The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3100 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920)     (CVE-2020-14583)

    * OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593)

    * OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)     (CVE-2020-14556)

    * OpenJDK: Unexpected exception raised by DerInputStream (Libraries, 8237731) (CVE-2020-14578)

    * OpenJDK: Unexpected exception raised by DerValue.equals() (Libraries, 8237736) (CVE-2020-14579)

    * OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature     (JAXP, 8242136) (CVE-2020-14621)

    * OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592)     (CVE-2020-14577)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639

  - Class Libraries :

  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW     JAVA.LANG.INTERNALERROR

  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA     HEAP

  - TRANSLATION MESSAGES UPDATE FOR JCL

  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A

  - Java Virtual Machine :

  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT

  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT

  - JIT Compiler :

  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED     SYNCHRONIZED METHOD IN DEBUGGING MODE

  - INTERMITTENT ASSERTION FAILURE REPORTED

  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD

  - JIT CRASH DURING CLASS UNLOADING IN     J9METHOD_HT::ONCLASSUNLOADING()

  - SEGMENTATION FAULT WHILE COMPILING A METHOD

  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL     PARALLEL APPLICATION ON IBM Z PLATFORM

  - Security :

  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY     SET TO NON DEFAULT VALUE

  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS

  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED,     WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE

  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS     EXCEPTION FROM KEYFACTORY CLASS

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_7_1-ibm fixes the following issues :

Update to Java 7.1 Service Refresh 4 Fix Pack 70 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639

  - Class Libraries :

  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A

  - Security :

  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY     SET TO NON DEFAULT VALUE

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openjdk8 package has been released.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
138847	RHEL 8 : java-1.8.0-openjdk (RHSA-2020:3100)	Nessus	Red Hat Local Security Checks	2020/7/22	2024/11/7	high
140257	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2020:2461-1)	Nessus	SuSE Local Security Checks	2020/9/4	2024/11/29	medium
140263	SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2020:2482-1)	Nessus	SuSE Local Security Checks	2020/9/4	2024/11/29	medium
203588	Photon OS 4.0: Openjdk8 PHSA-2023-4.0-0413	Nessus	PhotonOS Local Security Checks	2024/7/23	2026/11/2	critical

検出

プラグインの検索

high

medium

medium

critical