openjdk-11-jdk: CVE-2022-21476 unfixed for weeks

Debian Bug report logs - #1010597
openjdk-11-jdk: CVE-2022-21476 unfixed for weeks

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Kesper <mkesper@web.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: openjdk-11-jdk: CVE-2022-21476 unfixed for weeks

Date: Thu, 05 May 2022 10:45:26 +0200

Package: openjdk-11-jdk
Version: 11.0.14+9-1~deb11u1
Severity: critical
Tags: security
Justification: causes serious data loss
X-Debbugs-Cc: mkesper@web.de, team@security.debian.org, Debian Security Team <team@security.debian.org>

Dear Maintainer,

since weeks, there is a known undisputed CVE for all openjdk versions in Debian,
https://security-tracker.debian.org/tracker/CVE-2022-21476
described as easily exploitable for unauthenticated attackers resulting in access to data.

However, there seems to be no security issue handling of this CVE, instead a fix
is only made available to unstable.

Please include a fix for Debian stable at least.

Best regards
Michael

-- System Information:
Debian Release: 11.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'proposed-updates'), (500, 'stable'), (100, 'bullseye-fasttrack'), (100, 'bullseye-backports-staging')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-14-amd64 (SMP w/6 CPU threads)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de:en_US
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages openjdk-11-jdk depends on:
ii  libc6                    2.31-13+deb11u3
ii  openjdk-11-jdk-headless  11.0.14+9-1~deb11u1
ii  openjdk-11-jre           11.0.14+9-1~deb11u1

Versions of packages openjdk-11-jdk recommends:
ii  libxt-dev  1:1.2.0-1

Versions of packages openjdk-11-jdk suggests:
pn  openjdk-11-demo    <none>
pn  openjdk-11-source  <none>
pn  visualvm           <none>

-- no debconf information

Message #10 received at 1010597@bugs.debian.org (full text, mbox, reply):

From: Sascha Girrulat <s.girrulat@conventic.com>

To: 1010597@bugs.debian.org

Subject: Re: openjdk-11-jdk: CVE-2022-21476 unfixed for weeks

Date: Thu, 5 May 2022 12:04:07 +0200

Dear Maintainer,

i saw that the CVE is already fixed for sid. I'm unsure if we have to 
try to create a bullseye backport of the 11.0.15+10-1 for ourself or if 
we have to wait a bit longer until it's fixed for bullseye too. We are 
using the container images of debian with this openjdk-jre for our 
services and we are looking forward to an update.

Cheers
Sascha

On Thu, 05 May 2022 10:45:26 +0200 Michael Kesper <mkesper@web.de> wrote:
> Package: openjdk-11-jdk
> Version: 11.0.14+9-1~deb11u1
> Severity: critical
> Tags: security
> Justification: causes serious data loss
> X-Debbugs-Cc: mkesper@web.de, team@security.debian.org, Debian Security Team <team@security.debian.org>
> 
> Dear Maintainer,
> 
> since weeks, there is a known undisputed CVE for all openjdk versions in Debian,
> https://security-tracker.debian.org/tracker/CVE-2022-21476
> described as easily exploitable for unauthenticated attackers resulting in access to data.
> 
> However, there seems to be no security issue handling of this CVE, instead a fix
> is only made available to unstable.
> 
> Please include a fix for Debian stable at least.
> 
> Best regards
> Michael
> 
> -- System Information:
> Debian Release: 11.3
>   APT prefers stable-updates
>   APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'proposed-updates'), (500, 'stable'), (100, 'bullseye-fasttrack'), (100, 'bullseye-backports-staging')
> Architecture: amd64 (x86_64)
> 
> Kernel: Linux 5.10.0-14-amd64 (SMP w/6 CPU threads)
> Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de:en_US
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled
> 
> Versions of packages openjdk-11-jdk depends on:
> ii  libc6                    2.31-13+deb11u3
> ii  openjdk-11-jdk-headless  11.0.14+9-1~deb11u1
> ii  openjdk-11-jre           11.0.14+9-1~deb11u1
> 
> Versions of packages openjdk-11-jdk recommends:
> ii  libxt-dev  1:1.2.0-1
> 
> Versions of packages openjdk-11-jdk suggests:
> pn  openjdk-11-demo    <none>
> pn  openjdk-11-source  <none>
> pn  visualvm           <none>
> 
> -- no debconf information
> 
> 

Message #23 received at 1010597-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 1010597-submitter@bugs.debian.org

Subject: closing 1010597, closing 1010597, closing 1010597

Date: Thu, 05 May 2022 16:49:45 +0200

close 1010597 11.0.15+10-1
# pending in upcoming DSA
close 1010597 11.0.15+10-1~deb11u1
close 1010597 11.0.15+10-1~deb10u1
thanks

Send a report that this bug log contains spam.