SUSE-SU-2022:4250-1: important: Security update for java-1_8_0-openj9

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for java-1_8_0-openj9
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:4250-1
Rating:             important
References:         #1204471 #1204472 #1204473 #1204475 #1204703 
                    
Cross-References:   CVE-2022-21619 CVE-2022-21624 CVE-2022-21626
                    CVE-2022-21628 CVE-2022-3676
CVSS scores:
                    CVE-2022-21619 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21619 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21624 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21624 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21626 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21626 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21628 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21628 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-3676 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-3676 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Products:
                    openSUSE Leap 15.3
                    openSUSE Leap 15.4
______________________________________________________________________________

   An update that fixes 5 vulnerabilities is now available.

Description:

   This update for java-1_8_0-openj9 fixes the following issues:

   - Update to OpenJDK 8u352 build 08 with OpenJ9 0.35.0 virtual machine,
     including Oracle October 2022 CPU changes.

   - CVE-2022-21619: An unauthenticated attacker with network access via
     multiple protocols to compromise Oracle Java SE (bsc#1204473).
   - CVE-2022-21626: An unauthenticated attacker with network access via
     HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
     (bsc#1204471).
   - CVE-2022-21624: An unauthenticated attacker with network access via
     multiple protocols to compromise Oracle Java SE, Oracle GraalVM
     Enterprise (bsc#1204475).
   - CVE-2022-21628: An unauthenticated attacker with network access via HTTP
     can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition
     (bsc#1204472).
   - CVE-2022-3676: Fixed interface than calls can be inlined without a
     runtime type check (bsc#1204703).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.4:

      zypper in -t patch openSUSE-SLE-15.4-2022-4250=1

   - openSUSE Leap 15.3:

      zypper in -t patch openSUSE-SLE-15.3-2022-4250=1



Package List:

   - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

      java-1_8_0-openj9-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.4 (noarch):

      java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.3 (ppc64le s390x x86_64):

      java-1_8_0-openj9-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-accessibility-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-debugsource-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-demo-debuginfo-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-devel-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-headless-1.8.0.352-150200.3.27.1
      java-1_8_0-openj9-src-1.8.0.352-150200.3.27.1

   - openSUSE Leap 15.3 (noarch):

      java-1_8_0-openj9-javadoc-1.8.0.352-150200.3.27.1


References:

   https://www.suse.com/security/cve/CVE-2022-21619.html
   https://www.suse.com/security/cve/CVE-2022-21624.html
   https://www.suse.com/security/cve/CVE-2022-21626.html
   https://www.suse.com/security/cve/CVE-2022-21628.html
   https://www.suse.com/security/cve/CVE-2022-3676.html
   https://bugzilla.suse.com/1204471
   https://bugzilla.suse.com/1204472
   https://bugzilla.suse.com/1204473
   https://bugzilla.suse.com/1204475
   https://bugzilla.suse.com/1204703