Red Hat Security Advisory: java-1.8.0-openjdk security update

The Red Hat build of OpenJDK versions 8, 11, and 21 have multiple security vulnerabilities that have been addressed in recent updates. The vulnerabilities include a crash caused by long exception messages (CVE-2024-21011), an integer overflow in the C1 compiler address generation (CVE-2024-21068), excessive memory allocation in Pack200 (CVE-2024-21085), C2 compilation failures due to exceeding internal array limits (CVE-2024-21094), and improper reverse DNS lookup in the HTTP/2 client (CVE-2024-21012). These issues could lead to crashes or improper behavior of the Java runtime environment. Red Hat has issued updated packages that fix these vulnerabilities and recommends restarting all running OpenJDK Java instances after applying the updates.

The vulnerabilities may cause crashes or improper behavior in the OpenJDK runtime environment, potentially affecting application stability and security. The integer overflow and excessive memory allocation issues could lead to resource exhaustion or denial of service. The improper reverse DNS lookup in the HTTP/2 client could cause unexpected network behavior. The overall security impact is rated as moderate by Red Hat.

Red Hat has released official security updates for OpenJDK 8, 11, and 21 builds that address these vulnerabilities. Users should apply the relevant updates provided by Red Hat for their OpenJDK versions. After updating, all running OpenJDK Java instances must be restarted to ensure the fixes take effect. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258 for detailed guidance.