Category Archives: Advisories

java-17-openjdk-17.0.4.0.8-1.fc35

Read Time:1 Minute, 44 Second

FEDORA-2022-64431bccec

Packages in this update:

java-17-openjdk-17.0.4.0.8-1.fc35

Update description:

New in release OpenJDK 17.0.4 (2022-07-19)

The release announcement can be found at https://bit.ly/openjdk1704
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-17.0.4.txt

Security fixes

JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8273056, JDK-8283875, CVE-2022-21549: java.util.random does not correctly sample exponential or Gaussian distributions
JDK-8277608: Address IP Addressing
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt

JDK-8278386: Default JDK compressor will be closed when IOException is encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

Read More

java-latest-openjdk-18.0.2.0.9-1.rolling.fc35

Read Time:1 Minute, 4 Second

FEDORA-2022-b76ab52e73

Packages in this update:

java-latest-openjdk-18.0.2.0.9-1.rolling.fc35

Update description:

New in release OpenJDK 18.0.2 (2022-07-19)

Full release notes can be found at https://builds.shipilev.net/backports-monitor/release-notes-18.0.2.txt

Security fixes

JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8277608: Address IP Addressing
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8282676: Improve subject handling
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

JDK-8288367: CPU Shares Ignored When Computing Active Processor Count

Previous JDK releases used an incorrect interpretation of the Linux cgroups parameter cpu.shares. This might cause the JVM to use fewer CPUs than available, leading to an under utilization of CPU resources when the JVM is used inside a container.
Starting from this JDK release, by default, the JVM no longer considers cpu.shares when deciding the number of threads to be used by the various thread pools. The -XX:+UseContainerCpuShares command-line option can be used to revert to the previous behaviour. This option is deprecated and may be removed in a future JDK release.

Read More

java-17-openjdk-17.0.4.0.8-1.fc36

Read Time:1 Minute, 44 Second

FEDORA-2022-34584d4257

Packages in this update:

java-17-openjdk-17.0.4.0.8-1.fc36

Update description:

New in release OpenJDK 17.0.4 (2022-07-19)

The release announcement can be found at https://bit.ly/openjdk1704
Full release details can be found at https://builds.shipilev.net/backports-monitor/release-notes-17.0.4.txt

Security fixes

JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8273056, JDK-8283875, CVE-2022-21549: java.util.random does not correctly sample exponential or Gaussian distributions
JDK-8277608: Address IP Addressing
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

JDK-8285240: HTTPS Channel Binding support for Java GSS/Kerberos

Support has been added for TLS channel binding tokens for Negotiate/Kerberos authentication over HTTPS through javax.net.HttpsURLConnection.

Channel binding tokens are increasingly required as an enhanced form of security which can mitigate certain kinds of socially engineered, man in the middle (MITM) attacks. They work by communicating from a client to a server the client’s understanding of the binding between connection security (as represented by a TLS server cert) and higher level authentication credentials (such as a username and password). The server can then detect if the client has been fooled by a MITM and shutdown the session/connection.

The feature is controlled through a new system property jdk.https.negotiate.cbt which is described fully at the following
page: https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-properties.html#jdk.https.negotiate.cbt

JDK-8278386: Default JDK compressor will be closed when IOException is encountered

DeflaterOutputStream.close() and GZIPOutputStream.finish() methods have been modified to close out the associated default JDK compressor before propagating a Throwable up the stack. ZIPOutputStream.closeEntry() method has been modified to close out the associated default JDK compressor before propagating an IOException, not of type ZipException, up the stack.

Read More

java-latest-openjdk-18.0.2.0.9-1.rolling.fc36

Read Time:1 Minute, 4 Second

FEDORA-2022-e573851f56

Packages in this update:

java-latest-openjdk-18.0.2.0.9-1.rolling.fc36

Update description:

New in release OpenJDK 18.0.2 (2022-07-19)

Full release notes can be found at https://builds.shipilev.net/backports-monitor/release-notes-18.0.2.txt

Security fixes

JDK-8272243: Improve DER parsing
JDK-8272249: Better properties of loaded Properties
JDK-8277608: Address IP Addressing
JDK-8281859, CVE-2022-21540: Improve class compilation
JDK-8281866, CVE-2022-21541: Enhance MethodHandle invocations
JDK-8282676: Improve subject handling
JDK-8283190: Improve MIDI processing
JDK-8284370: Improve zlib usage
JDK-8285407, CVE-2022-34169: Improve Xalan supports

JDK-8288367: CPU Shares Ignored When Computing Active Processor Count

Previous JDK releases used an incorrect interpretation of the Linux cgroups parameter cpu.shares. This might cause the JVM to use fewer CPUs than available, leading to an under utilization of CPU resources when the JVM is used inside a container.
Starting from this JDK release, by default, the JVM no longer considers cpu.shares when deciding the number of threads to be used by the various thread pools. The -XX:+UseContainerCpuShares command-line option can be used to revert to the previous behaviour. This option is deprecated and may be removed in a future JDK release.

Read More

CVE-2017-20144

Read Time:13 Second

A vulnerability has been found in Anvsoft PDFMate PDF Converter Pro 1.7.5.0 and classified as critical. The manipulation leads to memory corruption. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Read More

xen-4.15.3-3.fc35

Read Time:10 Second

FEDORA-2022-7bc84ae2cc

Packages in this update:

xen-4.15.3-3.fc35

Update description:

Retbleed – arbitrary speculative code execution with return instructions
[XSA-407, CVE-2022-23816, CVE-2022-23825, CVE-2022-29900]

Read More

Lightning Framework: A New Modular Malware for Linux

Read Time:1 Minute, 37 Second

FortiGuard Labs is aware of the discovery of a new Linux malware variant that is not only complex in design, but modular. Dubbed ‘Lightning Framework’, the malware consists of various modules for different functionality. At this time, there is no report of Lightning Framework being used or observed in the wild attacks.Why is this Significant?This is significant because Lightning Framework is a previously unknown modular malware for Linux that can download and install different modules (including rootkits) and plugins to a targeted machine. While there are no reports of the malware being used in the wild, it can be safely surmised that the Lightning Framework can be expected and incorporated in real attacks soon.What is Lightning Framework?Lightning Framework is a modular malware that consists of various modules for different functionality.A Lightning Framework infection starts with an installation of the Lightning.Downloader module on the compromised Linux machine. This module connects to its Command-and-Control (C2) server and is used to download other additional and plugins including Lightning.Core. Lightning.Core is the main module of Lightning Framework and is responsible for receiving commands from the C2 server and to execute remote commands. Other modules that are downloaded by Lightning.Downloader are:Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Sshd, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf.According to the Intezer blog the modules: Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf are referenced only in the source and actual files have not been discovered in the wild.Furthermore, to add insult to injury – Lightning Framework can open a SSH backdoor using the Linux.Plugin.Lightning.Sshd plugin upon receiving a remote command.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against available modules and plugins of Lightning Framework:Linux/Agent.PA!trLinux/Agent.B5B5!trLinux/Agent.C492!tr

Read More