{"id":"USN-7255-1","summary":"openjdk-23 vulnerability","details":"It was discovered that the Hotspot component of OpenJDK 23 did not properly\nhandle API access under certain circumstances. An unauthenticated attacker\ncould possibly use this issue to access unauthorized resources and expose\nsensitive information.\n","modified":"2026-02-04T03:23:19.281289Z","published":"2025-02-05T04:28:09.237031Z","related":["CVE-2025-21502","UBUNTU-CVE-2025-21502"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-7255-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-21502"}],"affected":[{"package":{"name":"openjdk-23","ecosystem":"Ubuntu:24.10","purl":"pkg:deb/ubuntu/openjdk-23@23.0.2+7-1ubuntu1~24.10?arch=source&distro=oracular"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.2+7-1ubuntu1~24.10"}]}],"versions":["23~20ea-1","23~28ea-1ubuntu1","23~33ea-1","23~34ea-1","23~36ea-1","23~37ea-1","23+37-1","23.0.1+11-1ubuntu1~24.10.1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"openjdk-23-dbg","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-demo","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-doc","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-jdk","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-jdk-headless","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-jre","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-jre-headless","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-jre-zero","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-source","binary_version":"23.0.2+7-1ubuntu1~24.10"},{"binary_name":"openjdk-23-testsupport","binary_version":"23.0.2+7-1ubuntu1~24.10"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-7255-1.json"}}],"schema_version":"1.7.3"}