/1191903, https://bugzilla.suse.com/1191904, https://bugzilla.suse.com/1191906, https://bugzilla.suse.com/1191909, https://bugzilla.suse.com/1191910, https://bugzilla.suse.com/1191911, https://bugzilla.suse.com/1191912, https://bugzilla.suse.com/1191913, https://bugzilla.suse.com/1191914, https://www.suse.com/security/cve/CVE-2021-2161, https://www.suse.com/security/cve/CVE-2021-2163, https://www.suse.com/security/cve/CVE-2021-2341, https://www.suse.com/security/cve/CVE-2021-2369, https://www.suse.com/security/cve/CVE-2021-2388, https://www.suse.com/security/cve/CVE-2021-35550, https://www.suse.com/security/cve/CVE-2021-35556, https://www.suse.com/security/cve/CVE-2021-35559, https://www.suse.com/security/cve/CVE-2021-35561, https://www.suse.com/security/cve/CVE-2021-35564, https://www.suse.com/security/cve/CVE-2021-35565, https://www.suse.com/security/cve/CVE-2021-35567, https://www.suse.com/security/cve/CVE-2021-35578, https://www.suse.com/security/cve/CVE-2021-35586, https://www.suse.com/security/cve/CVE-2021-35603

    Affected packages

    Package

    Name: java-1_8_0-openj9

    Purl: pkg:rpm/opensuse/java-1_8_0-openj9&distro=openSUSE%20Leap%2015.2

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.8.0.312-lp152.3.12.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    openSUSE-SU-2021:1455-1 | CVE-DB