Bugzilla – Bug 1218908
VUL-0: CVE-2024-20932: java-17-openjdk: OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123)
Last modified: 2024-05-24 11:11:41 UTC
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 17.0.9; Oracle GraalVM for JDK: 17.0.9; Oracle GraalVM Enterprise Edition: 21.3.8 and 22.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-20932 https://www.oracle.com/security-alerts/cpujan2024.html https://www.cve.org/CVERecord?id=CVE-2024-20932 https://bugzilla.redhat.com/show_bug.cgi?id=2257720
Only 17 affected according to the matrix
SUSE-SU-2024:0325-1: An update that solves six vulnerabilities can now be installed. Category: security (important) Bug References: 1218903, 1218905, 1218907, 1218908, 1218909, 1218911 CVE References: CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20932, CVE-2024-20945, CVE-2024-20952 Sources used: openSUSE Leap 15.4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 openSUSE Leap 15.5 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 Basesystem Module 15-SP5 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Manager Proxy 4.3 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Manager Retail Branch Server 4.3 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 SUSE Manager Server 4.3 (src): java-17-openjdk-17.0.10.0-150400.3.36.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0605-1: An update that solves eight vulnerabilities can now be installed. Category: security (important) Bug References: 1218903, 1218905, 1218906, 1218907, 1218908, 1218909, 1218911, 1219843 CVE References: CVE-2023-33850, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20932, CVE-2024-20945, CVE-2024-20952 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:0619-1: An update that solves eight vulnerabilities can now be installed. Category: security (important) Bug References: 1218903, 1218905, 1218906, 1218907, 1218908, 1218909, 1218911, 1219843 CVE References: CVE-2023-33850, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926, CVE-2024-20932, CVE-2024-20945, CVE-2024-20952 Sources used: NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Fixed, please close.
Released. Closing bug.