Ubuntu alert USN-7900-1 (openjdk-17-crac)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7900-1] CRaC JDK 17 vulnerabilities
Date:
             
 
Tue, 02 Dec 2025 01:57:29 +0000
Message-ID:
             
 
<E1vQFdx-00052W-6I@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7900-1
December 01, 2025

openjdk-17-crac vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 25.04

Summary:

Several security issues were fixed in CRaC JDK 17.

Software Description:
- openjdk-17-crac: Open Source Java implementation with Coordinated Restore at Checkpoints

Details:

Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)

Darius Bohni discovered that the JAXP component of CRaC JDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)

In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.

Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-...

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  openjdk-17-crac-jdk             17.0.17+10-0ubuntu1~25.10
  openjdk-17-crac-jdk-headless    17.0.17+10-0ubuntu1~25.10
  openjdk-17-crac-jre             17.0.17+10-0ubuntu1~25.10
  openjdk-17-crac-jre-headless    17.0.17+10-0ubuntu1~25.10
  openjdk-17-crac-jre-zero        17.0.17+10-0ubuntu1~25.10

Ubuntu 25.04
  openjdk-17-crac-jdk             17.0.17+10-0ubuntu1~25.04
  openjdk-17-crac-jdk-headless    17.0.17+10-0ubuntu1~25.04
  openjdk-17-crac-jre             17.0.17+10-0ubuntu1~25.04
  openjdk-17-crac-jre-headless    17.0.17+10-0ubuntu1~25.04
  openjdk-17-crac-jre-zero        17.0.17+10-0ubuntu1~25.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart Java
applications to make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7900-1
  CVE-2025-53057, CVE-2025-53066

Package Information:
  https://launchpad.net/ubuntu/+source/openjdk-17-crac/17.0...
  https://launchpad.net/ubuntu/+source/openjdk-17-crac/17.0...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmkuRhoACgkQcpJm3tlz
hgHWmBAAl1mKPw6A9A55fS4uku60gk3Z0Hu9jlwsHZDivLui32WsDaKgho8w4eqO
BQrcKVg/KMWYANUNxEXsvmwv2toklX5keWe5OTDByMeZq0SggvXZpzX3kbdJhoRt
LqjfcsXRFHlewME7TIV2UI3i2lY+wh5i7mVTYb4tWJrQVkB0a8D42s+9n3sFbCYA
2JRJjjVKeHp1utlINNqpb0BxlU/7o1gn7T+nq3HdOmo4uUxG4gbJO7kF98R4uG5m
8RNvJaz6JHDJkLy/GJIWAlVo4Kz6KyiB3+kU9LDytoLOfL6ex1JNLhEQDcYnYru7
RMCInZhEnwrnzLoeidFaovou+kcwqnFZH+0BGWK9NV3W6rcosvjik+tO3OnvLEzo
1BJj0ttS5T3mk1ZnB42lDN7JKhcT0IoaVtFLjpnEbNuSgk4iMBhY4dVjaPEYY5sf
3juluI/U+T//ApwZA+GBL7nEDyeS8tP4E5DJmN9O2uEB0rf8B3O+JFUqtrtbvz+9
ZzAHkFFZg2FpJ4/SV+8K4e/t8oE7RQKQGFhr+YFV7S7mxPsTRZs4ua5fbnjS1VQP
WQ3yJ8/G3QKCIf7Ye/fquwFpfcSMI0JRJTqVrGZdUGysP4QRF4wLbRcUoBVZsYqc
qJ6jOo5PPgiXW5XENzpD7cQ81vJGr4NFm/mhq61qPkd33qnsUYM=
=rltS
-----END PGP SIGNATURE-----