Red Hat Security Advisory

RHSA-2022:7013

java-11-openjdk security and bug fix update

Released 2022-10-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) java-11-openjdk-demo-fastdebug-1:11.0.17.0.8-2.el9_0, java-11-openjdk-demo-slowdebug-1:11.0.17.0.8-2.el9_0, java-11-openjdk-devel-fastdebug-1:11.0.17.0.8-2.el9_0 +11
Red Hat Enterprise Linux AppStream (v. 9) java-11-openjdk-1:11.0.17.0.8-2.el9_0, java-11-openjdk-demo-1:11.0.17.0.8-2.el9_0, java-11-openjdk-devel-1:11.0.17.0.8-2.el9_0 +6

Fixes 7 records

TI-2022-06007 CVE-2022-21628 · GHSA-34g7-gffm-5gm5

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle…

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02879 Published 2022-10-18 Partial fix

TI-2022-06005 CVE-2022-21626 · GHSA-33pw-h52r-5vpg

Protection mechanism failure in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02433 Published 2022-10-18 Partial fix CWE-693

TI-2022-05997 CVE-2022-21618 · GHSA-wq9f-w2rj-j5wc

Improper authentication in Oracle Java SE JDK and JRE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02811 Published 2022-10-18 Partial fix CWE-287

TI-2022-14547 CVE-2022-33068 · GHSA-cq67-chj5-8385

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows…

LOW 27

An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01189 Published 2022-06-22 Fixed CWE-190

TI-2022-05998 CVE-2022-21619 · GHSA-3ggq-p922-54qp

Improper access control in Oracle Java SE JDK and JRE

LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03328 Published 2022-10-18 Partial fix CWE-284

TI-2022-18771 CVE-2022-39399 · GHSA-pvgf-45fp-3xpp

Improper access control in Oracle Java SE JDK and JRE

LOW 22

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.02037 Published 2022-10-18 Partial fix CWE-284

TI-2022-06003 CVE-2022-21624 · GHSA-h547-5jph-p9qq

Deserialization of untrusted data in Oracle Java SE JDK and JRE

LOW 22

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.01965 Published 2022-10-18 Partial fix CWE-502