RHBA-2023:3099 - Bug Fix Advisory

Topic

An update for java-17-openjdk is now available for Red Hat Enterprise Linux 8.8.

Description

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Bug Fix(es):

• All RHEL versions now share a single OpenJDK build (RHBZ#2189330)
• In FIPS mode, the list of cryptographic services and algorithms available is

limited to those that are FIPS compliant. It was found that this filtering was
too strict and was also excluding service attributes. These attributes are now
made available in FIPS mode, as they are in non-FIPS mode. (RHBZ#2186834)

• Previously, the XML signature provider was unable to operate in FIPS mode.

Following recent enhancements to FIPS mode support, the XML signature provider
can now be supported. It is now enabled in FIPS mode. (RHBZ#2186826)

• The PKCS#11 provider used by FIPS mode can be supported by different PKCS#11

tokens. It was found that some PKCS#11 tokens may not be initialised fully
before use, leading to an exception being thrown by the provider. With this
release, this exception is now expected and handled by the FIPS support code.
(RHBZ#2186830)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
• Red Hat CodeReady Linux Builder for x86_64 8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 8.8 aarch64

Fixes

• BZ - 2186826 - Enable XML Signature provider in FIPS mode [rhel-8, openjdk-17] [rhel-8.8.0.z]
• BZ - 2186830 - C_GetInfo can throw an exception if called before initialization in some PKCS #11 tokens [rhel-8, openjdk-17] [rhel-8.8.0.z]
• BZ - 2186834 - Add missing attributes when registering services in FIPS mode [rhel-8, openjdk-17] [rhel-8.8.0.z]
• BZ - 2189330 - Repackage portable build rather than building a new JDK [rhel-8, openjdk-17] [rhel-8.8.0.z]

CVEs

(none)

References

(none)