Vulnerability report for Docker openjdk:8-jdk-oracle

Vulnerabilities	162 via 162 paths
Dependencies	111
Source	Docker
Target OS	oracle:8

Test your Docker Hub image against our market leading vulnerability database Sign up for free

Severity

Critical
High
44
Medium
99
Low
19

Status

Open
162
Patched
0
Ignored
0

high severity

Integer Overflow or Wraparound

Vulnerable module: libksba
Introduced through: libksba@1.3.5-7.el8
Fixed in: 0:1.3.5-8.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libksba@1.3.5-7.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libksba package and not the libksba package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Remediation

Upgrade Oracle:8 libksba to version 0:1.3.5-8.el8_6 or higher.
This issue was patched in ELSA-2022-7089.

References

Integer Overflow or Wraparound vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: libksba
Introduced through: libksba@1.3.5-7.el8
Fixed in: 0:1.3.5-9.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libksba@1.3.5-7.el8

NVD Description

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

Remediation

Upgrade Oracle:8 libksba to version 0:1.3.5-9.el8_7 or higher.
This issue was patched in ELSA-2023-0625.

References

Integer Overflow or Wraparound vulnerability report

high severity

Use After Free

Vulnerable module: systemd-libs
Introduced through: systemd-libs@239-58.0.1.el8_6.3
Fixed in: 0:239-58.0.1.el8_6.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › systemd-libs@239-58.0.1.el8_6.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd-libs package and not the systemd-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later.

Remediation

Upgrade Oracle:8 systemd-libs to version 0:239-58.0.1.el8_6.4 or higher.
This issue was patched in ELSA-2022-6206.

References

Use After Free vulnerability report

high severity

Integer Overflow or Wraparound

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-22.0.1.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-libs package and not the krb5-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-22.0.1.el8_7 or higher.
This issue was patched in ELSA-2022-8638.

References

Integer Overflow or Wraparound vulnerability report

high severity

Use After Free

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-8.0.1.el8_6.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-8.0.1.el8_6.3 or higher.
This issue was patched in ELSA-2022-6878.

References

Use After Free vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-common package and not the glibc-common package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc-minimal-langpack package and not the glibc-minimal-langpack package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Write vulnerability report

high severity

CVE-2023-44487

Vulnerable module: libnghttp2
Introduced through: libnghttp2@1.33.0-3.el8_2.1
Fixed in: 0:1.33.0-5.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libnghttp2@1.33.0-3.el8_2.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libnghttp2 package and not the libnghttp2 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Remediation

Upgrade Oracle:8 libnghttp2 to version 0:1.33.0-5.el8_8 or higher.
This issue was patched in ELSA-2023-5837.

References

CVE-2023-44487 vulnerability report

high severity

Double Free

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 1:1.1.1k-9.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl-libs package and not the openssl-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Remediation

Upgrade Oracle:8 openssl-libs to version 1:1.1.1k-9.el8_7 or higher.
This issue was patched in ELSA-2023-1405.

References

Double Free vulnerability report

high severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-5.0.1.ksplice1.el8_5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-5.0.1.ksplice1.el8_5 or higher.
This issue was patched in ELSA-2022-9243.

References

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability report

high severity

Use After Free

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 1:1.1.1k-9.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

Remediation

Upgrade Oracle:8 openssl-libs to version 1:1.1.1k-9.el8_7 or higher.
This issue was patched in ELSA-2023-1405.

References

Use After Free vulnerability report

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 1:1.1.1k-9.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Remediation

Upgrade Oracle:8 openssl-libs to version 1:1.1.1k-9.el8_7 or higher.
This issue was patched in ELSA-2023-1405.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

high severity

Improper Certificate Validation

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1g-15.ksplice1.el8_3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1g-15.ksplice1.el8_3 or higher.
This issue was patched in ELSA-2021-9151.

References

Improper Certificate Validation vulnerability report

high severity

Out-of-bounds Read

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-bounds Read

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-bounds Read

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Out-of-bounds Read vulnerability report

high severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use After Free

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-225.0.4.el8_8.6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-225.0.4.el8_8.6 or higher.
This issue was patched in ELSA-2023-5455.

References

Use After Free vulnerability report

high severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: libgcrypt
Introduced through: libgcrypt@1.8.5-7.el8_6
Fixed in: 10:1.8.5-7.el8_6_fips

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libgcrypt@1.8.5-7.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt package and not the libgcrypt package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.

Remediation

Upgrade Oracle:8 libgcrypt to version 10:1.8.5-7.el8_6_fips or higher.
This issue was patched in ELSA-2022-9564.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

high severity

Information Exposure

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 1:1.1.1k-9.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.

Remediation

Upgrade Oracle:8 openssl-libs to version 1:1.1.1k-9.el8_7 or higher.
This issue was patched in ELSA-2023-1405.

References

Information Exposure vulnerability report

high severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1g-15.ksplice1.el8_3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1g-15.ksplice1.el8_3 or higher.
This issue was patched in ELSA-2021-9151.

References

NULL Pointer Dereference vulnerability report

high severity

CVE-2024-2961

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-251.0.2.el8_10.1 or higher.
This issue was patched in ELSA-2024-3269.

References

CVE-2024-2961 vulnerability report

high severity

CVE-2024-33599

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33599 vulnerability report

high severity

CVE-2024-33600

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

nscd: Null pointer crashes after notfound response

If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33600 vulnerability report

high severity

CVE-2024-33601

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33601 vulnerability report

high severity

CVE-2024-33602

Vulnerable module: glibc
Introduced through: glibc@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the cache was added to nscd.

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33602 vulnerability report

high severity

CVE-2024-2961

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-251.0.2.el8_10.1 or higher.
This issue was patched in ELSA-2024-3269.

References

CVE-2024-2961 vulnerability report

high severity

CVE-2024-33599

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33599 vulnerability report

high severity

CVE-2024-33600

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

nscd: Null pointer crashes after notfound response

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33600 vulnerability report

high severity

CVE-2024-33601

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33601 vulnerability report

high severity

CVE-2024-33602

Vulnerable module: glibc-common
Introduced through: glibc-common@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-common@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-common to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33602 vulnerability report

high severity

CVE-2024-2961

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-251.0.2.el8_10.1 or higher.
This issue was patched in ELSA-2024-3269.

References

CVE-2024-2961 vulnerability report

high severity

CVE-2024-33599

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

nscd: Stack-based buffer overflow in netgroup cache

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33599 vulnerability report

high severity

CVE-2024-33600

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

nscd: Null pointer crashes after notfound response

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33600 vulnerability report

high severity

CVE-2024-33601

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache may terminate daemon on memory allocation failure

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33601 vulnerability report

high severity

CVE-2024-33602

Vulnerable module: glibc-minimal-langpack
Introduced through: glibc-minimal-langpack@2.28-189.5.0.1.el8_6
Fixed in: 0:2.28-251.0.2.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glibc-minimal-langpack@2.28-189.5.0.1.el8_6

NVD Description

nscd: netgroup cache assumes NSS callback uses in-buffer strings

This vulnerability is only present in the nscd binary.

Remediation

Upgrade Oracle:8 glibc-minimal-langpack to version 0:2.28-251.0.2.el8_10.2 or higher.
This issue was patched in ELSA-2024-3344.

References

CVE-2024-33602 vulnerability report

high severity

CVE-2024-3596

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-30.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-30.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-8860.

References

CVE-2024-3596 vulnerability report

high severity

CVE-2024-5535

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-14.ksplice1.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application.

The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists).

This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem.

In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur.

This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely.

The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-14.ksplice1.el8_6 or higher.
This issue was patched in ELSA-2024-12786.

References

CVE-2024-5535 vulnerability report

high severity

ELSA-2019-4852

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1c-2.ksplice1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1c-2.ksplice1.el8 or higher.
This issue was patched in ELSA-2019-4852.

References

https://linux.oracle.com/errata/ELSA-2019-4852.html

ELSA-2019-4852 vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-15.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-15.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-6989.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-15.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-15.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-6989.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: freetype
Introduced through: freetype@2.9.1-4.el8_3.1
Fixed in: 0:2.9.1-9.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › freetype@2.9.1-4.el8_3.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.

Remediation

Upgrade Oracle:8 freetype to version 0:2.9.1-9.el8 or higher.
This issue was patched in ELSA-2022-7745.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 10:3.6.16-4.0.1.el8_fips

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls package and not the gnutls package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.

Remediation

Upgrade Oracle:8 gnutls to version 10:3.6.16-4.0.1.el8_fips or higher.
This issue was patched in ELSA-2022-9221.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 10:3.6.16-4.0.1.el8_fips

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potential consequences.

Remediation

Upgrade Oracle:8 gnutls to version 10:3.6.16-4.0.1.el8_fips or higher.
This issue was patched in ELSA-2022-9221.

References

Use After Free vulnerability report

medium severity

OS Command Injection

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-7.ksplice1.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-7.ksplice1.el8_6 or higher.
This issue was patched in ELSA-2022-9683.

References

OS Command Injection vulnerability report

medium severity

OS Command Injection

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-7.ksplice1.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-7.ksplice1.el8_6 or higher.
This issue was patched in ELSA-2022-9683.

References

OS Command Injection vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: sqlite-libs
Introduced through: sqlite-libs@3.26.0-15.el8
Fixed in: 0:3.26.0-16.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › sqlite-libs@3.26.0-15.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite-libs package and not the sqlite-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE for views that have a nested FROM clause.

Remediation

Upgrade Oracle:8 sqlite-libs to version 0:3.26.0-16.el8_6 or higher.
This issue was patched in ELSA-2022-7108.

References

Out-of-Bounds vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: zlib
Introduced through: zlib@1.2.11-18.el8_5
Fixed in: 0:1.2.11-19.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › zlib@1.2.11-18.el8_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Remediation

Upgrade Oracle:8 zlib to version 0:1.2.11-19.el8_6 or higher.
This issue was patched in ELSA-2022-7106.

References

Out-of-bounds Write vulnerability report

medium severity

CVE-2024-37371

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-29.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-29.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-5312.

References

CVE-2024-37371 vulnerability report

medium severity

Off-by-one Error

Vulnerable module: libtasn1
Introduced through: libtasn1@4.13-3.el8
Fixed in: 0:4.13-4.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libtasn1@4.13-3.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libtasn1 package and not the libtasn1 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.

Remediation

Upgrade Oracle:8 libtasn1 to version 0:4.13-4.el8_7 or higher.
This issue was patched in ELSA-2023-0116.

References

Off-by-one Error vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Out-of-bounds Write vulnerability report

medium severity

Use After Free

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5, iTunes 12.12.4 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, tvOS 15.5, watchOS 8.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Use After Free vulnerability report

medium severity

Use After Free

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libcap
Introduced through: libcap@2.48-2.el8
Fixed in: 0:2.48-5.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcap@2.48-2.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap package and not the libcap package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

Remediation

Upgrade Oracle:8 libcap to version 0:2.48-5.el8_8 or higher.
This issue was patched in ELSA-2023-4524.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: libcom_err
Introduced through: libcom_err@1.45.6-4.el8
Fixed in: 0:1.45.6-5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcom_err@1.45.6-4.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcom_err package and not the libcom_err package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Remediation

Upgrade Oracle:8 libcom_err to version 0:1.45.6-5.el8 or higher.
This issue was patched in ELSA-2022-7720.

References

Out-of-bounds Read vulnerability report

medium severity

Double Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-15.el8_7.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-15.el8_7.1 or higher.
This issue was patched in ELSA-2023-0173.

References

Double Free vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses-base
Introduced through: ncurses-base@6.1-9.20180224.el8
Fixed in: 0:6.1-9.20180224.el8_8.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › ncurses-base@6.1-9.20180224.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-base package and not the ncurses-base package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

Upgrade Oracle:8 ncurses-base to version 0:6.1-9.20180224.el8_8.1 or higher.
This issue was patched in ELSA-2023-5249.

References

Out-of-bounds Write vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: ncurses-libs
Introduced through: ncurses-libs@6.1-9.20180224.el8
Fixed in: 0:6.1-9.20180224.el8_8.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › ncurses-libs@6.1-9.20180224.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses-libs package and not the ncurses-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 ncurses-libs to version 0:6.1-9.20180224.el8_8.1 or higher.
This issue was patched in ELSA-2023-5249.

References

Out-of-bounds Write vulnerability report

medium severity

CVE-2023-26604

Vulnerable module: systemd-libs
Introduced through: systemd-libs@239-58.0.1.el8_6.3
Fixed in: 0:239-74.0.4.el8_8.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › systemd-libs@239-58.0.1.el8_6.3

NVD Description

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

Upgrade Oracle:8 systemd-libs to version 0:239-74.0.4.el8_8.2 or higher.
This issue was patched in ELSA-2023-3837.

References

CVE-2023-26604 vulnerability report

medium severity

Resource Exhaustion

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-11.0.1.el8_9.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-11.0.1.el8_9.1 or higher.
This issue was patched in ELSA-2024-1615.

References

Resource Exhaustion vulnerability report

medium severity

Use After Free

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-10.0.1.el8_7.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-10.0.1.el8_7.1 or higher.
This issue was patched in ELSA-2023-0103.

References

Use After Free vulnerability report

medium severity

XML External Entity (XXE) Injection

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-15.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-15.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-6989.

References

XML External Entity (XXE) Injection vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: freetype
Introduced through: freetype@2.9.1-4.el8_3.1
Fixed in: 0:2.9.1-9.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › freetype@2.9.1-4.el8_3.1

NVD Description

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.

Remediation

Upgrade Oracle:8 freetype to version 0:2.9.1-9.el8 or higher.
This issue was patched in ELSA-2022-7745.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: freetype
Introduced through: freetype@2.9.1-4.el8_3.1
Fixed in: 0:2.9.1-9.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › freetype@2.9.1-4.el8_3.1

NVD Description

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

Remediation

Upgrade Oracle:8 freetype to version 0:2.9.1-9.el8 or higher.
This issue was patched in ELSA-2022-7745.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

Out-of-bounds Write vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: gmp
Introduced through: gmp@1:6.1.2-10.el8
Fixed in: 1:6.1.2-11.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gmp@1:6.1.2-10.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream gmp package and not the gmp package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

Remediation

Upgrade Oracle:8 gmp to version 1:6.1.2-11.el8 or higher.
This issue was patched in ELSA-2024-3214.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Double Free

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 0:3.6.16-5.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Remediation

Upgrade Oracle:8 gnutls to version 0:3.6.16-5.el8_6 or higher.
This issue was patched in ELSA-2022-7105.

References

Double Free vulnerability report

medium severity

Improper Input Validation

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 10:3.6.16-4.0.1.el8_fips

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

Remediation

Upgrade Oracle:8 gnutls to version 10:3.6.16-4.0.1.el8_fips or higher.
This issue was patched in ELSA-2022-9221.

References

Improper Input Validation vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 10:3.6.16-8.el8_9.1_fips

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Remediation

Upgrade Oracle:8 gnutls to version 10:3.6.16-8.el8_9.1_fips or higher.
This issue was patched in ELSA-2024-12135.

References

Information Exposure vulnerability report

medium severity

CVE-2024-37370

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-29.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-29.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-5312.

References

CVE-2024-37370 vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-15.el8_7.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-15.el8_7.1 or higher.
This issue was patched in ELSA-2023-0173.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Use After Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-18.el8_10.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-18.el8_10.1 or higher.
This issue was patched in ELSA-2024-3626.

References

Use After Free vulnerability report

medium severity

Integer Overflow or Wraparound

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-4.ksplice1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-4.ksplice1.el8 or higher.
This issue was patched in ELSA-2021-9561.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Improper Validation of Array Index

Vulnerable module: sqlite-libs
Introduced through: sqlite-libs@3.26.0-15.el8
Fixed in: 0:3.26.0-17.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › sqlite-libs@3.26.0-15.el8

NVD Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Remediation

Upgrade Oracle:8 sqlite-libs to version 0:3.26.0-17.el8_7 or higher.
This issue was patched in ELSA-2023-0110.

References

Improper Validation of Array Index vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: sqlite-libs
Introduced through: sqlite-libs@3.26.0-15.el8
Fixed in: 0:3.26.0-16.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › sqlite-libs@3.26.0-15.el8

NVD Description

In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing.

Remediation

Upgrade Oracle:8 sqlite-libs to version 0:3.26.0-16.el8_6 or higher.
This issue was patched in ELSA-2022-7108.

References

NULL Pointer Dereference vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 0:3.6.16-6.el8_7

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

Remediation

Upgrade Oracle:8 gnutls to version 0:3.6.16-6.el8_7 or higher.
This issue was patched in ELSA-2023-1569.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-5.ksplice1.el8_5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-5.ksplice1.el8_5 or higher.
This issue was patched in ELSA-2021-9632.

References

Out-of-bounds Read vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: sqlite-libs
Introduced through: sqlite-libs@3.26.0-15.el8
Fixed in: 0:3.26.0-19.0.1.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › sqlite-libs@3.26.0-15.el8

NVD Description

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.

Remediation

Upgrade Oracle:8 sqlite-libs to version 0:3.26.0-19.0.1.el8_9 or higher.
This issue was patched in ELSA-2024-0253.

References

Out-of-Bounds vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm@4.14.3-23.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm package and not the rpm package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade Oracle:8 rpm to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm
Introduced through: rpm@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm@4.14.3-23.el8

NVD Description

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade Oracle:8 rpm to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm-libs@4.14.3-23.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream rpm-libs package and not the rpm-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 rpm-libs to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Link Following vulnerability report

medium severity

Link Following

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm-libs@4.14.3-23.el8

NVD Description

Remediation

Upgrade Oracle:8 rpm-libs to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Link Following vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-22.el8_6.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a "malloc bomb", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-22.el8_6.4 or higher.
This issue was patched in ELSA-2022-6159.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-25.el8_7.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-25.el8_7.3 or higher.
This issue was patched in ELSA-2023-1140.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

CVE-2023-46218

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.

It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-46218 vulnerability report

medium severity

CVE-2022-22662

Vulnerable module: glib2
Introduced through: glib2@2.56.4-158.el8
Fixed in: 0:2.56.4-159.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › glib2@2.56.4-158.el8

NVD Description

A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.

Remediation

Upgrade Oracle:8 glib2 to version 0:2.56.4-159.0.1.el8 or higher.
This issue was patched in ELSA-2022-7704.

References

CVE-2022-22662 vulnerability report

medium severity

Arbitrary Code Injection

Vulnerable module: gnupg2
Introduced through: gnupg2@2.2.20-2.el8
Fixed in: 0:2.2.20-3.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnupg2@2.2.20-2.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.

Remediation

Upgrade Oracle:8 gnupg2 to version 0:2.2.20-3.el8_6 or higher.
This issue was patched in ELSA-2022-6463.

References

Arbitrary Code Injection vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-22.el8_6.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcurl package and not the libcurl package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-22.el8_6.4 or higher.
This issue was patched in ELSA-2022-6159.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-25.el8_7.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-25.el8_7.3 or higher.
This issue was patched in ELSA-2023-1140.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

CVE-2023-46218

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-46218 vulnerability report

medium severity

Improper Authentication

Vulnerable module: libssh
Introduced through: libssh@0.9.6-3.el8
Fixed in: 0:0.9.6-10.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh@0.9.6-3.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh package and not the libssh package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepki_verify_data_signature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value rc, which is initialized to SSH_ERROR and later rewritten to save the return value of the function call pki_key_check_hash_compatible. The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls goto error returning SSH_OK.

Remediation

Upgrade Oracle:8 libssh to version 0:0.9.6-10.el8_8 or higher.
This issue was patched in ELSA-2023-3839.

References

Improper Authentication vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libssh
Introduced through: libssh@0.9.6-3.el8
Fixed in: 0:0.9.6-10.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh@0.9.6-3.el8

NVD Description

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

Remediation

Upgrade Oracle:8 libssh to version 0:0.9.6-10.el8_8 or higher.
This issue was patched in ELSA-2023-3839.

References

NULL Pointer Dereference vulnerability report

medium severity

Improper Authentication

Vulnerable module: libssh-config
Introduced through: libssh-config@0.9.6-3.el8
Fixed in: 0:0.9.6-10.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh-config@0.9.6-3.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh-config package and not the libssh-config package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 libssh-config to version 0:0.9.6-10.el8_8 or higher.
This issue was patched in ELSA-2023-3839.

References

Improper Authentication vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libssh-config
Introduced through: libssh-config@0.9.6-3.el8
Fixed in: 0:0.9.6-10.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh-config@0.9.6-3.el8

NVD Description

A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.

Remediation

Upgrade Oracle:8 libssh-config to version 0:0.9.6-10.el8_8 or higher.
This issue was patched in ELSA-2023-3839.

References

NULL Pointer Dereference vulnerability report

medium severity

Double Free

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-16.el8_8.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value).

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-16.el8_8.1 or higher.
This issue was patched in ELSA-2023-4529.

References

Double Free vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-16.el8_8.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-16.el8_8.1 or higher.
This issue was patched in ELSA-2023-4529.

References

NULL Pointer Dereference vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-18.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support the legacy SAX1 interface with custom callbacks; there is a crash even without crafted input.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-18.el8_9 or higher.
This issue was patched in ELSA-2024-0119.

References

Out-of-Bounds vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: rpm
Introduced through: rpm@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm@4.14.3-23.el8

NVD Description

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Remediation

Upgrade Oracle:8 rpm to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: rpm-libs
Introduced through: rpm-libs@4.14.3-23.el8
Fixed in: 0:4.14.3-28.0.2.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › rpm-libs@4.14.3-23.el8

NVD Description

Remediation

Upgrade Oracle:8 rpm-libs to version 0:4.14.3-28.0.2.el8_9 or higher.
This issue was patched in ELSA-2024-0647.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Cross-site Scripting (XSS)

Vulnerable module: libxml2
Introduced through: libxml2@2.9.7-13.el8_6.1
Fixed in: 0:2.9.7-15.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libxml2@2.9.7-13.el8_6.1

NVD Description

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Remediation

Upgrade Oracle:8 libxml2 to version 0:2.9.7-15.el8 or higher.
This issue was patched in ELSA-2022-7715.

References

Cross-site Scripting (XSS) vulnerability report

medium severity

Improper Authentication

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials being used during subsequent transfers. Previously created connections are kept in a connection pool for reuse if they match the current setup. However, certain FTP settings such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration match checks, causing them to match too easily. This could lead to libcurl using the wrong credentials when performing a transfer, potentially allowing unauthorized access to sensitive information.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-30.el8_8.2 or higher.
This issue was patched in ELSA-2023-3106.

References

Improper Authentication vulnerability report

medium severity

Improper Authentication

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-30.el8_8.3 or higher.
This issue was patched in ELSA-2023-4523.

References

Improper Authentication vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with xn-- and should not be allowed to pattern match, but the wildcard check in curl could still check for x*, which would match even though the IDN name most likely contained nothing even resembling an x.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-30.el8_8.3 or higher.
This issue was patched in ELSA-2023-4523.

References

Improper Certificate Validation vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-22.el8_6.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-22.el8_6.4 or higher.
This issue was patched in ELSA-2022-6159.

References

Out-of-bounds Write vulnerability report

medium severity

Information Exposure

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 0:3.6.16-8.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding.

Remediation

Upgrade Oracle:8 gnutls to version 0:3.6.16-8.el8_9 or higher.
This issue was patched in ELSA-2024-0155.

References

Information Exposure vulnerability report

medium severity

Improper Authentication

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-30.el8_8.2 or higher.
This issue was patched in ELSA-2023-3106.

References

Improper Authentication vulnerability report

medium severity

Improper Authentication

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-30.el8_8.3 or higher.
This issue was patched in ELSA-2023-4523.

References

Improper Authentication vulnerability report

medium severity

Improper Certificate Validation

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8_8.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-30.el8_8.3 or higher.
This issue was patched in ELSA-2023-4523.

References

Improper Certificate Validation vulnerability report

medium severity

Out-of-bounds Write

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-22.el8_6.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-22.el8_6.4 or higher.
This issue was patched in ELSA-2022-6159.

References

Out-of-bounds Write vulnerability report

medium severity

Improper Validation of Integrity Check Value

Vulnerable module: libssh
Introduced through: libssh@0.9.6-3.el8
Fixed in: 0:0.9.6-13.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh@0.9.6-3.el8

NVD Description

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Remediation

Upgrade Oracle:8 libssh to version 0:0.9.6-13.el8_9 or higher.
This issue was patched in ELSA-2024-0628.

References

Improper Validation of Integrity Check Value vulnerability report

medium severity

Improper Validation of Integrity Check Value

Vulnerable module: libssh-config
Introduced through: libssh-config@0.9.6-3.el8
Fixed in: 0:0.9.6-13.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh-config@0.9.6-3.el8

NVD Description

Remediation

Upgrade Oracle:8 libssh-config to version 0:0.9.6-13.el8_9 or higher.
This issue was patched in ELSA-2024-0628.

References

Improper Validation of Integrity Check Value vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-4.ksplice1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-4.ksplice1.el8 or higher.
This issue was patched in ELSA-2021-9561.

References

NULL Pointer Dereference vulnerability report

medium severity

CVE-2023-7008

Vulnerable module: systemd-libs
Introduced through: systemd-libs@239-58.0.1.el8_6.3
Fixed in: 0:239-82.0.1.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › systemd-libs@239-58.0.1.el8_6.3

NVD Description

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.

Remediation

Upgrade Oracle:8 systemd-libs to version 0:239-82.0.1.el8 or higher.
This issue was patched in ELSA-2024-3203.

References

CVE-2023-7008 vulnerability report

medium severity

NULL Pointer Dereference

Vulnerable module: binutils
Introduced through: binutils@2.30-113.0.2.el8
Fixed in: 0:2.30-119.0.2.el8_8.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › binutils@2.30-113.0.2.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.

Remediation

Upgrade Oracle:8 binutils to version 0:2.30-119.0.2.el8_8.2 or higher.
This issue was patched in ELSA-2023-6236.

References

NULL Pointer Dereference vulnerability report

medium severity

Buffer Overflow

Vulnerable module: sqlite-libs
Introduced through: sqlite-libs@3.26.0-15.el8
Fixed in: 0:3.26.0-18.0.1.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › sqlite-libs@3.26.0-15.el8

NVD Description

Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script.

Remediation

Upgrade Oracle:8 sqlite-libs to version 0:3.26.0-18.0.1.el8_8 or higher.
This issue was patched in ELSA-2023-3840.

References

Buffer Overflow vulnerability report

medium severity

CVE-2022-4415

Vulnerable module: systemd-libs
Introduced through: systemd-libs@239-58.0.1.el8_6.3
Fixed in: 0:239-68.0.2.el8_7.4

Detailed paths

Introduced through: openjdk@8-jdk-oracle › systemd-libs@239-58.0.1.el8_6.3

NVD Description

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.

Remediation

Upgrade Oracle:8 systemd-libs to version 0:239-68.0.2.el8_7.4 or higher.
This issue was patched in ELSA-2023-0837.

References

CVE-2022-4415 vulnerability report

medium severity

Off-by-one Error

Vulnerable module: systemd-libs
Introduced through: systemd-libs@239-58.0.1.el8_6.3
Fixed in: 0:239-68.0.2.el8_7.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › systemd-libs@239-58.0.1.el8_6.3

NVD Description

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

Remediation

Upgrade Oracle:8 systemd-libs to version 0:239-68.0.2.el8_7.1 or higher.
This issue was patched in ELSA-2023-0100.

References

Off-by-one Error vulnerability report

medium severity

Out-of-bounds Read

Vulnerable module: tar
Introduced through: tar@2:1.30-5.el8
Fixed in: 2:1.30-6.el8_7.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › tar@2:1.30-5.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Remediation

Upgrade Oracle:8 tar to version 2:1.30-6.el8_7.1 or higher.
This issue was patched in ELSA-2023-0842.

References

Out-of-bounds Read vulnerability report

medium severity

Excessive Iteration

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-12.ksplice1.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-12.ksplice1.el8_9 or higher.
This issue was patched in ELSA-2024-12056.

References

Excessive Iteration vulnerability report

medium severity

Improper Check for Unusual or Exceptional Conditions

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-12.ksplice1.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

While DH_check() performs all the necessary checks (as of CVE-2023-3817), DH_check_pub_key() doesn't make any of these checks, and is therefore vulnerable for excessively large P and Q parameters.

Likewise, while DH_generate_key() performs a check for an excessively large P, it doesn't check for an excessively large Q.

An application that calls DH_generate_key() or DH_check_pub_key() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

DH_generate_key() and DH_check_pub_key() are also called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().

Also vulnerable are the OpenSSL pkey command line application when using the "-pubcheck" option, as well as the OpenSSL genpkey command line application.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-12.ksplice1.el8_9 or higher.
This issue was patched in ELSA-2024-12056.

References

Improper Check for Unusual or Exceptional Conditions vulnerability report

medium severity

Inefficient Regular Expression Complexity

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-12.ksplice1.el8_9

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

Issue summary: Checking excessively long DH keys or parameters may be very slow.

The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length.

However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack.

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option.

The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-12.ksplice1.el8_9 or higher.
This issue was patched in ELSA-2024-12056.

References

Inefficient Regular Expression Complexity vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: openssl-libs
Introduced through: openssl-libs@1:1.1.1k-7.el8_6
Fixed in: 2:1.1.1k-7.ksplice1.el8_6

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openssl-libs@1:1.1.1k-7.el8_6

NVD Description

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Remediation

Upgrade Oracle:8 openssl-libs to version 2:1.1.1k-7.ksplice1.el8_6 or higher.
This issue was patched in ELSA-2022-9683.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

CVE-2023-28322

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-28322 vulnerability report

medium severity

CVE-2023-38546

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl. And if using the correct file format of course.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-38546 vulnerability report

medium severity

CVE-2023-28322

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-28322 vulnerability report

medium severity

CVE-2023-38546

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-33.el8_9.5

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

libcurl performs transfers. In its API, an application creates "easy handles" that are the individual handles for single transfers.

libcurl provides a function call that duplicates en easy handle called curl_easy_duphandle.

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-33.el8_9.5 or higher.
This issue was patched in ELSA-2024-1601.

References

CVE-2023-38546 vulnerability report

medium severity

Memory Leak

Vulnerable module: libcap
Introduced through: libcap@2.48-2.el8
Fixed in: 0:2.48-5.el8_8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcap@2.48-2.el8

NVD Description

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

Remediation

Upgrade Oracle:8 libcap to version 0:2.48-5.el8_8 or higher.
This issue was patched in ELSA-2023-4524.

References

Memory Leak vulnerability report

medium severity

CVE-2024-2398

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-34.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-34.el8_10.2 or higher.
This issue was patched in ELSA-2024-5654.

References

CVE-2024-2398 vulnerability report

medium severity

CVE-2024-50602

Vulnerable module: expat
Introduced through: expat@2.2.5-8.0.1.el8_6.2
Fixed in: 0:2.2.5-16.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › expat@2.2.5-8.0.1.el8_6.2

NVD Description

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

Remediation

Upgrade Oracle:8 expat to version 0:2.2.5-16.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-9502.

References

CVE-2024-50602 vulnerability report

medium severity

Use of a Broken or Risky Cryptographic Algorithm

Vulnerable module: gnutls
Introduced through: gnutls@3.6.16-4.el8
Fixed in: 0:3.6.16-8.el8_9.3

Detailed paths

Introduced through: openjdk@8-jdk-oracle › gnutls@3.6.16-4.el8

NVD Description

A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel.

Remediation

Upgrade Oracle:8 gnutls to version 0:3.6.16-8.el8_9.3 or higher.
This issue was patched in ELSA-2024-1784.

References

Use of a Broken or Risky Cryptographic Algorithm vulnerability report

medium severity

CVE-2024-2398

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-34.el8_10.2

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-34.el8_10.2 or higher.
This issue was patched in ELSA-2024-5654.

References

CVE-2024-2398 vulnerability report

medium severity

CVE-2024-28182

Vulnerable module: libnghttp2
Introduced through: libnghttp2@1.33.0-3.el8_2.1
Fixed in: 0:1.33.0-6.el8_10.1

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libnghttp2@1.33.0-3.el8_2.1

NVD Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Remediation

Upgrade Oracle:8 libnghttp2 to version 0:1.33.0-6.el8_10.1 or higher.
This issue was patched in ELSA-2024-4252.

References

CVE-2024-28182 vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: binutils
Introduced through: binutils@2.30-113.0.2.el8
Fixed in: 0:2.30-125.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › binutils@2.30-113.0.2.el8

NVD Description

finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write of 8 bytes. This can occur during execution of objdump.

Remediation

Upgrade Oracle:8 binutils to version 0:2.30-125.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-9689.

References

Out-of-bounds Write vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: bzip2-libs
Introduced through: bzip2-libs@1.0.6-26.el8
Fixed in: 0:1.0.6-27.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › bzip2-libs@1.0.6-26.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2-libs package and not the bzip2-libs package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Remediation

Upgrade Oracle:8 bzip2-libs to version 0:1.0.6-27.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-8922.

References

Out-of-bounds Write vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: libarchive
Introduced through: libarchive@3.3.3-3.el8_5
Fixed in: 0:3.3.3-5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libarchive@3.3.3-3.el8_5

NVD Description

Note: Versions mentioned in the description apply only to the upstream libarchive package and not the libarchive package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: "In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution."

Remediation

Upgrade Oracle:8 libarchive to version 0:3.3.3-5.el8 or higher.
This issue was patched in ELSA-2023-3018.

References

NULL Pointer Dereference vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: openldap
Introduced through: openldap@2.4.46-18.el8
Fixed in: 0:2.4.46-19.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › openldap@2.4.46-18.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Remediation

Upgrade Oracle:8 openldap to version 0:2.4.46-19.el8_10 or higher.
This issue was patched in ELSA-2024-4264.

References

NULL Pointer Dereference vulnerability report

low severity

Information Exposure

Vulnerable module: libgcc
Introduced through: libgcc@8.5.0-10.1.0.1.el8_6
Fixed in: 0:8.5.0-18.0.5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libgcc@8.5.0-10.1.0.1.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcc package and not the libgcc package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

Remediation

Upgrade Oracle:8 libgcc to version 0:8.5.0-18.0.5.el8 or higher.
This issue was patched in ELSA-2023-12788.

References

Information Exposure vulnerability report

low severity

Information Exposure

Vulnerable module: libstdc++
Introduced through: libstdc++@8.5.0-10.1.0.1.el8_6
Fixed in: 0:8.5.0-18.0.5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libstdc++@8.5.0-10.1.0.1.el8_6

NVD Description

Note: Versions mentioned in the description apply only to the upstream libstdc++ package and not the libstdc++ package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Remediation

Upgrade Oracle:8 libstdc++ to version 0:8.5.0-18.0.5.el8 or higher.
This issue was patched in ELSA-2023-12788.

References

Information Exposure vulnerability report

low severity

Use After Free

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

A use after free vulnerability exists in curl <7.87.0. Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-30.el8 or higher.
This issue was patched in ELSA-2023-2963.

References

Use After Free vulnerability report

low severity

Use After Free

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-30.el8 or higher.
This issue was patched in ELSA-2023-2963.

References

Use After Free vulnerability report

low severity

Improper Authentication

Vulnerable module: shadow-utils
Introduced through: shadow-utils@2:4.6-16.el8
Fixed in: 2:4.6-19.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › shadow-utils@2:4.6-16.el8

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow-utils package and not the shadow-utils package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.

Remediation

Upgrade Oracle:8 shadow-utils to version 2:4.6-19.el8 or higher.
This issue was patched in ELSA-2023-7112.

References

Improper Authentication vulnerability report

low severity

Unchecked Return Value

Vulnerable module: libssh
Introduced through: libssh@0.9.6-3.el8
Fixed in: 0:0.9.6-14.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh@0.9.6-3.el8

NVD Description

A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by different supported crypto backends. The return values from these were not properly checked, which could cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures, terminating the connection.

Remediation

Upgrade Oracle:8 libssh to version 0:0.9.6-14.el8 or higher.
This issue was patched in ELSA-2024-3233.

References

Unchecked Return Value vulnerability report

low severity

Unchecked Return Value

Vulnerable module: libssh-config
Introduced through: libssh-config@0.9.6-3.el8
Fixed in: 0:0.9.6-14.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh-config@0.9.6-3.el8

NVD Description

Remediation

Upgrade Oracle:8 libssh-config to version 0:0.9.6-14.el8 or higher.
This issue was patched in ELSA-2024-3233.

References

Unchecked Return Value vulnerability report

low severity

CVE-2023-4039

Vulnerable module: libgcc
Introduced through: libgcc@8.5.0-10.1.0.1.el8_6
Fixed in: 0:8.5.0-18.0.5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libgcc@8.5.0-10.1.0.1.el8_6

NVD Description

DISPUTEDA failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables.

The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself.

Remediation

Upgrade Oracle:8 libgcc to version 0:8.5.0-18.0.5.el8 or higher.
This issue was patched in ELSA-2023-12788.

References

CVE-2023-4039 vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: libssh
Introduced through: libssh@0.9.6-3.el8
Fixed in: 0:0.9.6-14.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh@0.9.6-3.el8

NVD Description

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.

Remediation

Upgrade Oracle:8 libssh to version 0:0.9.6-14.el8 or higher.
This issue was patched in ELSA-2024-3233.

References

Arbitrary Code Injection vulnerability report

low severity

Arbitrary Code Injection

Vulnerable module: libssh-config
Introduced through: libssh-config@0.9.6-3.el8
Fixed in: 0:0.9.6-14.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libssh-config@0.9.6-3.el8

NVD Description

Remediation

Upgrade Oracle:8 libssh-config to version 0:0.9.6-14.el8 or higher.
This issue was patched in ELSA-2024-3233.

References

Arbitrary Code Injection vulnerability report

low severity

CVE-2023-4039

Vulnerable module: libstdc++
Introduced through: libstdc++@8.5.0-10.1.0.1.el8_6
Fixed in: 0:8.5.0-18.0.5.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libstdc++@8.5.0-10.1.0.1.el8_6

NVD Description

Remediation

Upgrade Oracle:8 libstdc++ to version 0:8.5.0-18.0.5.el8 or higher.
This issue was patched in ELSA-2023-12788.

References

CVE-2023-4039 vulnerability report

low severity

CVE-2022-35252

Vulnerable module: curl
Introduced through: curl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › curl@7.61.1-22.el8_6.3

NVD Description

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

Remediation

Upgrade Oracle:8 curl to version 0:7.61.1-30.el8 or higher.
This issue was patched in ELSA-2023-2963.

References

CVE-2022-35252 vulnerability report

low severity

CVE-2022-35252

Vulnerable module: libcurl
Introduced through: libcurl@7.61.1-22.el8_6.3
Fixed in: 0:7.61.1-30.el8

Detailed paths

Introduced through: openjdk@8-jdk-oracle › libcurl@7.61.1-22.el8_6.3

NVD Description

Remediation

Upgrade Oracle:8 libcurl to version 0:7.61.1-30.el8 or higher.
This issue was patched in ELSA-2023-2963.

References

CVE-2022-35252 vulnerability report

low severity

CVE-2024-26458

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-27.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-27.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-3268.

References

CVE-2024-26458 vulnerability report

low severity

CVE-2024-26461

Vulnerable module: krb5-libs
Introduced through: krb5-libs@1.18.2-14.0.1.el8
Fixed in: 0:1.18.2-27.0.1.el8_10

Detailed paths

Introduced through: openjdk@8-jdk-oracle › krb5-libs@1.18.2-14.0.1.el8

NVD Description

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

Remediation

Upgrade Oracle:8 krb5-libs to version 0:1.18.2-27.0.1.el8_10 or higher.
This issue was patched in ELSA-2024-3268.

References

CVE-2024-26461 vulnerability report

Vulnerabilities

Dependencies

Source

Target OS

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Use After Free

Detailed paths

NVD Description

Remediation

References

high severity

Integer Overflow or Wraparound

Detailed paths

NVD Description

Remediation

References

high severity

Use After Free

Detailed paths

NVD Description

Remediation

References

high severity

Out-of-bounds Write

Detailed paths

NVD Description

Remediation

References

high severity

Out-of-bounds Write

Detailed paths

NVD Description

Remediation

References

high severity

Out-of-bounds Write

Detailed paths

NVD Description

Remediation

References

high severity

CVE-2023-44487

Detailed paths

NVD Description

Remediation

References

high severity

Double Free

Detailed paths

NVD Description

Remediation

References

high severity

Loop with Unreachable Exit Condition ('Infinite Loop')

Detailed paths

NVD Description

Remediation

References

high severity

Use After Free

Detailed paths

NVD Description

Remediation

References

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

Detailed paths

NVD Description