Linux · Security advisory · April 20, 2023

ELSA-2023-1898: Security update for 23 packages

ELSA-2023-1898, released April 20, 2023, fixes 7 CVEs across 23 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0250
84th percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 1 Routine 6

Fixed package versions

ProductReleaseFixed in
java-17-openjdkol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-demool 81:17.0.7.0.7-1.el8_7
java-17-openjdk-demo-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-demo-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-develol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-devel-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-devel-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-headlessol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-headless-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-headless-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-javadocol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-javadoc-zipol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-jmodsol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-jmods-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-jmods-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-srcol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-src-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-src-slowdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-static-libsol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-static-libs-fastdebugol 81:17.0.7.0.7-1.el8_7
java-17-openjdk-static-libs-slowdebugol 81:17.0.7.0.7-1.el8_7

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-21930 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 7.4 0.0130 None reported
Routine CVE-2023-21939 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 5.3 0.0250 None reported
Routine CVE-2023-21967 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 5.9 0.0154 None reported
Routine CVE-2023-21954 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 5.9 0.0143 None reported
Routine CVE-2023-21937 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 3.7 0.0122 None reported
Routine CVE-2023-21938 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:… 3.7 0.0122 None reported
Routine CVE-2023-21968 Microsoft Build of OpenJDK with Hotspot 11 and 1 other: Improper Access Control 3.7 0.0104 None reported
Showing 1 to 7 of 7 1