[ASA-202107-54] jre11-openjdk-headless: multiple issues

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-54
==========================================

Severity: High
Date    : 2021-07-21
CVE-ID  : CVE-2021-2341 CVE-2021-2369 CVE-2021-2388
Package : jre11-openjdk-headless
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2189

Summary
=======

The package jre11-openjdk-headless before version 11.0.12.u7-1 is
vulnerable to multiple issues including arbitrary code execution and
information disclosure.

Resolution
==========

Upgrade to 11.0.12.u7-1.

# pacman -Syu "jre11-openjdk-headless>=11.0.12.u7-1"

The problems have been fixed upstream in version 11.0.12.u7.

Workaround
==========

None.

Description
===========

- CVE-2021-2341 (information disclosure)

A security issue has been found in the Networking component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows an unauthenticated attacker with network access
via multiple protocols to compromise OpenJDK. Successful attacks
require human interaction from a person other than the attacker.
Successful attacks of this vulnerability can result in unauthorized
read access to a subset of OpenJDK accessible data.

Note: This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

- CVE-2021-2369 (arbitrary code execution)

A security issue has been found in the Library component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. An easily exploitable
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in unauthorized update, insert
or delete access to some of the OpenJDK accessible data.

Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

- CVE-2021-2388 (arbitrary code execution)

A security issue has been found in the Hotspot component of OpenJDK
versions 7u301, 8u291, 11.0.11 and 16.0.1. A difficult to exploit
vulnerability allows unauthenticated attacker with network access via
multiple protocols to compromise OpenJDK. Successful attacks require
human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in takeover of OpenJDK.

Note : This vulnerability applies to Java deployments, typically in
clients running sandboxed Java Web Start applications or sandboxed Java
applets, that load and run untrusted code (e.g., code that comes from
the internet) and rely on the Java sandbox for security. This
vulnerability does not apply to Java deployments, typically in servers,
that load and run only trusted code (e.g., code installed by an
administrator).

Impact
======

A malicious Java application could bypass security restrictions to run
arbitrary code or disclose sensitive information.

References
==========

https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-July/006954.html
https://openjdk.java.net/groups/vulnerability/advisories/2021-07-20
https://www.oracle.com/security-alerts/cpujul2021verbose.html#JAVA
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8258432
https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/ca23657dc7da
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8260967
https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e23ebe923867
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8264066
https://hg.openjdk.java.net/jdk-updates/jdk11u/rev/3588c0c6655e
https://security.archlinux.org/CVE-2021-2341
https://security.archlinux.org/CVE-2021-2369
https://security.archlinux.org/CVE-2021-2388
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210722/e1be11c6/attachment-0001.sig>