Ubuntu fixes OpenJDK 17 flaws that can expose or alter data
Original title: USN-9014-1: OpenJDK 17 vulnerabilities
Named issues include authentication and JSSE flaws plus a JAAS bug that could expose sensitive data.
Ubuntu security notice USN-9014-1 describes OpenJDK 17 flaws in Security, JSSE and JAAS. A remote attacker could possibly modify sensitive data because Security did not correctly authenticate users (CVE-2026-83374) and JSSE did not correctly authorize users (CVE-2026-83376). A JAAS authorization flaw could let a remote attacker read sensitive data (CVE-2026-83380). Another Security authorization issue is mentioned, but the snippet ends before its details.
Unconfirmed: The snippet is incomplete and does not state fixed versions or whether the flaws are exploited.
- CVE-2026-83374 affects OpenJDK 17 Security authentication.
- CVE-2026-83376 is a JSSE authorization issue that could modify data.
- CVE-2026-83380 in JAAS could let a remote attacker read sensitive data.
- A further Security authorization flaw is cut off in the feed.
Impact: Remote read or modification of sensitive data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK 17 | — |
- 1.Apply the Ubuntu update in USN-9014-1 for OpenJDK 17.
- Vendors
- Ubuntu
- Products
- OpenJDK 17
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83374+1 related CVE | Unauthenticated integrity flaw in Oracle Java SE Security | 5.9 group max | — | ||
| CVE-2026-83380 | Information disclosure in Oracle Java SE JAAS (unauthenticated network) | 5.3 | — |
From the original article
It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.