Bug 2015659 (CVE-2021-35588) - CVE-2021-35588 OpenJDK: Incomplete validation of inner class references in ClassFileParser (Hotspot, 8268071)
Summary: CVE-2021-35588 OpenJDK: Incomplete validation of inner class references in Cl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-35588
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2012336 2012337 2012338 2012339 2014299 2014300
Blocks: 2011827
TreeView+ depends on / blocked
 
Reported: 2021-10-19 19:52 UTC by Tomas Hoger
Modified: 2021-12-13 09:14 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2021-10-20 14:09:16 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:3952 0 None None None 2021-10-25 01:19:54 UTC
Red Hat Product Errata RHBA-2021:3954 0 None None None 2021-10-25 01:23:07 UTC
Red Hat Product Errata RHBA-2021:3963 0 None None None 2021-10-25 12:33:43 UTC
Red Hat Product Errata RHBA-2021:3965 0 None None None 2021-10-25 12:32:31 UTC
Red Hat Product Errata RHBA-2021:3985 0 None None None 2021-10-26 01:30:58 UTC
Red Hat Product Errata RHBA-2021:3986 0 None None None 2021-10-26 01:28:29 UTC
Red Hat Product Errata RHBA-2021:3993 0 None None None 2021-10-26 10:35:43 UTC
Red Hat Product Errata RHBA-2021:3995 0 None Waiting on Customer [Sat6.8] Satellite RAM requirements seem to have no upper bound 2022-05-19 09:35:21 UTC
Red Hat Product Errata RHBA-2021:4048 0 None None None 2021-11-01 18:52:05 UTC
Red Hat Product Errata RHBA-2021:4125 0 None None None 2021-11-04 11:21:22 UTC
Red Hat Product Errata RHBA-2021:4127 0 None None None 2021-11-04 12:56:03 UTC
Red Hat Product Errata RHBA-2021:4584 0 None None None 2021-11-10 08:16:55 UTC
Red Hat Product Errata RHBA-2021:4732 0 None None None 2021-11-18 12:15:22 UTC
Red Hat Product Errata RHSA-2021:3884 0 None None None 2021-10-20 13:18:52 UTC
Red Hat Product Errata RHSA-2021:3885 0 None None None 2021-10-20 13:32:44 UTC
Red Hat Product Errata RHSA-2021:3889 0 None None None 2021-10-20 14:38:20 UTC
Red Hat Product Errata RHSA-2021:3893 0 None None None 2021-10-20 13:40:14 UTC
Red Hat Product Errata RHSA-2021:3960 0 None None None 2021-10-25 11:55:53 UTC
Red Hat Product Errata RHSA-2021:3961 0 None None None 2021-10-25 11:56:15 UTC

Description Tomas Hoger 2021-10-19 19:52:50 UTC 
A flaw was found in the way the ClassFileParser class implementation in the Hotspot component of OpenJDK performed validation of inner class index values.  A specially-crafted class file could cause a Java virtual machine to crash when loaded.
Comment 1 Tomas Hoger 2021-10-19 20:19:55 UTC 
Public now via Oracle CPU October 2021:

https://www.oracle.com/security-alerts/cpuoct2021.html#AppendixJAVA

Fixed in Oracle Java SE 8u311 and 7u321.
Comment 4 errata-xmlrpc 2021-10-20 13:18:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2021:3884 https://access.redhat.com/errata/RHSA-2021:3884
Comment 5 errata-xmlrpc 2021-10-20 13:32:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3885 https://access.redhat.com/errata/RHSA-2021:3885
Comment 6 errata-xmlrpc 2021-10-20 13:40:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:3893 https://access.redhat.com/errata/RHSA-2021:3893
Comment 7 Product Security DevOps Team 2021-10-20 14:09:16 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-35588
Comment 8 errata-xmlrpc 2021-10-20 14:38:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3889 https://access.redhat.com/errata/RHSA-2021:3889
Comment 9 errata-xmlrpc 2021-10-25 11:55:51 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u312

Via RHSA-2021:3960 https://access.redhat.com/errata/RHSA-2021:3960
Comment 10 errata-xmlrpc 2021-10-25 11:56:13 UTC 
This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 8u312

Via RHSA-2021:3961 https://access.redhat.com/errata/RHSA-2021:3961
Comment 11 Tomas Hoger 2021-11-07 20:19:04 UTC 
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/78565a54a256
Note You need to log in before you can comment on or make changes to this bug.