Re: Security updates for JDK

On 11/18/25 1:39 PM, Rainer Fiebig ([email protected] via blfs-dev Mailing 
List) wrote:
> Am 04.11.25 um 21:15 schrieb "Douglas R. Reno"
> ([email protected] via blfs-dev Mailing List):
>> Good afternoon,
>>
>> I'm catching up on things after an extended family emergency and other
>> problems took me out of the game for a while (and to be fair, I'm still
>> not 100% yet, but things need to be taken care of).
>>
>> While I was out, new Java security updates became available on October
>> 21st. These updates fix several vulnerabilities, some of which more
>> severe than normal and may affect standard usage of programs such as
>> Libreoffice and fop. Some details on the vulnerabilities:
>>
>> - CVE-2025-53066 in the JAXP component, affecting multiple protocols.
>> It's a network exploitable vulnerability rated as High, and is extremely
>> trivial to exploit (and I have seen this happen on some Minecraft
>> servers that I host). The biggest risk is data exfiltration of any file
>> that Java can read. No risk to system integrity or availability though.
>> This can happen silently though with no user interaction, and no
>> privileges are required either. There's several different attack vectors
>> which this can be possibly exploited.
>>
>> - CVE-2025-53057 in the Security component. That's rated as Medium, and
>> has High attack complexity - but it does allow for a complete and total
>> SSL bypass.
>>
>> - CVE-2025-61748 in the Libraries component. That's rated as Low, and
>> can cause some integrity problems with certificates being trusted that
>> are not supposed to be trusted, as well as some other unlisted impacts.
>>
>> All three of these vulnerabilities are exploitable remotely with no user
>> interaction or privileges required. The first one is particular
>> egregious, but I have some other security updates and tickets that I
>> need to handle first. In the case of the three Minecraft servers that
>> were affected that I host, the attackers attempted to read /etc/passwd
>> and other sensitive system information.
>>
>> Before I file a ticket though, there's a problem that I need some advice
>> on. Java 25 is the latest version, and is the latest LTS. However, it's
>> got some major problems - notably that regressions cause applications
>> like Apache ANT and Fop (https://bugs.openjdk.org/browse/JDK-8368356) to
>> not work correctly, and even though they were reported and acknowledged
>> by OpenJDK back in September, they have not been resolved yet. I will
>> also note that very few of my prebuilt Java binaries run either because
>> they accidentally changed the class version in 25.0.1.
>>
>> Because of the security risks involved and the instability of the Java
>> 25 series so far, I would like to suggest downgrading the books back to
>> Java 21. It's the stable LTS, and we know everything in the book should
>> work with it. I don't feel comfortable leaving 24 in the book because of
>> CVE-2025-53066.
>>
>> Can I have some opinions on this please? Do we go back to 21, or upgrade
>> to 25 and spend time with upstreams trying to make the newer version
>> work...
> Downgrading from 24 to 21 isn't as straightforward as going from 24 to
> 25.  So for those who don't use Ant/Fop: is there anything else that
> would speak against upgrading to 25?  Thanks.
>
> Rainer
>
Hi Rainer,

One of the other problems that I'm encountering with Java 25 is that it 
breaks compatibility with binaries compiled for JDK17 (which was the 
default up until earlier this year). In my case, this breaks almost 
everything compiled with JDK 24, and the problems with ant that have 
been encountered by other packages will cause problems with Libreoffice 
and OpenCV. For reference, the errors that pop up on my end come out as 
"java.lang.IllegalArgumentException: Unsupported class file major 
version 69" with some packages.

As far as I know, there aren't any compatibility issues caused by 
downgrading from 24 to 21. Are you aware of any?

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page