SUSE Package Hub - SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-2222

Update Info

SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-2222

Security update for java-11-openjdk

Type: security

Severity: important

Issued: 2023-05-16

Description:

This update for java-11-openjdk fixes the following issues:

Upgrade to upsteam tag jdk-11.0.19+7 (April 2023 CPU):

- CVE-2023-21930: Fixed AES support (bsc#1210628).
- CVE-2023-21937: Fixed String platform support (bsc#1210631).
- CVE-2023-21938: Fixed runtime support (bsc#1210632).
- CVE-2023-21939: Fixed Swing platform support (bsc#1210634). 
- CVE-2023-21954: Fixed object reclamation process (bsc#1210635).
- CVE-2023-21967: Fixed TLS session negotiation (bsc#1210636).
- CVE-2023-21968: Fixed path handling (bsc#1210637).

References

CVE: CVE-2023-21968
CVE: CVE-2023-21967
CVE: CVE-2023-21954
CVE: CVE-2023-21939
CVE: CVE-2023-21938
CVE: CVE-2023-21937
CVE: CVE-2023-21930
Bugzilla: 1210637 VUL-0: CVE-2023-21968: java-1_8_0-ibm,java-1_8_0-openjdk,java-11-openjdk,java-17-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
Bugzilla: 1210636 VUL-0: CVE-2023-21967: java-17-openjdk,java-1_8_0-ibm,java-11-openjdk,java-1_8_0-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
Bugzilla: 1210635 VUL-0: CVE-2023-21954: java-17-openjdk,java-1_8_0-openjdk,java-11-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).
Bugzilla: 1210634 VUL-0: CVE-2023-21939: java-11-openjdk,java-1_8_0-openjdk,java-17-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).
Bugzilla: 1210632 VUL-0: CVE-2023-21938: java-11-openjdk,java-1_8_0-openjdk,java-17-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
Bugzilla: 1210631 VUL-0: CVE-2023-21937: java-11-openjdk,java-17-openjdk,java-1_8_0-openjdk: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).
Bugzilla: 1210628 VUL-0: CVE-2023-21930: java-17-openjdk,java-11-openjdk,java-1_8_0-openjdk: unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition

Packages

java-11-openjdk-11.0.19.0-150000.3.96.1