First Last Prev Next    This bug is not in your last search results.
Bug 1191912 - (CVE-2021-35561) VUL-0: CVE-2021-35561: java-1_8_0-openjdk,java-11-openjdk,java-1_7_0-openjdk: Excessive memory allocation in HashMap and HashSet (Utility, 8266097)
(CVE-2021-35561)
VUL-0: CVE-2021-35561: java-1_8_0-openjdk,java-11-openjdk,java-1_7_0-openjdk:...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/313040/
CVSSv3.1:SUSE:CVE-2021-35561:5.3:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2021-10-21 13:19 UTC by Alexander Bergmann
Modified: 2022-08-03 16:23 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2021-10-21 13:19:46 UTC 
rh#2014524

A flaw was found in the way the HashMap and the HashSet classes implementations in the Utility component of OpenJDK validated the load factor value during deserialization.  A specially crafted serialized data stream could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition when deserialized.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2014524
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-35561
https://www.oracle.com/security-alerts/cpuoct2021.html#CVE-2021-35561
https://www.oracle.com/security-alerts/cpuoct2021.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35561
Comment 2 Swamp Workflow Management 2021-10-27 13:21:08 UTC 
SUSE-SU-2021:3528-1: An update that fixes 10 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP5 (src):    java-11-openjdk-11.0.13.0-3.33.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2021-11-04 17:29:30 UTC 
openSUSE-SU-2021:3615-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1185055,1185056,1188564,1188565,1188566,1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-2161,CVE-2021-2163,CVE-2021-2341,CVE-2021-2369,CVE-2021-2388,CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    java-1_8_0-openj9-1.8.0.312-3.18.2
Comment 8 Swamp Workflow Management 2021-11-06 05:18:00 UTC 
openSUSE-SU-2021:1455-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1185055,1185056,1188564,1188565,1188566,1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-2161,CVE-2021-2163,CVE-2021-2341,CVE-2021-2369,CVE-2021-2388,CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    java-1_8_0-openj9-1.8.0.312-lp152.3.12.1
Comment 11 Swamp Workflow Management 2021-11-16 17:19:43 UTC 
SUSE-SU-2021:3671-1: An update that fixes 10 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE Enterprise Storage 6 (src):    java-11-openjdk-11.0.13.0-3.65.1
SUSE CaaS Platform 4.0 (src):    java-11-openjdk-11.0.13.0-3.65.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2021-11-16 17:34:26 UTC 
openSUSE-SU-2021:3671-1: An update that fixes 10 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    java-11-openjdk-11.0.13.0-3.65.1
Comment 13 Swamp Workflow Management 2021-11-17 14:30:52 UTC 
openSUSE-SU-2021:1480-1: An update that fixes 10 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    java-11-openjdk-11.0.13.0-lp152.2.21.2
Comment 14 Swamp Workflow Management 2021-11-23 20:21:00 UTC 
openSUSE-SU-2021:3770-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191905,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35588,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
Comment 15 Swamp Workflow Management 2021-11-23 20:23:52 UTC 
SUSE-SU-2021:3770-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191905,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35588,CVE-2021-35603
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Linux Enterprise Module for Legacy Software 15-SP2 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE Enterprise Storage 6 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2
SUSE CaaS Platform 4.0 (src):    java-1_8_0-openjdk-1.8.0.312-3.58.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2021-11-23 20:32:28 UTC 
SUSE-SU-2021:3771-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191905,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35588,CVE-2021-35603
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE OpenStack Cloud Crowbar 8 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE OpenStack Cloud 8 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1
HPE Helion Openstack 8 (src):    java-1_8_0-openjdk-1.8.0.312-27.66.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Swamp Workflow Management 2021-11-24 20:20:26 UTC 
openSUSE-SU-2021:1500-1: An update that fixes 11 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191903,1191904,1191905,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35567,CVE-2021-35578,CVE-2021-35586,CVE-2021-35588,CVE-2021-35603
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    java-1_8_0-openjdk-1.8.0.312-lp152.2.18.2
Comment 18 Swamp Workflow Management 2021-11-24 20:33:44 UTC 
SUSE-SU-2021:3797-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1191901,1191905,1191906,1191909,1191910,1191911,1191912,1191913,1191914
CVE References: CVE-2021-35550,CVE-2021-35556,CVE-2021-35559,CVE-2021-35561,CVE-2021-35564,CVE-2021-35565,CVE-2021-35586,CVE-2021-35588,CVE-2021-35603
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE OpenStack Cloud Crowbar 8 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE OpenStack Cloud 9 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE OpenStack Cloud 8 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2
HPE Helion Openstack 8 (src):    java-1_7_0-openjdk-1.7.0.321-43.53.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Petr Ostadal 2022-04-07 09:33:26 UTC 
fixed
Comment 22 Swamp Workflow Management 2022-07-23 16:15:49 UTC 
SUSE-SU-2022:2539-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1191912,1194931,1198670,1198671,1198672,1198673,1198674,1198675,1201643
CVE References: CVE-2021-35561,CVE-2022-21299,CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21449,CVE-2022-21476,CVE-2022-21496
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE OpenStack Cloud 9 (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_7_1-ibm-1.7.1_sr5.10-38.71.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Swamp Workflow Management 2022-07-23 16:17:19 UTC 
SUSE-SU-2022:2540-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1191912,1194931,1198670,1198671,1198672,1198673,1198674,1198675,1201643
CVE References: CVE-2021-35561,CVE-2022-21299,CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21449,CVE-2022-21476,CVE-2022-21496
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE OpenStack Cloud 9 (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Server 12-SP5 (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.10-30.90.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 Swamp Workflow Management 2022-08-03 16:23:46 UTC 
SUSE-SU-2022:2650-1: An update that solves 8 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1191912,1194931,1198670,1198671,1198672,1198673,1198674,1198675,1201643
CVE References: CVE-2021-35561,CVE-2022-21299,CVE-2022-21426,CVE-2022-21434,CVE-2022-21443,CVE-2022-21449,CVE-2022-21476,CVE-2022-21496
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
openSUSE Leap 15.3 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Manager Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Manager Retail Branch Server 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Manager Proxy 4.1 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server for SAP 15 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Server 15-LTSS (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Module for Legacy Software 15-SP4 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Enterprise Storage 7 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE Enterprise Storage 6 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1
SUSE CaaS Platform 4.0 (src):    java-1_8_0-ibm-1.8.0_sr7.10-150000.3.59.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
First Last Prev Next    This bug is not in your last search results.