Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: OpenJDK 8u292 Windows Builds release and
security update
Advisory ID: RHSA-2021:1445-01
Product: OpenJDK
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1445
Issue date: 2021-04-28
Keywords: openjdk,windows
Cross references: RHSA-2021:70386-01
CVE Names: CVE-2021-2161 CVE-2021-2163
====================================================================
1. Summary:
The Red Hat Build of OpenJDK 8 (java-1.8.0-openjdk) is now
available for
Windows.
Red Hat Product Security has rated this update as having a
security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base
score, which
gives a detailed severity rating, is available for each
vulnerability from
the CVE link(s) in the References section.
2. Description:
The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime
Environment and
the OpenJDK 8 Java Software Development Kit.
This release of the Red Hat build of OpenJDK 8 (1.8.0.292) for
Windows
serves as a replacement for the Red Hat build of OpenJDK 8
(1.8.0.282) and
includes security and bug fixes, and enhancements. For further
information,
refer to the release notes linked to in the References section.
Security Fix(es):
* OpenJDK: Incorrect handling of partially quoted arguments
in
ProcessBuilder on Windows (Libraries, 8250568) (CVE-2021-2161)
* OpenJDK: Incomplete enforcement of JAR signing disabled
algorithms
(Libraries, 8249906) (CVE-2021-2163)
For more details about the security issue(s), including the
impact, a CVSS
score, acknowledgments, and other related information, refer to the
CVE
page(s) listed in the References section.
3. Solution:
Before applying this update, make sure all previously released
errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/openjdk/8/html/installing_and
_using_openjdk_8_for_windows/index
4. Bugs fixed (https://bugzilla.redhat.com/):
1951217 - CVE-2021-2163 OpenJDK: Incomplete enforcement of JAR
signing disabled algorithms (Libraries, 8249906)
1951231 - CVE-2021-2161 OpenJDK: Incorrect handling of partially
quoted arguments in ProcessBuilder on Windows (Libraries,
8250568)
5. References:
https://access.redhat.com/security/cve/CVE-2021-2161
https://access.redhat.com/security/cve/CVE-2021-2163
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=core.service.openjdk&version=1.8.0.292
https://access.redhat.com/documentation/en-us/openjdk/8/html/installing_and_using_openjdk_8_for_windows/index
https://access.redhat.com/documentation/en-us/openjdk/8/html/troubleshooting_openjdk_8_for_windows/index
https://openjdk.java.net/groups/vulnerability/advisories/2021-04-20
6. Contact:
The Red Hat security contact is <
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYIlW99zjgjWX9erEAQhf2w//Y2ma/p8XNZzkqypaS9tLt4O5WTaLkZ84
p9YgmTYdaXQqcqoxeMkgWeoDDncbSfa1rK8Gx+zDY+wtqiGP3RTWcPZ6qzyOdHfM
h2AzuDxjtoWqk0aIzomzzNUitC+EAicJ/GeUzqaVqlStopjH3Yfz+zn2nL/40JNI
BX88A7c9vxtZXlaYqLNn3qOE5nB2fKLDYDkYkb3iK0hbJHONQI1m3gIVxh3dyCA3
vo6b5Mh5s1gk6Hud+YObiXpbYnC++obSHYJW0eeMk6uJnocTn1GodS1CFAszquqM
DhG2wUuMooG94GRbZVvsfNfKHCJ7/kCU/ViVs1GCuOhkhBlklWNZg5KBAB8hLKug
Xh9u6NcYidM0mTd/mwhjkfptZs+cqxLRoo2aSAwwmxmOauv6PXwExBnTqKgYipjD
4e3uvd28U6AD1zI/VmWQsE5BCGpy6pPeFWmbHzoVTZdWLihxA9Hj/BvX2GNj7R9p
psytP80l2Dx01ppCP0vUf85KmmLVxklb0j7zmxCxYsZk/T7p9h3/Hf8LtvHHDr35
UO3DwT4LXbrMiGZByI/QuD4EW5sEZd7a+w3obbTmoc5S0dFPLals3OdB20R5mixu
69/A8XxOQ4XlTq+SkhBLpjVSnyWjsfeNsBIFYS8m8YW4f+U2/6GhLNbaaJ2PQiGW
tyiQ9zRCIe4=V8tu
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Read more https://packetstormsecurity.com/files/162378/RHSA-2021-1445-01.txt