Security update for java-11-openjdk

Announcement ID:	SUSE-SU-2024:0203-1
Rating:	important
References:	bsc#1218903 bsc#1218905 bsc#1218906 bsc#1218907 bsc#1218909 bsc#1218911
Cross-References:	CVE-2024-20918 CVE-2024-20919 CVE-2024-20921 CVE-2024-20926 CVE-2024-20945 CVE-2024-20952
CVSS scores:	CVE-2024-20918 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2024-20919 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2024-20921 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2024-20926 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2024-20945 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2024-20952 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves six vulnerabilities can now be installed.

Description:

This update for java-11-openjdk fixes the following issues:

Updated to version 11.0.22 (January 2024 CPU):

• CVE-2024-20918: Fixed an out of bounds access in the Hotspot JVM due to a missing bounds check (bsc#1218907).
• CVE-2024-20919: Fixed a sandbox bypass in the Hotspot JVM class file verifier (bsc#1218903).
• CVE-2024-20921: Fixed an incorrect optimization in the Hotspot JVM that could lead to corruption of JVM memory (bsc#1218905).
• CVE-2024-20926: Fixed arbitrary Java code execution in Nashorn (bsc#1218906).
• CVE-2024-20945: Fixed a potential private key leak through debug logs (bsc#1218909).
• CVE-2024-20952: Fixed an RSA padding issue and timing side-channel attack against TLS (bsc#1218911).

Find the full release notes at:

https://mail.openjdk.org/pipermail/jdk-updates-dev/2024-January/029215.html

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-203=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-203=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2024-203=1

Package List:

• SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)
  • java-11-openjdk-devel-11.0.22.0-3.72.2
  • java-11-openjdk-headless-11.0.22.0-3.72.2
  • java-11-openjdk-11.0.22.0-3.72.2
  • java-11-openjdk-debuginfo-11.0.22.0-3.72.2
  • java-11-openjdk-debugsource-11.0.22.0-3.72.2
  • java-11-openjdk-demo-11.0.22.0-3.72.2
• SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)
  • java-11-openjdk-devel-11.0.22.0-3.72.2
  • java-11-openjdk-headless-11.0.22.0-3.72.2
  • java-11-openjdk-11.0.22.0-3.72.2
  • java-11-openjdk-debuginfo-11.0.22.0-3.72.2
  • java-11-openjdk-debugsource-11.0.22.0-3.72.2
  • java-11-openjdk-demo-11.0.22.0-3.72.2
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
  • java-11-openjdk-devel-11.0.22.0-3.72.2
  • java-11-openjdk-headless-11.0.22.0-3.72.2
  • java-11-openjdk-11.0.22.0-3.72.2
  • java-11-openjdk-debuginfo-11.0.22.0-3.72.2
  • java-11-openjdk-debugsource-11.0.22.0-3.72.2
  • java-11-openjdk-demo-11.0.22.0-3.72.2

References:

• https://www.suse.com/security/cve/CVE-2024-20918.html
• https://www.suse.com/security/cve/CVE-2024-20919.html
• https://www.suse.com/security/cve/CVE-2024-20921.html
• https://www.suse.com/security/cve/CVE-2024-20926.html
• https://www.suse.com/security/cve/CVE-2024-20945.html
• https://www.suse.com/security/cve/CVE-2024-20952.html
• https://bugzilla.suse.com/show_bug.cgi?id=1218903
• https://bugzilla.suse.com/show_bug.cgi?id=1218905
• https://bugzilla.suse.com/show_bug.cgi?id=1218906
• https://bugzilla.suse.com/show_bug.cgi?id=1218907
• https://bugzilla.suse.com/show_bug.cgi?id=1218909
• https://bugzilla.suse.com/show_bug.cgi?id=1218911