This Red Hat Security Advisory (RHSA-2024:4568) addresses five distinct vulnerabilities in the java-17-openjdk packages for OpenJDK 17. The fixed issues are: CVE-2024-21147 (RangeCheckElimination array index overflow), CVE-2024-21131 (potential UTF8 size overflow), CVE-2024-21138 (excessive symbol length causing infinite loop), CVE-2024-21140 (Range Check Elimination pre-loop limit overflow), and CVE-2024-21145 (out-of-bounds access in 2D image handling). These vulnerabilities affect multiple Red Hat Enterprise Linux 8 and 9 variants and architectures including x86_64, s390x, ppc64le, and aarch64. The advisory provides a security update that mitigates these issues, and Red Hat classifies the impact as Important. No CVSS scores are provided in the advisory, but the severity is assessed as high based on the nature of the vulnerabilities.

The vulnerabilities fixed include array index overflows, potential size overflows, infinite loops, and out-of-bounds memory accesses, which could lead to application crashes or other unintended behavior in Java applications running on affected OpenJDK 17 versions. The advisory does not specify exploitation in the wild or direct impact beyond the potential for these issues to affect Java runtime stability and security. Red Hat rates the update as Important, indicating a significant security impact that warrants prompt remediation.

Red Hat has released an updated java-17-openjdk package that addresses these vulnerabilities. Users should apply the update as provided by Red Hat for their specific Red Hat Enterprise Linux version and architecture. After applying the update, all running OpenJDK Java instances must be restarted to ensure the fixes take effect. Refer to the Red Hat advisory RHSA-2024:4568 and the linked article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated by the vendor.