Critical CVE in distroless/java17 update to openjdk 17.0.3

[georgespalding]

Java 17.0.2 has a severe flaw in signature verification for elliptic curve signatures.
17.0.3 was released to the public on April 19, 2022:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21449

See also https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/

[maximilianro]

Would be great if the other Java images are also updated quickly (e.g. Java 8 and 11)

[loosebazooka]

These images follow debian bullseye. If they release an update, we will pick it up. Distroless Java 8 is longer supported and has not been updated in a long time.

[georgespalding]

@maximilianro As per my amateur tests the java11 image is not vulnerable (but I need java17 because of language features used in the codebase).

[georgespalding]

Tracking of the CVE at Debian: https://security-tracker.debian.org/tracker/CVE-2022-21449

[chulkilee]

I'm wondering whether this image can use temurin 17.0.3 release from https://github.com/adoptium/temurin17-binaries/releases instead of waiting for Debian - if other flavors use that approach (e.g. when debian does not have the corresponding versions)

[loosebazooka]

Yeah sure, if someone proposed a PR for this, we could start from there.
It should cover support for:

1. amd64, arm64
2. java 11, 17
3. automatic update (or at least detection)

after looking into the temurin/adoptium release docs, I think we should only pick up *-ga releases.

[loosebazooka]

I'm wondering whether this image can use temurin 17.0.3 release from https://github.com/adoptium/temurin17-binaries/releases instead of waiting for Debian

Adoptium has not releases an actual -ga version of these images yet: adoptium/adoptium#140

[floriankoch]

@loosebazooka seems like the Termiten GA Release is there

[chulkilee]

What do you mean with *-ga releases? Since https://github.com/adoptium/temurin17-binaries/releases/tag/jdk-17.0.3%2B7 says "Official Release of jdk-17.0.3+7" so I think those binaries are ready to use directly.

Seems like related to #961 ? Let me know if you prefer to discuss using temurin binaries directly instead of openjdk package in a separate issue. Thanks!

BTW I had to do that due to the debian delay...

[loosebazooka]

So, reading through the docs, it looks like the +N builds are just weekly builds, leading up to the final release? But maybe I'm misunderstanding that sutff: https://github.com/adoptium/temurin-build/blob/master/RELEASING.md

[floriankoch]

@loosebazooka i think you are right, the Readme says there is a -ga tag when ist Released

[chulkilee]

@loosebazooka @floriankoch That -ga tag seems for source code tag, not github release or container tag.

Eventually after rampdown and final phase testing the GA build is tagged and released, e.g. the jdk-13-ga code level is tagged along side the actual release build tag.

Also no github binary releases are marked as -ga - but other non-ga versions have suffix (e.g. -beta)

[georgespalding]

I agree with @chulkilee; Comparing the 17.0.2+8 and 17.0.3+8 tags at least I get the impression these are official releases?
https://github.com/adoptium/temurin17-binaries/releases/tag/jdk-17.0.3%2B7

Official Release of jdk-17.0.3+7

https://github.com/adoptium/temurin17-binaries/releases/tag/jdk-17.0.2%2B8

Official Release of jdk-17.0.2+8

Would switching to using temurin binaries be feasible in the scope of this issue?
Also interested to get an indication of what the timeline might be to get that in place?

[floriankoch]

@georgespalding debian has the new openjdk in unstable

[Guillaume-Mayer]

Not sure if it helps, but I have a Dockerfile based on debian:11-slim, I did build it today and when I apt-get install openjdk-17-jdk-headless, it pulled this package:
Get:91 http://security.debian.org/debian-security bullseye-security/main amd64 openjdk-17-jdk-headless amd64 17.0.3+7-1~deb11u1 [234 MB]

[loosebazooka]

okay great this should be picked up soon, lemme trigger an unscheduled updated.
edit: oh jk, we rely on debian-snapshots, so we should be a few hours behind ~6-12 hours.

[floriankoch]

@loosebazooka can you trigger a rebuild?

[floriankoch]

Some news here? The package is in the snapshot repo

Is relying on snapshots a good way to geht fast Security Updates?

[loosebazooka]

the latest release is done with this fix.