elsa-2026-55787

{
  "cves": [
    "CVE-2026-60589",
    "CVE-2026-61308",
    "CVE-2026-70907"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[1:21.0.12.1.1-1.2.0.1]\n- Add Oracle vendor bug URL [Orabug: 34340155]\n\n[1:21.0.12.1.1-1.2]\n- Bump release for PQC build\n- Related: RHEL-235625\n\n[1:21.0.12.1.1-1.1]\n- Update to jdk-21.0.12.1+1 (GA)\n- Update release notes to 21.0.12.1+1\n- Sync the copy of the portable specfile with the latest update\n- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **\n- Resolves: RHEL-235625\n\n[1:21.0.12.0.8-2.1]\n- Add CVEs to NEWS file\n- Update to tarball with final changeset ID\n- Sync the copy of the portable specfile with the latest update\n- Related: RHEL-188866\n\n[1:21.0.12.0.8-1.2]\n- Bump release for PQC build\n- Related: RHEL-212332\n- Related: RHEL-212334\n- Related: RHEL-212336\n- Related: RHEL-151193\n- Related: RHEL-212341\n- Related: RHEL-188866\n- Related: RHEL-212345\n- Related: RHEL-212347\n- Related: RHEL-151167\n- Related: RHEL-212348\n- Related: RHEL-212349\n\n[1:21.0.12.0.8-1.1]\n- Update to jdk-21.0.12+8 (GA)\n- Update release notes to 21.0.12+8\n- Bump freetype version to 2.14.3 following JDK-8385390\n- Bump giflib version to 6.1.3 following JDK-8384902\n- Bump HarfBuzz version to 14.2.0 following JDK-8385490\n- Bump lcms2 version to 2.19.1 following JDK-8375065  JDK-8383354\n- Bump libpng version to 1.6.58 following JDK-8384495\n- Update tagging scripts to include signature checks and correctly handle gating\n- Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z  10.3.\n- Add gating scripts to simplify obtaining results and waiving issues\n- Cleanup tagging and gating scripts to appease shellcheck:\n- * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.\n- * scripts/builds/check_signatures.sh: Quote variable usage.\n- * scripts/builds/waive_issue.sh: Remove redundant 'test 'x'' usage.\n- * scripts/builds/waive_leapp_issue.sh: Likewise.\n- * scripts/builds/waive_rpminspect.sh: Likewise.\n- * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.\n- * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test 'x'' usage.\n- Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file\n- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field\n- Obsolete old RHEL releases (9.7.0-z, 10.1-z)\n- Make zone string debug output optional in TestTranslations\n- Change javadoc-zip to just own the top-level directory, not include the entire subtree\n- Sync the copy of the portable specfile with the latest update\n- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **\n- Resolves: RHEL-212332\n- Resolves: RHEL-212334\n- Resolves: RHEL-212336\n- Resolves: RHEL-151193\n- Resolves: RHEL-212341\n- Resolves: RHEL-188866\n- Resolves: RHEL-212345\n- Resolves: RHEL-212347\n- Related: RHEL-212349\n\n[1:21.0.11.0.10-1.3]\n- Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm\n- See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1\n- Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps\n- Make headless own /usr/share/doc/java-1.8.0-openjdk\n- Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk\n- Resolves: RHEL-151167\n- Resolves: RHEL-212348\n- Resolves: RHEL-212349",
  "id": "ELSA-2026-55787",
  "ovalId": "oval:com.oracle.elsa:def:202655787",
  "source": "oracle_linux",
  "title": "ELSA-2026-55787:  java-21-openjdk security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-55787.html"
}