-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Moderate: java-1.8.0-openjdk security and bug fix update
Advisory ID:       RHSA-2022:0307-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:0307
Issue date:        2022-01-27
CVE Names:         CVE-2022-21248 CVE-2022-21282 CVE-2022-21283
                   CVE-2022-21293 CVE-2022-21294 CVE-2022-21296
                   CVE-2022-21299 CVE-2022-21305 CVE-2022-21340
                   CVE-2022-21341 CVE-2022-21360 CVE-2022-21365
====================================================================
1. Summary:

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise
Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat CodeReady Linux Builder (v. 8) - aarch64, ppc64le, x86_64
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

* OpenJDK: Incomplete deserialization class filtering in ObjectInputStream
(Serialization, 8264934) (CVE-2022-21248)

* OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP,
8270492) (CVE-2022-21282)

* OpenJDK: Unexpected exception thrown in regex Pattern (Libraries,
8268813) (CVE-2022-21283)

* OpenJDK: Incomplete checks of StringBuffer and StringBuilder during
deserialization (Libraries, 8270392) (CVE-2022-21293)

* OpenJDK: Incorrect IdentityHashMap size checks during deserialization
(Libraries, 8270416) (CVE-2022-21294)

* OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
(CVE-2022-21296)

* OpenJDK: Infinite loop related to incorrect handling of newlines in
XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299)

* OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
(CVE-2022-21305)

* OpenJDK: Excessive resource use when reading JAR manifest attributes
(Libraries, 8272026) (CVE-2022-21340)

* OpenJDK: Insufficient checks when deserializing exceptions in
ObjectInputStream (Serialization, 8272236) (CVE-2022-21341)

* OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
(CVE-2022-21360)

* OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
(CVE-2022-21365)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* Previously, OpenJDK would crash when running the Java Flight Recorder
(JFR) on PowerPC 64 (ppc64) machines. This was found to be due to missing
crash protection in the ppc64 port. With this update, JFR should be run
without crashing on ppc64. (BZ#2038935)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2038935 - OpenJDK crashes when using JFR [rhel-8.5.0.z]
2041400 - CVE-2022-21283 OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813)
2041417 - CVE-2022-21293 OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392)
2041427 - CVE-2022-21294 OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416)
2041435 - CVE-2022-21282 OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492)
2041439 - CVE-2022-21296 OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498)
2041472 - CVE-2022-21299 OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646)
2041491 - CVE-2022-21360 OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756)
2041785 - CVE-2022-21365 OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838)
2041801 - CVE-2022-21248 OpenJDK: Incomplete deserialization class filtering in ObjectInputStream (Serialization, 8264934)
2041878 - CVE-2022-21305 OpenJDK: Array indexing issues in LIRGenerator (Hotspot, 8272014)
2041884 - CVE-2022-21340 OpenJDK: Excessive resource use when reading JAR manifest attributes (Libraries, 8272026)
2041897 - CVE-2022-21341 OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream (Serialization, 8272236)

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.src.rpm

aarch64:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.aarch64.rpm

noarch:
java-1.8.0-openjdk-javadoc-1.8.0.322.b06-2.el8_5.noarch.rpm
java-1.8.0-openjdk-javadoc-zip-1.8.0.322.b06-2.el8_5.noarch.rpm

ppc64le:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.ppc64le.rpm

s390x:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.s390x.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.s390x.rpm

x86_64:
java-1.8.0-openjdk-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-1.8.0.322.b06-2.el8_5.x86_64.rpm

Red Hat CodeReady Linux Builder (v. 8):

aarch64:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.aarch64.rpm

ppc64le:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.ppc64le.rpm

x86_64:
java-1.8.0-openjdk-accessibility-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-debugsource-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-slowdebug-debuginfo-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-fastdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm
java-1.8.0-openjdk-src-slowdebug-1.8.0.322.b06-2.el8_5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-21248
https://access.redhat.com/security/cve/CVE-2022-21282
https://access.redhat.com/security/cve/CVE-2022-21283
https://access.redhat.com/security/cve/CVE-2022-21293
https://access.redhat.com/security/cve/CVE-2022-21294
https://access.redhat.com/security/cve/CVE-2022-21296
https://access.redhat.com/security/cve/CVE-2022-21299
https://access.redhat.com/security/cve/CVE-2022-21305
https://access.redhat.com/security/cve/CVE-2022-21340
https://access.redhat.com/security/cve/CVE-2022-21341
https://access.redhat.com/security/cve/CVE-2022-21360
https://access.redhat.com/security/cve/CVE-2022-21365
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYfLioNzjgjWX9erEAQjQCQ//bKw75UWSZ5JUHzicVtJGE7smTOZd/FxI
LDp0E1FtQvJOUuSLl56ZS/ogE4xrVU3bWF/X9Oee3OS3YqJMdIzqCylKSptqfWri
iXkMUUMrjbRCywsfp2PZVp5GEJUfxNIwjYeTmrDiaKx2v4l56XnXXo/MODaZlfEd
LDQzUQSLFQ79ixHbGcSviyvkhURtNRIBRVzBWWGo/RKnSKwsrBHJ90Hl6qu4mti/
huGb6yFeuRCLvLNz+Jl/L+QEZJ4khBHmPh9CIGNJVjQ5UwHg5L7LGNVCYLnLTV9u
l5C+YFwFWl5yeiF5coqowakrOElEQllBKmUic98+3MZpl2J3RodoCPgnSzyB0xCE
NsGzBYjn6sJHHDOXrhBhucP8nMGgfNyMS6sTf4siBfgW2H509D2csS/xLbXKHWvP
wPPgUHDB8KX7DYdzWND+0ABqUtuc7eFhmTlfjFhsl2/uREaomjSaYRCQ0GYrWrSK
OPk5Y1jnuif46zpMba0qdYYHTVCMqXmDqRAqxKBU9od6u4LuYlBxL4hYgTRethZv
Kri3fKTaFEJ2Gc8C95z5sK2r9Hq9uhD8KwI47bjr2O395BtM5ne52Qr3jS8a7Grj
ZJyb6sC1/bILs5J+s2Ast+VRxFWd374Ohd6I6kvJcNMnjrPm7HlfM0b48xkm0i2j
0bbC4xsM3WcKj1
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce