QID 378494

This release of the Red Hat build of OpenJDK 11 (11.0.14) for Windows serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.13) and includes security and bug fixes, and enhancements.

OpenJDK: Unexpected exception thrown in regex Pattern (Libraries, 8268813) (CVE-2022-21283).

OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization (Libraries, 8270392) (CVE-2022-21293).

OpenJDK: Incorrect IdentityHashMap size checks during deserialization (Libraries, 8270416) (CVE-2022-21294).

OpenJDK: Insufficient URI checks in the XSLT TransformerImpl (JAXP, 8270492) (CVE-2022-21282).

OpenJDK: Incorrect access checks in XMLEntityManager (JAXP, 8270498) (CVE-2022-21296).

OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner (JAXP, 8270646) (CVE-2022-21299).

OpenJDK: Incorrect reading of TIFF files in TIFFNullDecompressor (ImageIO, 8270952) (CVE-2022-21277).

OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8273756) (CVE-2022-21360).

OpenJDK: Integer overflow in BMPImageReader (ImageIO, 8273838) (CVE-2022-21365).
Affected Versions:
Red Hat build of OpenJDK 11 (11.0.13) and later Versions and Prior to OpenJDK 11 (11.0.14)

QID Detection Logic (Authenticated):
This QID checks for:
"HKLM\Software\JavaSoft\Java Runtime Environment"
"HKLM\Software\Wow6432Node\JavaSoft\Java Runtime Environment"
"HKLM\Software\JavaSoft\Java Development Kit"
"HKLM\Software\Wow6432Node\JavaSoft\Java Development Kit"
"HKLM\Software\JavaSoft\JRE"
"HKLM\Software\Wow6432Node\JavaSoft\JRE"
"HKLM\Software\JavaSoft\JDK"
and "HKLM\Software\Wow6432Node\JavaSoft\JDK" subkeys and fetches JavaHome value, checks for bin\java.exe file existence in the fetched location, performs jar extraction to confirm Red Hat as the vendor, then reads the compare the version for file java.exe and posts the QID on Windows Operating Systems

Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS).