SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4078

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2022-4078

Security update for java-11-openjdk

Type: security

Severity: moderate

Issued: 2022-11-18

Description:

This update for java-11-openjdk fixes the following issues:

- Update to jdk-11.0.17+8 (October 2022 CPU)
- CVE-2022-39399: Improve HTTP/2 client usage(bsc#1204480)
- CVE-2022-21628: Better HttpServer service (bsc#1204472)
- CVE-2022-21624: Enhance icon presentations (bsc#1204475)
- CVE-2022-21619: Improve NTLM support (bsc#1204473)
- CVE-2022-21626: Key X509 usages (bsc#1204471)
- CVE-2022-21618: Wider MultiByte (bsc#1204468)

References

CVE: CVE-2022-39399
CVE: CVE-2022-21628
CVE: CVE-2022-21626
CVE: CVE-2022-21624
CVE: CVE-2022-21619
CVE: CVE-2022-21618
Bugzilla: 1204523 L3: JIT memory issue in 11.0.16.0-150000.3.83.1 [ref:_00D1igLOd._5005qDdCkU:ref]
Bugzilla: 1204480 VUL-0: CVE-2022-39399: java-11-openjdk,java-17-openjdk: unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
Bugzilla: 1204475 VUL-0: CVE-2022-21624: java-1_8_0-openjdk-plugin,java-10-openjdk,java-1_8_0-openjdk,java-11-openjdk,java-1_8_0-ibm,java-17-openjdk: unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise
Bugzilla: 1204473 VUL-0: CVE-2022-21619: java-1_8_0-openjdk,java-17-openjdk,java-11-openjdk: unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE
Bugzilla: 1204472 VUL-0: CVE-2022-21628: java-1_8_0-openjdk,java-17-openjdk,java-11-openjdk: unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
Bugzilla: 1204471 VUL-0: CVE-2022-21626: java-1_8_0-openjdk,java-11-openjdk: unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
Bugzilla: 1204468 VUL-0: CVE-2022-21618: java-17-openjdk: JGSS: unauthenticated attacker with network access via Kerberos can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
Bugzilla: 1203476 openjdk-11 and openjdk-17 Can't work with Eclipse 2022-09 because of missing file in openjdk

Packages

java-11-openjdk-11.0.17.0-150000.3.86.2