> 2-3 years is pretty old.
In the JS or NodeJS world, sure. For pretty much everyone else, not so much.
In the JS or NodeJS world, sure. For pretty much everyone else, not so much.
If you are an enterprise company that runs 3 year old java version then
1) Your CSO and CIO should all be fired
2) Your security team should be replaced
3) Your ISO 27001 and SOC2 certification among others should be revoked
Java 11 was released on 2018-09-25
Java 11.0.2 that contained the "fix" was released on 2019-01-15
Java 11.0.13 (latest) was released on 2021-10-19
Also Java 8u192 was released on 2018-10-16
Java 11 as a major is not old, it’s probably the best GA version right now, 17 is at a very early adoption stage.
Openjdk 11.0.0 would be too old, though.
As other comments mentioned even with a patched JDK you are still vulnerable in other ways, but the specific method this whole thread is about seems to have patches in Java 8 and 11 releases.
I understand that lagging new major releases by years and be prudent for different apps, but there is no excuse not to be updating your patch versions.