SUSE-CU-2026:12305-1: Security update of bci/openjdk-devel
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 16 08:14:00 UTC 2026
SUSE Container Update Advisory: bci/openjdk-devel
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12305-1
Container Tags : bci/openjdk-devel:17 , bci/openjdk-devel:17-sles15 , bci/openjdk-devel:17.0.20.1 , bci/openjdk-devel:17.0.20.1-21.79
Container Release : 21.79
Severity : important
Type : security
References : 1188469 1246873 1273185 1280015 CVE-2021-36374 CVE-2025-7962
CVE-2026-78254
-----------------------------------------------------------------
The container bci/openjdk-devel was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4677-1
Released: Thu Oct 15 07:55:18 2026
Summary: Security update for the Java stack
Type: security
Severity: important
References: 1188469,1246873,1273185,1280015,CVE-2021-36374,CVE-2025-7962,CVE-2026-78254
This update for Java fixes the following issues:
This update introduces new libraries and refines existing Java tools to
improve security, compatibility, stability, and formatting.
ant (Updated to version 1.10.18):
- Security issues fixed:
- CVE-2021-36374: Fixed excessive memory allocation when reading specially crafted ZIP archives or derived formats
(bsc#1188469)
- CVE-2025-7962: Fixed improper neutralization of line breaks to prevent SMTP injection (bsc#1246873)
- CVE-2026-78254: Fixed path traversal in FTP and SCP tasks that could allow arbitrary file writes (bsc#1280015)
- Other changes and bugs fixed:
* Breaking changes:
+ FTPS tasks now use encrypted data channels by default.
+ FTP and SCP tasks now prevent files or directories from being written outside the target directory by default.
* Other changes:
+ Added package `ant-junit5` that allows tests to be launched and run using the JUnit 5 framework.
+ Improved support for reproducible builds by standardizing timestamps, file modification times, and timezone
handling.
+ Upgraded the jakarta.mail dependency to version 2.0.2.
+ Added an option to the 'record' task to create log files relative to the project directory.
* Bugs fixed:
+ Fixed compatibility and startup issues when running on newer Java versions.
+ Fixed network handling issues in FTP and SCP tasks, including proper support for IPv6 addresses.
+ Improved security in email tasks by verifying TLS server certificates and enforcing STARTTLS encryption.
+ Improved report generation performance in JUnit launcher tasks.
+ Fixed regressions and edge cases in resource mapping, path conversion, and command execution.
json-simple (Updated to version 2.3.1):
- Updated to a newer version that makes reading and writing structured web data (JSON) safer and more reliable.
- Added a 'pretty-printing' feature to format web data so it is easier to read.
- Made reading and writing data safer when multiple tasks are running simultaneously.
- Made looking up data more flexible, allowing the tool to automatically handle different format types
(like numbers and text).
junit5 (Updated to version 5.14.4):
- Fixed an issue where tests could conflict or run incorrectly when executed at the same time.
- Corrected test behavior on newer versions of Java so they run reliably.
- Improved test reports so that test names are clearer, unique, and easier to distinguish from one another.
- Added features to customize how test names are generated and better capture testing outputs.
maven-doxia, maven-doxia-sitetools (Updated to version 2.1.0):
- Added support for displaying the last modification date and author on
generated web pages.
- Added support for displaying interactive diagrams (such as flowcharts or charts) directly on web pages.
- Improved formatting and layout for modern documents, including better tables, lists, and links.
maven-surefire, maven-surefire-plugins (Updated to version 3.5.6):
- Fixed a bug that caused software testing tasks to fail abruptly with an unexpected error [bsc#1273185].
- Added timestamps to testing reports so you can see exactly when tests ran.
- Made running multiple tests at the same time much more reliable, preventing mixed-up report results.
- Added the ability to immediately stop testing once a failure is detected (saving time).
objectweb-asm (Updated to version 9.10.1):
- Added support for newer Java versions, including bytecode support up to Java 27.
- Prevented out-of-memory errors when processing invalid or corrupted class files.
- Improved bytecode analysis and verification to correctly handle valid Java code and prevent unexpected analysis errors
- Improved compliance with FIPS 140-3 security standards during class serialization.
- Corrected package import ranges to prevent dependency conflicts in OSGi environments.
- Fixed unexpected crashes and errors in code generation and inspection utilities.
plexus-archiver (Updated to version 4.14.0):
- Added support for following symbolic links when collecting files for archives.
- Reduced memory usage when creating ZIP archives to prevent out-of-memory errors during large builds.
- Fixed an issue where reading file attributes on Windows systems could cause unexpected errors.
- Improved ZIP archive handling, fixing checksum calculation errors, negative timestamp issues, and file permissions.
- Replaced compression components with Apache Commons Compress to eliminate vulnerable dependencies.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies, including commons-io to 2.22.0, xz to 1.12, and zstd-jni to 1.5.7-15.
plexus-build-api (Updated to version 1.2.0):
- Updated dependencies for compatibility with modern build and injection tools.
plexus-cipher (Updated to version 2.1.0):
- Updated dependencies for compatibility with modern build and injection tools.
plexus-classworlds (Updated to version 2.12.1):
- Fixed file pattern matching (glob matching) when loading classes and resources.
- Restored backward compatibility with legacy Maven 2 configurations.
- Added support for registering filtered class realms.
- Implemented clean resource shutdown support (Closeable) for class loaders.
- Added support for the PPC64LE architecture.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies, including jakarta.xml.bind-api, log4j-api, and ant.
plexus-compiler (Updated to version 2.17.1):
- Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction.
- Fixed an unexpected crash (ConcurrentModificationException) when processing compiler arguments concurrently.
- Fixed compiler diagnostics and warning reporting to ensure multi-line messages and warning categories are properly
displayed.
- Fixed Java version detection when custom options or newer Java versions are present.
- Fixed an issue where the Eclipse Java Compiler (ECJ) failed to detect annotation processors configured in the
processor path.
- Added support for quoting compiler argument files to safely handle paths containing spaces.
- Fixed cross-drive file path handling on Windows systems.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies, including Google Guava to 33.7.1 and Eclipse Java Compiler (ECJ) to 3.46.100.
plexus-containers (Updated to version 2.2.0):
- Added the plexus-metadata-generator Ant task and command-line interface to generate component metadata.
- Added the plexus-metadata-generator-ant package capability.
plexus-i18n (Updated to version 1.2.0):
- Corrected language translation lookup to prevent unintentionally falling back to the system default locale.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated internal dependencies.
plexus-interactivity (Updated to version 1.6.0):
- Upgraded the terminal reader dependency to JLine 3 for improved console and terminal interaction.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies, including Sisu Inject to 1.1.0 and Guice to 5.1.0.
plexus-interpolation (Updated to version 1.30.0):
- Fixed caching issues in string and regular expression interpolators to significantly improve evaluation performance
and consistency.
- Added support for feedback value sources and delimiter tracking.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated internal dependencies.
plexus-io (Updated to version 3.8.0):
- Improved performance by caching Unix user and group lookups.
- Fixed file handling to properly follow symbolic links when configured.
- Fixed an issue where temporary files were left unclosed, preventing file-not-found errors.
- Improved resilience when querying file attributes on network file systems.
- Added support for tracking hard-link identities for unchanged files.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies, including commons-io to 2.22.0, plexus-utils to 3.6.2, and Sisu Inject to 1.1.0.
plexus-languages (Updated to version 1.6.0):
- Replaced the source code parser with JavaParser for improved language support and modern Java compatibility.
- Added support for newer Java versions, including JDK 23 and JDK 24 bytecode.
- Improved the speed of detecting Java class file versions.
- Added validation to detect and report duplicate modules on the module path.
- Updated dependencies, including ObjectWeb ASM to 9.10.1.
plexus-sec-dispatcher (Updated to version 2.0):
- Modernized component injection by using standard javax.inject annotations.
- Updated dependencies for compatibility with modern Sisu tools.
plexus-utils (Updated to version 4.1.0):
- Breaking change: File scanning no longer excludes '.gitignore' and '.cvsignore' files by default.
- Fixed a security issue (Zip Slip) that could allow arbitrary file overwrite during archive extraction.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated internal dependencies.
plexus-velocity (Updated to version 2.4.0):
- Reduced runtime dependency requirements by eliminating unnecessary injection components.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated dependencies to secure releases, including Apache Velocity Engine to 2.4.1 and Commons Lang to 3.20.0.
plexus-xml (Updated to version 3.1.0):
- Fixed XML parsing issues when reading documents in UTF-8 (without BOM) and ISO-8859-1 encodings.
- Added Java Module System (JPMS) support for compatibility with modern Java versions.
- Updated internal dependencies, including plexus-utils to 4.0.2.
New package dependencies distributed:
- apache-commons-digester3: XML-to-Java object mapping library; required at
runtime by `velocity-tools`.
- javaparser: Java source code parser and abstract syntax tree library;
required at runtime by `plexus-languages`.
- antlr: Parser generator for reading, processing, and translating
structured text; required at runtime by `ant` (`ant-antlr`).
- jakarta-mail: Implementation of the Jakarta Mail API for email handling
(addresses CVE-2025-7962); required at runtime by `ant` (`ant-jakartamail`).
- jakarta-activation: Framework for handling MIME data types and extensible
data content; required at runtime by `jakarta-mail` and `ant`
(`ant-jakartamail`).
- univocity-parsers: Fast CSV, TSV, and fixed-width tabular text parser
collection; required at runtime by `ant` (`ant-junit5`) and `junit5`.
- opentest4j: Common exception and test assertion abstraction for JVM
testing frameworks; required at runtime by `ant` (`ant-junit5`) and `junit5`.
- picocli: Annotation-based command-line interface parser; required at
runtime by `junit5`.
- assertj-core: Fluent assertion library for Java testing; required at
runtime by `junit5`.
- plexus-build-api0: Compatibility API layer for Plexus build tooling;
required at runtime by `plexus-build-api`.
- qdox: High-speed parser for extracting class, interface, and Javadoc
metadata; required at runtime by `plexus-containers`
(`plexus-component-metadata`).
- bsf: Bean Scripting Framework for running scripting languages from Java;
required at runtime by `ant` (`ant-apache-bsf`).
- jdepend: Metric generator analyzing Java package design and dependencies;
required at runtime by `ant` (`ant-jdepend`).
- javassist: Java bytecode manipulation and analysis toolkit; required at
runtime by `javaparser`.
- ant-contrib: Additional tasks, condition handlers, and control-flow logic
for Apache Ant; optional runtime companion for `ant`.
- byte-buddy: Runtime code generation and bytecode manipulation library;
required at runtime by `junit5` and `ant-junit5`.
- velocity-tools: Reusable tools and view support helpers for the Apache
Velocity template engine; standalone runtime library for template-driven web
applications.
- zstd-jni: JNI bindings providing fast and high-ratio lossless compression
via Zstandard; required at runtime by `plexus-archiver`.
The following package changes have been done:
- objectweb-asm-9.10.1-150200.3.20.3 updated
- plexus-classworlds-2.12.1-150200.3.8.2 updated
- plexus-containers-component-annotations-2.2.0-150200.3.12.2 updated
- plexus-interpolation-1.30.0-150200.3.12.4 updated
- plexus-utils-4.1.0-150200.3.17.2 updated
- plexus-xml-3.1.0-150200.5.13.2 updated
- plexus-cipher-2.1.0-150200.3.10.2 updated
- plexus-sec-dispatcher-2.0-150200.3.10.2 updated
More information about the sle-container-updates
mailing list