This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============4689408480872471161==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------qC0lfZ8IkOLu05bhJai6uw0E"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------qC0lfZ8IkOLu05bhJai6uw0E
Content-Type: multipart/mixed;
 boundary="------------SvJJ0r0QhmzLeaTGk8CZ1LtN";
 protected-headers="v1"
From: Evan Caville <evan.caville@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <ffa552eb-1fe7-46e9-8a5f-42477a025b26@canonical.com>
Subject: [USN-7255-1] OpenJDK 23 vulnerability

--------------SvJJ0r0QhmzLeaTGk8CZ1LtN
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

==========================================================================
Ubuntu Security Notice USN-7255-1
February 05, 2025

openjdk-23 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.10

Summary:

OpenJDK 23 could be made to expose sensitive information over the
network.

Software Description:
- openjdk-23: Open Source Java implementation

Details:

It was discovered that the Hotspot component of OpenJDK 23 did not properly
handle API access under certain circumstances. An unauthenticated attacker
could possibly use this issue to access unauthorized resources and expose
sensitive information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.10
   openjdk-23-jdk                  23.0.2+7-1ubuntu1~24.10
   openjdk-23-jdk-headless         23.0.2+7-1ubuntu1~24.10
   openjdk-23-jre                  23.0.2+7-1ubuntu1~24.10
   openjdk-23-jre-headless         23.0.2+7-1ubuntu1~24.10
   openjdk-23-jre-zero             23.0.2+7-1ubuntu1~24.10

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7255-1
   CVE-2025-21502

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-23/23.0.2+7-1ubuntu1~24.10

--------------SvJJ0r0QhmzLeaTGk8CZ1LtN--

--------------qC0lfZ8IkOLu05bhJai6uw0E
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature.asc"

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmejB/wFAwAAAAAACgkQWNrRIKaTkWfA
5Q/+IxnBQvlFAYL6mHwppJW+YwEayYCDm/WfkfY6ordBvLBNMkvEdj0l+WBI7QKGfpt/3WbdLF2l
tp+/8Rwo1PQDAgzF5q96p/BM4BUVTq+/3c8MdB/Hy4/EVwDXL8ubm0twDcFYg79lMi+E0VQ+PEUW
8OY4E9KIf27cFiDOTkgo8hd8I551NUJHl3fJ8NPTMKle0lViz50Msw68EbvZH9RPsQy6mbmkrho6
DCwJpg1OAvv8jsdaOR+bQ/v0Nog1S9b6iG5GunTd8wkS3dmHFLwHQdgNB/3Ik0XaL6nPzaFq7lmA
+LdDUU/klFtAvUpRKm6EM6WYVIzAxw5lPRbEUdA0KkKvrzdhHGAcAjf6hV9DNRJa5aEDJK5Dsg+q
kvbR73RbExT77/irclvlYkDgyGBRonvVyFX2DpCZDrR5u+jCl8nifsoJzrZgfIFBaTho6plPSvyb
HwdzzY4y7QzKFo0q1Co6NV2SLmog4rfeV3qzs9ypQ9NXCtwtFabPPb15xomkqXSJq6tGtNXZhlkU
ja1e+vgc3NCWmUg0NFpRKFfdo0Gmx9hf1gDceNgEEVxjQvgWh6/ub2Rgc2tvUGfvB6HI3P9KCoXu
RD6aG3y7Ds02ZUnLfsDc4k2ErctT+bRKeCTPnmoOrymyKNcZy7mNELWBHU1oYpSOja2+zP7Xgjvl
Xoc=
=5I18
-----END PGP SIGNATURE-----

--------------qC0lfZ8IkOLu05bhJai6uw0E--


--===============4689408480872471161==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============4689408480872471161==--