1. Ubuntu Security Notices
  2. USN-5313-1

USN-5313-1: OpenJDK vulnerabilities

Publication date

7 March 2022

Overview

Several security issues were fixed in OpenJDK.

Releases

Packages

Details

It was discovered that OpenJDK incorrectly handled deserialization filters.
An attacker could possibly use this issue to insert, delete or obtain
sensitive information. (CVE-2022-21248)

It was discovered that OpenJDK incorrectly read uncompressed TIFF files.
An attacker could possibly use this issue to cause a denial of service via
a specially crafted TIFF file. (CVE-2022-21277)

Jonni Passki discovered that OpenJDK incorrectly verified access
restrictions when performing URI resolution. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2022-21282)

It was discovered that OpenJDK incorrectly handled certain regular
expressions in the Pattern class implementation. An attacker could
possibly use this issue to cause a denial of service. (

It was discovered that OpenJDK incorrectly handled deserialization filters.
An attacker could possibly use this issue to insert, delete or obtain
sensitive information. (CVE-2022-21248)

It was discovered that OpenJDK incorrectly read uncompressed TIFF files.
An attacker could possibly use this issue to cause a denial of service via
a specially crafted TIFF file. (CVE-2022-21277)

Jonni Passki discovered that OpenJDK incorrectly verified access
restrictions when performing URI resolution. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2022-21282)

It was discovered that OpenJDK incorrectly handled certain regular
expressions in the Pattern class implementation. An attacker could
possibly use this issue to cause a denial of service. (CVE-2022-21283)

It was discovered that OpenJDK incorrectly handled specially crafted Java
class files. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-21291)

Markus Loewe discovered that OpenJDK incorrectly validated attributes
during object deserialization. An attacker could possibly use this issue
to cause a denial of service. (CVE-2022-21293, CVE-2022-21294)

Dan Rabe discovered that OpenJDK incorrectly verified access permissions
in the JAXP component. An attacker could possibly use this to specially
craft an XML file to obtain sensitive information. (CVE-2022-21296)

It was discovered that OpenJDK incorrectly handled XML entities. An
attacker could use this to specially craft an XML file that, when parsed,
would possibly cause a denial of service. (CVE-2022-21299)

Zhiqiang Zang discovered that OpenJDK incorrectly handled array indexes.
An attacker could possibly use this issue to obtain sensitive information.
(CVE-2022-21305)

It was discovered that OpenJDK incorrectly read very long attributes
values in JAR file manifests. An attacker could possibly use this to
specially craft JAR file to cause a denial of service. (CVE-2022-21340)

It was discovered that OpenJDK incorrectly validated input from serialized
streams. An attacker cold possibly use this issue to bypass sandbox
restrictions. (CVE-2022-21341)

Fabian Meumertzheim discovered that OpenJDK incorrectly handled certain
specially crafted BMP or TIFF files. An attacker could possibly use this
to cause a denial of service. (CVE-2022-21360, CVE-2022-21366)

It was discovered that an integer overflow could be triggered in OpenJDK
BMPImageReader class implementation. An attacker could possibly use this
to specially craft a BMP file to cause a denial of service.
(CVE-2022-21365)

Update instructions

This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any Java applications or applets to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
21.10 impish openjdk-17-jdk –  17.0.2+8-1~22.10
openjdk-17-jre-zero –  17.0.2+8-1~22.10
openjdk-11-jre-zero –  11.0.14+9-0ubuntu2~22.10
openjdk-11-jre-headless –  11.0.14+9-0ubuntu2~22.10
openjdk-11-jdk –  11.0.14+9-0ubuntu2~22.10
openjdk-17-jre-headless –  17.0.2+8-1~22.10
openjdk-11-jre –  11.0.14+9-0ubuntu2~22.10
openjdk-17-jre –  17.0.2+8-1~22.10
20.04 focal openjdk-17-jdk –  17.0.2+8-1~20.04
openjdk-17-jre-zero –  17.0.2+8-1~20.04
openjdk-11-jre-zero –  11.0.14+9-0ubuntu2~20.04
openjdk-11-jre-headless –  11.0.14+9-0ubuntu2~20.04
openjdk-11-jdk –  11.0.14+9-0ubuntu2~20.04
openjdk-17-jre-headless –  17.0.2+8-1~20.04
openjdk-11-jre –  11.0.14+9-0ubuntu2~20.04
openjdk-17-jre –  17.0.2+8-1~20.04
18.04 bionic openjdk-17-jdk –  17.0.2+8-1~18.04
openjdk-17-jre-zero –  17.0.2+8-1~18.04
openjdk-11-jre-zero –  11.0.14+9-0ubuntu2~18.04
openjdk-11-jre-headless –  11.0.14+9-0ubuntu2~18.04
openjdk-11-jdk –  11.0.14+9-0ubuntu2~18.04
openjdk-17-jre-headless –  17.0.2+8-1~18.04
openjdk-11-jre –  11.0.14+9-0ubuntu2~18.04
openjdk-17-jre –  17.0.2+8-1~18.04

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›