Bug 2376784 (CVE-2025-30754)

Summary:	CVE-2025-30754 openjdk: Enhance TLS protocol support (Oracle CPU 2025-07)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahughes, fitzsim, jsamir, khosford, mbalaoal, neugens, pjindal, security-response-team, sraghupu, sthirugn, vkrizan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2025-07-15

Description OSIDB Bzimport 2025-07-07 10:48:32 UTC

The JSSE client will complete the TLS 1.3 handshake without receiving
the EncryptedExtensions message which may lead to weakening the
protections that TLS provides.

Comment 1 Michal Findra 2025-07-25 11:11:33 UTC

OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/517df6c40d2e04729526c285ed32cf91ea5be969

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/898c0078ad1fee02b899b8e8987d2c944c8d6f54

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/645ef7b7c2f1d59200f80e62736d7a724a679906

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/bab305aff7bff5603507aa1516396728c1a1e146

Comment 2 Michal Findra 2025-07-25 12:39:42 UTC

This CVE was fixed in Oracle Java SE 8u461, 11.0.28, 17.0.16, 21.0.8. 

https://www.oracle.com/java/technologies/javase/8u461-relnotes.html#R180_461
https://www.oracle.com/java/technologies/javase/11-0-28-relnotes.html#R11_0_28
https://www.oracle.com/java/technologies/javase/17-0-16-relnotes.html#R17_0_16
https://www.oracle.com/java/technologies/javase/21-0-8-relnotes.html