OpenJDK-21.0.13.0.2

[zeckma]

This is a security update.

CVE-2026-91403 (Critical/9.1): Unauthenticated access over network.

This needs to be updated quickly.

[pierre]

See ​https://openjdk.org/groups/vulnerability/advisories/2026-10-20 and ​https://openjdk.org/groups/vulnerability/advisories/2026-10-21 for the risk matrix. The critical RCE is (taken from the link above):

CVE-2026-91403 concerns ​eight compromised intermediate CA certificates.

If you use a standalone OpenJDK Java runtime, we recommend that you update it as soon as possible, since it likely contains the compromised certificates. If that is not possible, take immediate action by implementing one of these steps:

Manually block the impacted certificates. First, download the blocked.certs file for your operating system. There is a version for Windows and a version for other operating systems. Find your local $JDK_HOME/lib/security/blocked.certs file. If you have already added entries to this file, create a backup and re-add your entries to the new file. Otherwise, move or replace the blocked.certs file with the downloaded version. For JDK 8, rename blocked.certs to blacklisted.certs; the file location is the same.

Enable certificate revocation checking for your application, if not already enabled. For TLS applications, add -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true to your command line. With JDK 17 and later, for signed JARs, use jarsigner -verify -revcheck -strict $SIGNED_JAR to verify the signed JAR and check revocation.

If you have more than one standalone OpenJDK Java runtime installed, repeat the selected step for all installations.

If you use an OpenJDK Java runtime provided by your operating system, then it most likely uses the operating system’s certificates. This is true of the OpenJDK packages in Arch Linux, Debian, Devuan, Fedora, Gentoo, Oracle Linux, Red Hat Enterprise Linux, and Ubuntu; in these cases, updating the operating system’s certificates is sufficient. This is not true of the OpenJDK packages in FreeBSD and Homebrew, which must be updated directly.

End of citation

Since we use our own certificates, I guess we just need to run make-ca, and the CVE does not directly apply to us. We still need to update for the other CVE's

[pierre]

Note that jdk-21.0.13.0.2 gets an improved detection of revoked certificates, and the revoked emudhra certificates are shipped in the list of revoked certificates within the source. In this case, this is not needed for blfs since we use system certificates, but may be useful in the future if some certificates are revoked and mozilla certs are not updated yet, or if user certificates are revoked.

[pierre]

The book has been updated to OpenJDK-25.0.5.0.3, and the SA will reference that version.