SUSE-CU-2026:13720-1: Security update of bci/openjdk-devel

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13720-1
Container Tags        : bci/openjdk-devel:21 , bci/openjdk-devel:21-sles15 , bci/openjdk-devel:21.0.12.1 , bci/openjdk-devel:21.0.12.1-25.91
Container Release     : 25.91
Severity              : important
Type                  : security
References            : 1284985 CVE-2026-102554 
-----------------------------------------------------------------

The container bci/openjdk-devel was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3145-1
Released:    Tue Jul 21 10:38:13 2026
Summary:     Recommended update for log4j
Type:        recommended
Severity:    important
References:  
This update for log4j fixes the following issues:
  
log4j was updated and includes fixes and improvements from versions 2.21.0 through 2.26.0:

- Bugs fixed:
  - Fixed crashes when logging errors with stack traces modified by other threads
  - Fixed FATAL-level log messages being silently discarded
  - Fixed memory leaks in several components
  - Fixed log file headers not being written correctly when files are recreated
  - Fixed log file rotation failures
  - Fixed configuration file loading from HTTP sources
  - Fixed date and time formatting issues in logs
  - Fixed problems when multiple threads modify logger settings simultaneously
  - Fixed MongoDB appender connection issues

- New Features Added:
  - Support for ZStandard compression for log files
  - Support for LMAX Disruptor 4.x (high-performance logging)
  - Better support for GraalVM environments
  - Java 8 users now get sub-millisecond precision timestamps

- Features Removed:
  - JMX GUI tool (moved to separate release)
  - Flume Appender (moved to separate release)
  - Kubernetes lookup feature (users should migrate to io.fabric8:kubernetes-log4j)
  - JAnsi library support (Windows 10+ has built-in color support)

- Important Changes:
  - JMX monitoring is now DISABLED by default (set log4j2.disableJmx=false to enable)
  - Default log format has changed
  - Configuration scripts now require explicit names

- Deprecations (features to be removed in the future):
  - MongoDB4 module (use standard MongoDB module instead)
  - EventLogger class
  - Some builder methods (replaced with setter methods)

New Runtime Dependencies:

- jackson-dataformat-xml
- stax2-api
- woodstox-core
    
New and Updated Build Dependencies:

- aalto-xml (updated from version 1.3.3 to 1.4.0)
- jakarta-annotations (new)
- jakarta-messaging (new)
- jspecify (new)


-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5061-1
Released:    Tue Nov  3 08:28:55 2026
Summary:     Security update for guava, j2objc-annotations
Type:        security
Severity:    important
References:  1284985,CVE-2026-102554
This update for guava, j2objc-annotations fixes the following issue:

- CVE-2026-102554: Allocation of resources without limits or throttling (CWE-770) during Java object deserialization
  allows an attacker to cause a Denial of Service via OutOfMemoryError (bsc#1284985).

Changes for guava:

- Upgrade to version 33.7.2

Changes for j2objc-annotations:

- Update to version 3.0.0


The following package changes have been done:

- j2objc-annotations-3.0.0-150200.5.8.1 updated
- jspecify-1.0.0-150200.5.5.1 added
- guava-33.7.2-150200.3.20.1 updated
- container:bci-openjdk-21-15.7.21-24.77 updated
- checker-qual-3.22.0-150200.5.7.2 removed
- jsr-305-3.0.2-150200.3.7.5 removed