Bug 2133765 (CVE-2022-21624) - CVE-2022-21624 OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910)
Summary: CVE-2022-21624 OpenJDK: insufficient randomization of JNDI DNS port numbers (...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-21624
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2133708 2133711 2133718 2133721 2133727 2133730 2134564 2142629 2133701 2133703 2133704 2133705 2133706 2133707 2133709 2133710 2133712 2133713 2133714 2133715 2133716 2133717 2133719 2133720 2133722 2133723 2133724 2133725 2133726 2133728 2133729 2142628 2144796 2144907
Blocks: 2133694
TreeView+ depends on / blocked
 
Reported: 2022-10-11 10:20 UTC by Mauro Matteo Cascella
Modified: 2023-01-14 07:00 UTC (History)
21 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-01-14 07:00:39 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:6999 0 None None None 2022-10-20 08:05:57 UTC
Red Hat Product Errata RHSA-2022:7000 0 None None None 2022-10-19 22:39:00 UTC
Red Hat Product Errata RHSA-2022:7001 0 None None None 2022-10-19 22:23:59 UTC
Red Hat Product Errata RHSA-2022:7002 0 None None None 2022-10-19 22:11:02 UTC
Red Hat Product Errata RHSA-2022:7003 0 None None None 2022-10-19 21:30:25 UTC
Red Hat Product Errata RHSA-2022:7004 0 None None None 2022-10-19 21:18:40 UTC
Red Hat Product Errata RHSA-2022:7005 0 None None None 2022-10-19 22:13:57 UTC
Red Hat Product Errata RHSA-2022:7006 0 None None None 2022-10-19 22:18:44 UTC
Red Hat Product Errata RHSA-2022:7007 0 None None None 2022-10-20 08:02:16 UTC
Red Hat Product Errata RHSA-2022:7008 0 None None None 2022-10-19 22:30:26 UTC
Red Hat Product Errata RHSA-2022:7009 0 None None None 2022-10-19 21:12:46 UTC
Red Hat Product Errata RHSA-2022:7010 0 None None None 2022-10-19 22:28:15 UTC
Red Hat Product Errata RHSA-2022:7011 0 None None None 2022-10-19 22:25:27 UTC
Red Hat Product Errata RHSA-2022:7012 0 None None None 2022-10-19 22:39:52 UTC
Red Hat Product Errata RHSA-2022:7013 0 None None None 2022-10-20 08:04:38 UTC
Red Hat Product Errata RHSA-2022:7049 0 None None None 2022-10-20 10:10:20 UTC
Red Hat Product Errata RHSA-2022:7050 0 None None None 2022-10-20 10:11:00 UTC
Red Hat Product Errata RHSA-2022:7051 0 None None None 2022-10-20 10:26:08 UTC
Red Hat Product Errata RHSA-2022:7052 0 None None None 2022-10-20 10:18:51 UTC
Red Hat Product Errata RHSA-2022:7053 0 None None None 2022-10-20 10:27:53 UTC
Red Hat Product Errata RHSA-2022:7054 0 None None None 2022-10-20 10:20:06 UTC
Red Hat Product Errata RHSA-2022:8880 0 None None None 2022-12-07 10:45:16 UTC
Red Hat Product Errata RHSA-2023:0128 0 None None None 2023-01-12 08:33:39 UTC

Description Mauro Matteo Cascella 2022-10-11 10:20:45 UTC 
It was discovered that the JNDI component of OpenJDK did not properly randomize DNS port numbers, potentially making it easier for a remote attacker to perform spoofing attacks.
Comment 17 Mauro Matteo Cascella 2022-10-19 15:09:32 UTC 
Public now via Oracle CPU October 2022:

https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixJAVA

Fixed in Oracle Java SE 8u351, 11.0.17, 17.0.5, 19.0.1.

Release notes:
https://www.oracle.com/java/technologies/javase/8u351-relnotes.html
https://www.oracle.com/java/technologies/javase/11-0-17-relnotes.html
https://www.oracle.com/java/technologies/javase/17-0-5-relnotes.html
https://www.oracle.com/java/technologies/javase/19-0-1-relnotes.html
Comment 18 errata-xmlrpc 2022-10-19 21:12:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:7009 https://access.redhat.com/errata/RHSA-2022:7009
Comment 19 errata-xmlrpc 2022-10-19 21:18:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:7004 https://access.redhat.com/errata/RHSA-2022:7004
Comment 20 errata-xmlrpc 2022-10-19 21:30:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:7003 https://access.redhat.com/errata/RHSA-2022:7003
Comment 21 errata-xmlrpc 2022-10-19 22:10:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:7002 https://access.redhat.com/errata/RHSA-2022:7002
Comment 22 errata-xmlrpc 2022-10-19 22:13:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:7005 https://access.redhat.com/errata/RHSA-2022:7005
Comment 23 errata-xmlrpc 2022-10-19 22:18:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7006 https://access.redhat.com/errata/RHSA-2022:7006
Comment 24 errata-xmlrpc 2022-10-19 22:23:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:7001 https://access.redhat.com/errata/RHSA-2022:7001
Comment 25 errata-xmlrpc 2022-10-19 22:25:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:7011 https://access.redhat.com/errata/RHSA-2022:7011
Comment 26 errata-xmlrpc 2022-10-19 22:28:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:7010 https://access.redhat.com/errata/RHSA-2022:7010
Comment 27 errata-xmlrpc 2022-10-19 22:30:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:7008 https://access.redhat.com/errata/RHSA-2022:7008
Comment 28 errata-xmlrpc 2022-10-19 22:38:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7000 https://access.redhat.com/errata/RHSA-2022:7000
Comment 29 errata-xmlrpc 2022-10-19 22:39:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7012 https://access.redhat.com/errata/RHSA-2022:7012
Comment 30 errata-xmlrpc 2022-10-20 08:02:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7007 https://access.redhat.com/errata/RHSA-2022:7007
Comment 31 errata-xmlrpc 2022-10-20 08:04:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7013 https://access.redhat.com/errata/RHSA-2022:7013
Comment 32 errata-xmlrpc 2022-10-20 08:05:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:6999 https://access.redhat.com/errata/RHSA-2022:6999
Comment 33 errata-xmlrpc 2022-10-20 10:10:18 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u352

Via RHSA-2022:7049 https://access.redhat.com/errata/RHSA-2022:7049
Comment 34 errata-xmlrpc 2022-10-20 10:10:58 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u352

Via RHSA-2022:7050 https://access.redhat.com/errata/RHSA-2022:7050
Comment 35 errata-xmlrpc 2022-10-20 10:18:48 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 11.0.17

Via RHSA-2022:7052 https://access.redhat.com/errata/RHSA-2022:7052
Comment 36 errata-xmlrpc 2022-10-20 10:20:02 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 11.0.17

Via RHSA-2022:7054 https://access.redhat.com/errata/RHSA-2022:7054
Comment 37 errata-xmlrpc 2022-10-20 10:26:05 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.5

Via RHSA-2022:7051 https://access.redhat.com/errata/RHSA-2022:7051
Comment 38 errata-xmlrpc 2022-10-20 10:27:51 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.5

Via RHSA-2022:7053 https://access.redhat.com/errata/RHSA-2022:7053
Comment 39 Mauro Matteo Cascella 2022-10-20 13:28:41 UTC 
OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/a3097d41a1d27223d7dfc876b5d8684c13a1ee39

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/0db04eeefd2a24000b7be46fdc75d332cdb1935b

OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/a2fb4c151714ae4203cb6d024fcbf9c1ea590bdb
Comment 42 errata-xmlrpc 2022-12-07 10:45:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2022:8880 https://access.redhat.com/errata/RHSA-2022:8880
Comment 43 errata-xmlrpc 2023-01-12 08:33:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0128 https://access.redhat.com/errata/RHSA-2023:0128
Comment 44 Product Security DevOps Team 2023-01-14 07:00:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-21624
Note You need to log in before you can comment on or make changes to this bug.