Re: Security updates for JDK

Am 18.11.25 um 21:19 schrieb "Douglas R. Reno"
([email protected] via blfs-dev Mailing List):
> On 11/18/25 1:39 PM, Rainer Fiebig ([email protected] via blfs-dev Mailing
> List) wrote:
>> Am 04.11.25 um 21:15 schrieb "Douglas R. Reno"
>> ([email protected] via blfs-dev Mailing List):
>>> Good afternoon,
>>>
>>> I'm catching up on things after an extended family emergency and other
>>> problems took me out of the game for a while (and to be fair, I'm still
>>> not 100% yet, but things need to be taken care of).
>>>
>>> While I was out, new Java security updates became available on October
>>> 21st. These updates fix several vulnerabilities, some of which more
>>> severe than normal and may affect standard usage of programs such as
>>> Libreoffice and fop. Some details on the vulnerabilities:
>>>
>>> - CVE-2025-53066 in the JAXP component, affecting multiple protocols.
>>> It's a network exploitable vulnerability rated as High, and is extremely
>>> trivial to exploit (and I have seen this happen on some Minecraft
>>> servers that I host). The biggest risk is data exfiltration of any file
>>> that Java can read. No risk to system integrity or availability though.
>>> This can happen silently though with no user interaction, and no
>>> privileges are required either. There's several different attack vectors
>>> which this can be possibly exploited.
>>>
>>> - CVE-2025-53057 in the Security component. That's rated as Medium, and
>>> has High attack complexity - but it does allow for a complete and total
>>> SSL bypass.
>>>
>>> - CVE-2025-61748 in the Libraries component. That's rated as Low, and
>>> can cause some integrity problems with certificates being trusted that
>>> are not supposed to be trusted, as well as some other unlisted impacts.
>>>
>>> All three of these vulnerabilities are exploitable remotely with no user
>>> interaction or privileges required. The first one is particular
>>> egregious, but I have some other security updates and tickets that I
>>> need to handle first. In the case of the three Minecraft servers that
>>> were affected that I host, the attackers attempted to read /etc/passwd
>>> and other sensitive system information.
>>>
>>> Before I file a ticket though, there's a problem that I need some advice
>>> on. Java 25 is the latest version, and is the latest LTS. However, it's
>>> got some major problems - notably that regressions cause applications
>>> like Apache ANT and Fop (https://bugs.openjdk.org/browse/JDK-8368356) to
>>> not work correctly, and even though they were reported and acknowledged
>>> by OpenJDK back in September, they have not been resolved yet. I will
>>> also note that very few of my prebuilt Java binaries run either because
>>> they accidentally changed the class version in 25.0.1.
>>>
>>> Because of the security risks involved and the instability of the Java
>>> 25 series so far, I would like to suggest downgrading the books back to
>>> Java 21. It's the stable LTS, and we know everything in the book should
>>> work with it. I don't feel comfortable leaving 24 in the book because of
>>> CVE-2025-53066.
>>>
>>> Can I have some opinions on this please? Do we go back to 21, or upgrade
>>> to 25 and spend time with upstreams trying to make the newer version
>>> work...
>> Downgrading from 24 to 21 isn't as straightforward as going from 24 to
>> 25.  So for those who don't use Ant/Fop: is there anything else that
>> would speak against upgrading to 25?  Thanks.
>>
>> Rainer
>>
> Hi Rainer,
> 
> One of the other problems that I'm encountering with Java 25 is that it
> breaks compatibility with binaries compiled for JDK17 (which was the
> default up until earlier this year). In my case, this breaks almost
> everything compiled with JDK 24, and the problems with ant that have
> been encountered by other packages will cause problems with Libreoffice
> and OpenCV. For reference, the errors that pop up on my end come out as
> "java.lang.IllegalArgumentException: Unsupported class file major
> version 69" with some packages.
> 
> As far as I know, there aren't any compatibility issues caused by
> downgrading from 24 to 21. Are you aware of any?
No, I'm not.  But when I tried to downgrade to the latest version of 21
I got this:

[...]
configure: Found potential Boot JDK using java(c) in PATH
configure: Potential Boot JDK found at /opt/jdk24u-jdk-24.0.2-ga is
incorrect JDK version (openjdk version "24.0.2-internal" 2025-07-15
OpenJDK Runtime Environment (build
24.0.2-internal-adhoc.rainer.jdk24u-jdk-24.0.2-ga) OpenJDK 64-Bit Server
VM (build 24.0.2-internal-adhoc.rainer.jdk24u-jdk-24.0.2-ga, mixed mode,
sharing)); ignoring
configure: (Your Boot JDK version must be one of: 20 21)
configure: Could not find a valid Boot JDK. OpenJDK distributions are
available at http://jdk.java.net/.
configure: This might be fixed by explicitly setting --with-boot-jdk
configure: error: Cannot continue
[...]

I just wanted to get over with those jdk-security-issues with as little
effort as possible but had deleted versions 20/21 from /opt some time
ago in a clean-up-act.  And thus I'm wondering whether upgrading to 25
might still be an option (for me, not the books).  I think I'll give it
a try and report back if I meet problems.

Rainer

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page