Bug 56632 - openjdk-11: Multiple issues (5.0)
Summary: openjdk-11: Multiple issues (5.0)
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Security updates
Version: UCS 5.0
Hardware: All Linux
: P3 normal
Target Milestone: UCS 5.0-5-errata
Assignee: Quality Assurance
QA Contact: Philipp Hahn
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-09-20 15:08 CEST by Quality Assurance
Modified: 2023-09-20 17:56 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2023-09-20 15:08:45 CEST
New Debian openjdk-11 11.0.20+8-1~deb10u1 fixes:
This update addresses the following issues:
11.0.20+8-1~deb10u1 (Mon, 18 Sep 2023 19:14:04 +0200)
* Non-maintainer upload by the LTS Team.
* Backport to buster.
11.0.20+8-1 (Wed, 19 Jul 2023 08:40:22 +0200)
* OpenJDK 11.0.20 release, build 8. - CVE-2023-22041, CVE-2023-25193,  CVE-2023-22045, CVE-2023-22049, CVE-2023-22036, CVE-2023-22006. - Release  notes:  https://www.oracle.com/java/technologies/javase/11-0-20-relnotes.html#R11_0_20
* Link with --no-as-needed..
* Refresh patches.
11.0.20~7-1 (Sat, 01 Jul 2023 09:11:49 +0200)
* OpenJDK 11.0.20+7 build (early access).
[ Vladimir Petko ]
* debian/copyright: convert to a machine-readable format.
* debian/copyright: align excludes statement with openjdk-17.
* Provide versioned java-runtime, java-runtime-headless, java-sdk and  java-sdk-headless virtual packages (Emmanuel Bourg).
* Configure --with-stdc++lib=static on ia64.
* Bump standards version.
11.0.19+7-1 (Sun, 11 Jun 2023 12:55:28 +0200)
* OpenJDK 11.0.19 release, build 7. - CVE-2023-21930, CVE-2023-21937,  CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967,  CVE-2023-21968. - Release notes:  https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-April/021900.html -  d/p/*: refresh patches.
* debian/JB-jre-headless.postinst.in: trigger ca-certificates-java after jre  is set up.
* d/p: drop obsolete patches (LP: #2011653). -  workaround_expand_exec_shield_cs_limit.diff: obsoleted by  hotspot-disable-exec-shield-workaround.diff. - generated-headers.patch:  include is already added by openjdk makefile. - parallel-build-fix.diff:  include is not necessary.
* d/copyright, d/watch: implement uscan repackaging (LP: #2011749).
* d/rules: use --with-debug-symbols=none (LP: #2003820).
* d/control: add jtreg6 dependencies, regenerate control.
* d/t/{jdk,hotspot,jaxp,langtools}: run tier1 and tier2 jtreg tests only, add  test options from OpenJDK makefile.
* d/t/*: fix test environment: add missing -nativepath (LP: #2001563).
* d/t/jdk: provide dbus session for the window manager (LP: #2001576).
* d/p/*: add patches for jtreg tests: - disable-thumb-assertion.patch: fix  JDK-8305481. - update-assertion-for-armhf.patch: fix JDK-8305480. -  log-generated-classes-test.patch: workaround JDK-8166162. -  update-permission-test.patch: add security permissions for testng 7. -  ldap-timeout-test-use-ip.patch, test-use-ip-address.patch: Ubuntu-specific  patches to workaround missing DNS resolver on the build machines. -  exclude_broken_tests.patch: quarantine failing tests.
* d/rules: package external debug symbols (LP: #2015835).
* drop d/p/{jaw-classpath.diff, jaw-optional.diff}: the atk wrapper is  disabled and these patches cause class data sharing tests to fail (LP:  #2016194).
* d/p/exclude-broken-tests.patch: add OpenJDK 11 failures.
* d/t/jtreg-autopkgtest.in: pass JTREG home to locate junit.jar, regenerate  d/t/jtreg-autopkgtest.sh (LP: #2016206).
* d/t/control.in: disable jtreg autopkgtests in line with openjdk 17,  regenerate control (LP: #2016438).
* d/rules: pack external debug symbols with build-id, do not pack duplicate  symbols, do not strip JVM shared libraries (LP: #2012326, LP: #2016739).
* d/rules: always use jtreg6.
[ Matthias Klose ]
* d/rules: Fix using CC/CXX for recent releases.
Comment 1 Quality Assurance univentionstaff 2023-09-20 15:21:05 CEST
--- mirror/ftp/pool/main/o/openjdk-11/openjdk-11_11.0.18+10-1~deb10u1.dsc
+++ apt/ucs_5.0-0-errata5.0-5/source/openjdk-11_11.0.20+8-1~deb10u1.dsc
@@ -1,3 +1,79 @@
+11.0.20+8-1~deb10u1 [Mon, 18 Sep 2023 19:14:04 +0200] Emilio Pozuelo Monfort <pochu@debian.org>:
+
+  * Non-maintainer upload by the LTS Team.
+  * Backport to buster.
+
+11.0.20+8-1 [Wed, 19 Jul 2023 08:40:22 +0200] Matthias Klose <doko@ubuntu.com>:
+
+  * OpenJDK 11.0.20 release, build 8.
+    - CVE-2023-22041, CVE-2023-25193, CVE-2023-22045,
+      CVE-2023-22049, CVE-2023-22036, CVE-2023-22006.
+    - Release notes:
+      https://www.oracle.com/java/technologies/javase/11-0-20-relnotes.html#R11_0_20
+
+  * Link with --no-as-needed. Closes: #1031521.
+  * Refresh patches.
+
+11.0.20~7-1 [Sat, 01 Jul 2023 09:11:49 +0200] Matthias Klose <doko@ubuntu.com>:
+
+  * OpenJDK 11.0.20+7 build (early access).
+
+  [ Vladimir Petko ]
+  * debian/copyright: convert to a machine-readable format.
+  * debian/copyright: align excludes statement with openjdk-17.
+
+  * Provide versioned java-runtime, java-runtime-headless, java-sdk
+    and java-sdk-headless virtual packages (Emmanuel Bourg).
+  * Configure --with-stdc++lib=static on ia64.
+  * Bump standards version.
+
+11.0.19+7-1 [Sun, 11 Jun 2023 12:55:28 +0200] Matthias Klose <doko@ubuntu.com>:
+
+  * OpenJDK 11.0.19 release, build 7.
+    - CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939,
+      CVE-2023-21954, CVE-2023-21967, CVE-2023-21968.
+    - Release notes:
+      https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-April/021900.html
+    - d/p/*: refresh patches.
+
+  [ Vladimir Petko ]
+  * debian/JB-jre-headless.postinst.in: trigger ca-certificates-java after jre
+    is set up.
+  * d/p: drop obsolete patches (LP: #2011653).
+    - workaround_expand_exec_shield_cs_limit.diff: obsoleted by
+      hotspot-disable-exec-shield-workaround.diff.
+    - generated-headers.patch: include is already added by openjdk makefile.
+    - parallel-build-fix.diff: include is not necessary.
+  * d/copyright, d/watch: implement uscan repackaging (LP: #2011749).
+  * d/rules: use --with-debug-symbols=none (LP: #2003820).
+  * d/control: add jtreg6 dependencies, regenerate control.
+  * d/t/{jdk,hotspot,jaxp,langtools}: run tier1 and tier2 jtreg tests only,
+    add test options from OpenJDK makefile.
+  * d/t/*: fix test environment: add missing -nativepath (LP: #2001563).
+  * d/t/jdk: provide dbus session for the window manager (LP: #2001576).
+  * d/p/*: add patches for jtreg tests:
+    - disable-thumb-assertion.patch: fix JDK-8305481.
+    - update-assertion-for-armhf.patch: fix JDK-8305480.
+    - log-generated-classes-test.patch: workaround JDK-8166162.
+    - update-permission-test.patch: add security permissions for testng 7.
+    - ldap-timeout-test-use-ip.patch, test-use-ip-address.patch: Ubuntu-specific
+      patches to workaround missing DNS resolver on the build machines.
+    - exclude_broken_tests.patch: quarantine failing tests.
+  * d/rules: package external debug symbols (LP: #2015835).
+  * drop d/p/{jaw-classpath.diff, jaw-optional.diff}: the atk wrapper is disabled
+    and these patches cause class data sharing tests to fail (LP: #2016194).
+  * d/p/exclude-broken-tests.patch: add OpenJDK 11 failures.
+  * d/t/jtreg-autopkgtest.in: pass JTREG home to locate junit.jar, regenerate
+    d/t/jtreg-autopkgtest.sh (LP: #2016206).
+  * d/t/control.in: disable jtreg autopkgtests in line with openjdk 17,
+    regenerate control (LP: #2016438).
+  * d/rules: pack external debug symbols with build-id, do not pack duplicate
+    symbols, do not strip JVM shared libraries (LP: #2012326, LP: #2016739).
+  * d/rules: always use jtreg6.
+
+  [ Matthias Klose ]
+  * d/rules: Fix using CC/CXX for recent releases.
+
 11.0.18+10-1~deb10u1 [Tue, 31 Jan 2023 10:06:57 +0100] Emilio Pozuelo Monfort <pochu@debian.org>:
 
   * Non-maintainer upload by the LTS Team.

<http://piuparts.knut.univention.de/5.0-5/#4923208674602877600>
Comment 2 Philipp Hahn univentionstaff 2023-09-20 15:33:34 CEST
OK: bug
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[5.0-5] dade78ee37 Bug #56632: openjdk-11 11.0.20+8-1~deb10u1
 doc/errata/staging/openjdk-11.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[5.0-5] ceb73d29d4 Bug #56632: openjdk-11 11.0.20+8-1~deb10u1
 doc/errata/staging/openjdk-11.yaml | 77 +++++++++-----------------------------
 1 file changed, 17 insertions(+), 60 deletions(-)

[5.0-5] 3e3b5b0a4b Bug #56632: openjdk-11 11.0.20+8-1~deb10u1
 doc/errata/staging/openjdk-11.yaml | 83 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 83 insertions(+)