-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: OpenJDK 11.0.11 Security Update for Portable Linux Builds Advisory ID: RHSA-2021:1446-01 Product: OpenJDK Advisory URL: https://access.redhat.com/errata/RHSA-2021:1446 Issue date: 2021-04-28 Keywords: openjdk,linux Cross references: RHSA-2021:71666-01 CVE Names: CVE-2021-2163 ==================================================================== 1. Summary: The Red Hat Build of OpenJDK 11 (java-11-openjdk) is now available for portable Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This release of the Red Hat build of OpenJDK 11 (11.0.11) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.10) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/documentation/en-us/openjdk/11/html/installing_an d_using_openjdk_11_on_rhel/installing-openjdk11-on-rhel8#installing-jdk11-o n-rhel-using-archive 4. Bugs fixed (https://bugzilla.redhat.com/): 1951217 - CVE-2021-2163 OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) 5. References: https://access.redhat.com/security/cve/CVE-2021-2163 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=core.service.openjdk&version.0.11.9 https://access.redhat.com/documentation/en-us/openjdk/11/html/installing_and_using_openjdk_11_on_rhel/installing-openjdk11-on-rhel8#installing-jdk11-on-rhel-using-archive https://openjdk.java.net/groups/vulnerability/advisories/2021-04-20 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYIlW3dzjgjWX9erEAQhX+g/+OPn5r48LkxCPHu7NnCpWp1W3GR3boaCa KjIPQ3cbtFVqrgMs8xK33ObaWmb2lFMQFyPYZudnSlvpBYzo+c3iz5OxM2fyGjPd ZtgGCjfnZwticJa4wEY8GhgG3ruRFEokoeOdLbYWkMbk3ranQ1N48xDEE5gmfybO 9drBITOaTKljRDlYHIU/ePafDwe6ZLtgescdA6SGMeY0qgKuqpcODx/1ags+Vpvb E0sjPfAGU3amAsmQwUCq2tVV0Bq93E9WOLwN/e28ys+uZo30XCQnjPoV5NPzCwOr oQ78LlHL/uD4utklZlVRuGG6gQAS8vE8ykcPQsr0m4lJIFcBro9ONrY1ppuFb6lL fV5e4gVLlNkMtmPWmA0E4gqgBa5bULgWJdEtq3RauWPp/YgsZgaQBPHHwtZlSjWC 0NTrcQqahrdrAfc09YnUfpZwFLrl+ohPsUWFsBLPzTRpJNyxVPeEtVi9nxzHom8n 5tMrHStWiP5LFfS2f61eD6MbLAy58TdcWtA/aEYutZBgcRSk9xTCK+kmprM/DGoY Ks95FhbLw/LKGeyKDa1E9j+5c9b3mEHGBO3Mm24HB8KiLiMKKbghTotcjCeXvwzO ZO36yTWWntJ8xvRDtQ5HPDbWnHVD+3Aw23KglzFKaSfnPqvW8/0R5QVZg1nuLXvY jNEVI8Rx0Gk=tx/r -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce