{"schema_version":"1.7.3","id":"SUSE-SU-2023:1850-1","published":"2023-04-14T13:07:14Z","modified":"2026-02-04T04:15:40.168071Z","related":["CVE-2022-21426","CVE-2023-21830","CVE-2023-21835","CVE-2023-21843"],"upstream":["CVE-2022-21426","CVE-2023-21830","CVE-2023-21835","CVE-2023-21843"],"summary":"Security update for java-1_8_0-ibm","details":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 8 (bsc#1208480):\n\n  * Security fixes:\n    - CVE-2023-21830: Fixed improper restrictions in CORBA deserialization (bsc#1207249).\n    - CVE-2023-21835: Fixed handshake DoS attack against DTLS connections (bsc#1207246).\n    - CVE-2023-21843: Fixed soundbank URL remote loading (bsc#1207248).\n  \n  * New Features/Enhancements:\n    - Add RSA-PSS signature to IBMJCECCA.\n  * Defect Fixes:\n    - IJ45437 Service, Build, Packaging and Deliver: Getting\n      FIPSRUNTIMEEXCEPTION when calling java code:\n      MESSAGEDIGEST.GETINSTANCE('SHA256', 'IBMJCEFIPS'); in MAC\n    - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843\n    - IJ45280 Class Libraries: Update timezone information to the\n      latest TZDATA2022F\n    - IJ44896 Class Libraries: Update timezone information to the\n      latest TZDATA2022G\n    - IJ45436 Java Virtual Machine: Stack walking code gets into\n      endless loop, hanging the application\n    - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified\n      multiple times on the same command line the first option takes\n      precedence instead of the last\n    - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()\n      due to a NULL pointer\n    - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static\n      final field object properties\n    - IJ44107 JIT Compiler: JIT publishes new object reference to other\n      threads without executing a memory flush\n    - IX90193 ORB: Fix security vulnerability CVE-2023-21830\n    - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has\n      similar error of JDK-8253368\n    - IJ45148 Security: code changes for tech preview\n    - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,\n      using IBMJCEPLUS, causes a small memory leak\n    - IJ44172 Security: Disable SHA-1 signed jars for EA\n    - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,\n      using IBMJCEPLUS, Causes a small memory leak\n    - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305\n      crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION\n    - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA\n      during signature operations resulting in Java cores\n    - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm\n    - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain\n      a SUBJECTKEYIDENTIFIER extension\n    - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()\n      method uses SHA1XXXX signature algorithms to match private and public keys\n    - IJ45203 Security: RSAPSS multiple names for KEYTYPE\n    - IJ43920 Security: The PKCS12 keystore update and the PBES2 support\n    - IJ40002 XML: Fix security vulnerability CVE-2022-21426\n","affected":[{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP4","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Enterprise Storage 7","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Enterprise%20Storage%207"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"SUSE:Enterprise Storage 7.1","purl":"pkg:rpm/suse/java-1_8_0-ibm&distro=SUSE%20Enterprise%20Storage%207.1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}},{"package":{"name":"java-1_8_0-ibm","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/java-1_8_0-ibm&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.0-150000.3.71.1"}]}],"ecosystem_specific":{"binaries":[{"java-1_8_0-ibm":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-32bit":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-alsa":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-demo":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-devel-32bit":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-plugin":"1.8.0_sr8.0-150000.3.71.1","java-1_8_0-ibm-src":"1.8.0_sr8.0-150000.3.71.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:1850-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231850-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1207246"},{"type":"REPORT","url":"https://bugzilla.suse.com/1207248"},{"type":"REPORT","url":"https://bugzilla.suse.com/1207249"},{"type":"REPORT","url":"https://bugzilla.suse.com/1208480"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-21426"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-21830"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-21835"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-21843"}]}