OpenJDK, a widely used open-source implementation of Java, recently had several security vulnerabilities patched in Ubuntu. These issues could allow attackers to steal sensitive information or crash systems. In this article, we will delve into the specific vulnerabilities that have been identified and learn how to stay secure.

Recent OpenJDK Vulnerabilities

Here’s a closer look at the vulnerabilities found in OpenJDK 8, OpenJDK 11, OpenJDK 17, OpenJDK 21, and OpenJDK 22.

CVE-2024-21011: A flaw in the Hotspot component, which executes Java bytecode, allowed attackers to potentially crash the system (denial-of-service) by sending specially crafted messages.

CVE-2024-21012: Under certain circumstances, OpenJDK performed faulty reverse DNS queries, potentially revealing sensitive information to attackers. This vulnerability does not exist in OpenJDK 8.

CVE-2024-21068: This vulnerability, discovered by Vladimir Kondratyev, could have been exploited to crash the system or even execute malicious code due to incorrect address handling in the C1 compiler, part of Hotspot.

CVE-2024-21085: Yakov Shafranovich identified a memory management issue in Pack200 archives, a compressed format for Java class libraries. Attackers could have potentially exploited this to crash the system. This issue is not present in OpenJDK 17 and OpenJDK 21.

CVE-2024-21094: Another Hotspot vulnerability, this one related to how the C2 compiler handled array access, could have resulted in a denial-of-service or even arbitrary code execution by attackers.

Staying Secure

The good news is that these OpenJDK vulnerabilities have been addressed. To ensure your system is protected, update your OpenJDK installation to the latest patched version available from your operating system’s package manager.

The Ubuntu security team has released updates to fix these vulnerabilities across various Ubuntu versions, including Ubuntu 24.04 LTS, Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 18.04 ESM. It’s recommended to keep your Ubuntu system updated to benefit from the latest security patches.

However, Ubuntu 18.04 has reached its end of life and no longer receives updates, leaving systems vulnerable to security threats. Users and organizations still relying on Ubuntu 18.04 can utilize TuxCare’s Extended Lifecycle Support for Ubuntu 18.04 to receive security updates beyond the end of life date. This ensures continued protection against vulnerabilities like those affecting OpenJDK and maintains compliance without the immediate need to upgrade to a newer Ubuntu release.

Remember, staying up-to-date with security patches is crucial for maintaining a secure system. Don’t wait – update your OpenJDK installation today!

Source: Ubuntu Security Notice

The post Multiple OpenJDK Vulnerabilities Addressed in Ubuntu appeared first on TuxCare.

*** This is a Security Bloggers Network syndicated blog from TuxCare authored by Rohan Timalsina. Read the original post at: https://tuxcare.com/blog/multiple-openjdk-vulnerabilities-addressed-in-ubuntu/