OpenJDK 11 auth flaws may expose or alter data (USN-9010-1)
Original title: USN-9010-1: OpenJDK 11 vulnerabilities
Ubuntu's notice says remote attackers could modify or read sensitive data via Security, JSSE, and JAAS issues.
Ubuntu published USN-9010-1 for several OpenJDK 11 flaws. The Security component may fail to authenticate users (CVE-2026-83374), and JSSE may fail to authorize them (CVE-2026-83376, CVE-2026-91461), possibly letting a remote attacker modify sensitive data. JAAS may fail to authorize users, possibly allowing sensitive data to be read (CVE-2026-83380). The feed text is cut off and does not name fixed versions.
Unconfirmed: The notice snippet is truncated and does not state fixed versions or exploitation status.
- CVE-2026-83374 is an OpenJDK 11 Security authentication flaw.
- CVE-2026-83376 and CVE-2026-91461 affect the JSSE component.
- CVE-2026-83380 is a JAAS authorization issue that may expose data.
- The snippet ends before another Security authorization flaw is described.
Impact: Possible remote modification or reading of sensitive data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK | 11 |
- 1.Apply the OpenJDK 11 updates referenced by USN-9010-1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83374+1 related CVE | Unauthenticated integrity flaw in Oracle Java SE Security | 5.9 group max | — | ||
CVE-2026-83380+1 related CVE | Information disclosure in Oracle Java SE JAAS (unauthenticated network) | 5.3 group max | — |
From the original article
It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.