SUSE-CU-2023:3666-1: Security update of bci/openjdk

[sle-security-updates at lists.suse.com]

SUSE Container Update Advisory: bci/openjdk
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2023:3666-1
Container Tags        : bci/openjdk:17 , bci/openjdk:17-12.28 , bci/openjdk:latest
Container Release     : 12.28
Severity              : important
Type                  : security
References            : 1196647 1214790 1216339 1216374 CVE-2023-22025 CVE-2023-22081
-----------------------------------------------------------------

The container bci/openjdk was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2023:4289-1
Released:    Tue Oct 31 09:15:08 2023
Summary:     Security update for java-17-openjdk
Type:        security
Severity:    important
References:  1214790,1216339,1216374,CVE-2023-22025,CVE-2023-22081
This update for java-17-openjdk fixes the following issues:

- Updated to JDK 17.0.9+9 (October 2023 CPU):

  - CVE-2023-22081: Fixed a partial denial of service issue that could
    be triggered via HTTPS (bsc#1216374).
  - CVE-2023-22025: Fixed a memory corruption issue in applications
    using AVX-512 (bsc#1216339).

Please visit the Oracle Release Notes page for the full changelog:

https://www.oracle.com/java/technologies/javase/17all-relnotes.html

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2023:4310-1
Released:    Tue Oct 31 14:10:47 2023
Summary:     Recommended update for libtirpc
Type:        recommended
Severity:    moderate
References:  1196647
This Update for libtirpc to 1.3.4, fixing the following issues:
    
Update to 1.3.4 (bsc#1199467)

 * binddynport.c honor ip_local_reserved_ports
   - replaces: binddynport-honor-ip_local_reserved_ports.patch
 * gss-api: expose gss major/minor error in authgss_refresh()
 * rpcb_clnt.c: Eliminate double frees in delete_cache()
 * rpcb_clnt.c: memory leak in destroy_addr
 * portmapper: allow TCP-only portmapper
 * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
 * clnt_raw.c: fix a possible null pointer dereference
 * bindresvport.c: fix a potential resource leakage

Update to 1.3.3:

* Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
* _rpc_dtablesize: use portable system call
* libtirpc: Fix use-after-free accessing the error number
* Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
* rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
* Eliminate deadlocks in connects with an MT environment
* clnt_dg_freeres() uncleared set active state may deadlock
* thread safe clnt destruction
* SUNRPC: mutexed access blacklist_read state variable
* SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c

Update to 1.3.2:

* Replace the final SunRPC licenses with BSD licenses
* blacklist: Add a few more well known ports
* libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS

Update to 1.3.1:

* Remove AUTH_DES interfaces from auth_des.h
  The unsupported  AUTH_DES authentication has be
  compiled out since commit d918e41d889 (Wed Oct 9 2019)
  replaced by API routines that return errors.
* svc_dg: Free xp_netid during destroy
* Fix memory management issues of fd locks
* libtirpc: replace array with list for per-fd locks
* __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
* __rpc_dtbsize: rlim_cur instead of rlim_max
* pkg-config: use the correct replacements for libdir/includedir


The following package changes have been done:

- libtirpc-netconfig-1.3.4-150300.3.20.1 updated
- libtirpc3-1.3.4-150300.3.20.1 updated
- java-17-openjdk-headless-17.0.9.0-150400.3.33.1 updated
- java-17-openjdk-17.0.9.0-150400.3.33.1 updated
- container:sles15-image-15.0.0-36.5.52 updated