Bug 1211615 (CVE-2023-2597)

Summary:	VUL-0: CVE-2023-2597: java-1_8_0-openj9: buffer overflow in shared cache implementation
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Thomas Leroy <thomas.leroy>
Component:	Incidents	Assignee:	Fridrich Strba <fstrba>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	cathy.hu, security-team, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/367132/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-2597:7.0:(AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Thomas Leroy 2023-05-22 15:30:08 UTC

CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared
cache (which is enabled by default in OpenJ9 builds) the size of a string is not
properly checked against the size of the buffer.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-2597
https://www.cve.org/CVERecord?id=CVE-2023-2597
https://github.com/eclipse-openj9/openj9/pull/17259

Comment 1 Thomas Leroy 2023-05-22 15:35:16 UTC

Affected:
- SUSE:SLE-15-SP2:Update/java-1_8_0-openj9

Comment 3 Maintenance Automation 2023-06-09 08:30:03 UTC

SUSE-SU-2023:2476-1: An update that solves nine vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1210711, 1210826, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597, CVE-2023-30441
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 4 Maintenance Automation 2023-06-13 08:30:01 UTC

SUSE-SU-2023:2491-1: An update that solves nine vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1210711, 1210826, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597, CVE-2023-30441
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 7 Maintenance Automation 2023-08-14 12:30:10 UTC

SUSE-SU-2023:3305-1: An update that solves eight vulnerabilities can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597
Sources used:
openSUSE Leap 15.4 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2
openSUSE Leap 15.5 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2
SUSE Package Hub 15 15-SP5 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.