Bug 1211615 (CVE-2023-2597) - VUL-0: CVE-2023-2597: java-1_8_0-openj9: buffer overflow in shared cache implementation
Summary: VUL-0: CVE-2023-2597: java-1_8_0-openj9: buffer overflow in shared cache impl...
Status: RESOLVED FIXED
Alias: CVE-2023-2597
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Fridrich Strba
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/367132/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-2597:7.0:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-05-22 15:30 UTC by Thomas Leroy
Modified: 2023-08-17 12:37 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2023-05-22 15:30:08 UTC 
CVE-2023-2597

In Eclipse Openj9 before version 0.38.0, in the implementation of the shared
cache (which is enabled by default in OpenJ9 builds) the size of a string is not
properly checked against the size of the buffer.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-2597
https://www.cve.org/CVERecord?id=CVE-2023-2597
https://github.com/eclipse-openj9/openj9/pull/17259
Comment 1 Thomas Leroy 2023-05-22 15:35:16 UTC 
Affected:
- SUSE:SLE-15-SP2:Update/java-1_8_0-openj9
Comment 3 Maintenance Automation 2023-06-09 08:30:03 UTC 
SUSE-SU-2023:2476-1: An update that solves nine vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1210711, 1210826, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597, CVE-2023-30441
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 4 Maintenance Automation 2023-06-13 08:30:01 UTC 
SUSE-SU-2023:2491-1: An update that solves nine vulnerabilities and has one fix can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1210711, 1210826, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597, CVE-2023-30441
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2023-08-14 12:30:10 UTC 
SUSE-SU-2023:3305-1: An update that solves eight vulnerabilities can now be installed.

Category: security (important)
Bug References: 1210628, 1210631, 1210632, 1210634, 1210635, 1210636, 1210637, 1211615
CVE References: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2023-2597
Sources used:
openSUSE Leap 15.4 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2
openSUSE Leap 15.5 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2
SUSE Package Hub 15 15-SP5 (src): java-1_8_0-openj9-1.8.0.372-150200.3.33.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.