FEDORA-2022-64431bccec
Packages in this update:
java-17-openjdk-17.0.4.0.8-1.fc35
Update description:
New in release OpenJDK 17.0.4 (2022-07-19)
The release announcement can be found at https://bit.ly/openjdk1704
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-17.0.4.txt
Security fixes
JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8273056, JDK-8283875, CVE-2022-21549: java.util.random does not correctly sample exponential or Gaussian distributions
JDK-8277608: Address IP Addressing
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports
JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos
Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.
Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.
The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt
JDK-8278386: Default JDK compressor will be closed when IOException is encountered
DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.
More Stories
ZDI-CAN-25373: Microsoft
A CVSS score 7.0 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Peter Girnus - Trend Micro Zero Day Initiative' was reported to...
DSA-5774-1 ruby-saml – security update
It was discovered that ruby-saml, a SAML library implementing the client side of a SAML authorization, does not properly verify...
USN-6968-2: PostgreSQL vulnerability
USN-6968-1 fixed CVE-2024-7348 in PostgreSQL-12, PostgreSQL-14, and PostgreSQL-16 This update provides the corresponding updates for PostgreSQL-9.5 in Ubuntu 16.04 LTS....
USN-7015-2: Python vulnerabilities
USN-7015-1 fixed several vulnerabilities in Python. This update provides one of the corresponding updates for python2.7 for Ubuntu 16.04 LTS,...
USN-7027-1: Emacs vulnerabilities
It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands....
USN-7024-1: tgt vulnerability
It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1,...