Read Time:2 Minute, 16 Second
FEDORA-2022-ae563934f7
Packages in this update:
java-11-openjdk-11.0.16.0.8-1.fc36
Update description:
New in release OpenJDK 11.0.16 (2022-07-19)
The release announcement can be found at https://bit.ly/openjdk11016
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-11.0.16.txt
Security fixes
JDK-8277608: Address IP Addressing
JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports
FIPS Changes
RH2007331: SecretKey generate/import operations don’t add the CKA_SIGN attribute in FIPS mode
RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
RH2090378: Revert to disabling system security properties and FIPS mode support together
Depend on crypto-policies package at build-time and run-time
Other Changes
Add javaver- and origin-specific javadoc and javadoczip alternatives (thanks to FeRD (Frank Dana) ferdnyc@gmail.com)
JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos
Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.
Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.
The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt
JDK-8278386: Default JDK compressor will be closed when IOException is encountered
DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.
JDK-8277157: Vector should throw ClassNotFoundException for a missing class of an element
java.util.Vector is updated to correctly report ClassNotFoundException that occurs during deserialization usingjava.io.ObjectInputStream.GetField.get(name, object)when the class of an element of the Vector is not found. Without this fix, aStreamCorruptedException` is thrown that does not provide information about the missing class.
