{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenJDK.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 8 (8u442) for portable Linux serves as a replacement for Red Hat build of OpenJDK 8 (8u432) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2025:0419",
        "url": "https://access.redhat.com/errata/RHBA-2025:0419"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/8/html/release_notes_for_red_hat_build_of_openjdk_8.0.442/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/8/html/release_notes_for_red_hat_build_of_openjdk_8.0.442/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_0419.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: OpenJDK 8u442 Bug Fix Update for Portable Linux Builds",
    "tracking": {
      "current_release_date": "2026-11-03T01:57:31+00:00",
      "generator": {
        "date": "2026-11-03T01:57:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHBA-2025:0419",
      "initial_release_date": "2025-01-22T11:21:11+00:00",
      "revision_history": [
        {
          "date": "2025-01-22T11:21:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-01-22T11:21:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-03T01:57:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 8u432",
                "product": {
                  "name": "Red Hat Build of OpenJDK 8u432",
                  "product_id": "Red Hat Build of OpenJDK 8u432",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:1.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-21502",
      "cwe": {
        "id": "CWE-195",
        "name": "Signed to Unsigned Conversion Error"
      },
      "discovery_date": "2025-01-20T11:15:11.094000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2338992"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance array handling (Oracle CPU 2025-01)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "MODERATE impact affects some Red Hat Enterprise Linux products using OpenJDK and IBM Java. An unauthenticated attacker with network access via multiple protocols may exploit APIs supplied through a web service to cause unauthorized update, insertion, or deletion of accessible Java SE data. The underlying issue is a C2 compiler optimization that incorrectly assumes an unsigned comparison is always true, including when m == -1. The current scope is product- and stream-specific: entries for java-11-openjdk and java-1.8.0-ibm are marked AFFECTED, while multiple java-1.8.0-openjdk entries are marked NOTAFFECTED; other entries are NEW or DELEGATED. The upstream and Red Hat CVSS scores are both 4.8 (MODERATE).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 8u432"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-21502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2338992",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338992"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-21502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-21502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-21502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21502"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-01-21T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-01-22T11:21:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u432"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2025:0419"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u432"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 8u432"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance array handling (Oracle CPU 2025-01)"
    }
  ]
}