Security Fix(es) :

  - OpenJDK: Side-channel attack risks in Elliptic Curve     (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in     deserialization (Utilities, 8212328) (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during     deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Missing URL format validation (Networking,     8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers     (JCE, 8223511) (CVE-2019-2842)

  - OpenJDK: Insufficient restriction of privileges in     AccessController (Security, 8216381) (CVE-2019-2786)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1816 advisory.

    [1:1.8.0.222.b10-0]
    - Update to aarch64-shenandoah-jdk8u222-b10.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b09-0]
    - Update to aarch64-shenandoah-jdk8u222-b09.
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b08-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b08.
    - Adjust PR3083/RH134640 to apply after JDK-8182999
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b07-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b06-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b06.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b05-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b05.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b04-0.0.ea]
    - Update new format sources file.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b04-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b04.
    - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b03-0.1.ea]
    - Update to aarch64-shenandoah-jdk8u222-b03.
    - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
    - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b02-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b02.
    - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-1]
    - Switch to EA mode
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-1]
    - Allow Recommends and Suggests on Fedora platforms too.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-0]
    - Make use of Recommends and Suggests dependent on RHEL 8+ environment.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-0]
    - Update to aarch64-shenandoah-jdk8u222-b01.
    - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
    - Drop 8171000 & 8197546 as applied upstream.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Fix value of built_doc_archive for javadoc debug package.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Drop unused use_shenandoah_hotspot variable.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Update to aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30.
    - Update version logic to handle -shenandoah* tag suffix.
    - Drop PR3634 as applied upstream.
    - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
    - Update 8214206 to use log2_long rather than casting to intptr_t, which may be smaller than size_t.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-7317: Improve PNG support options (bsc#1141780).

CVE-2019-2818: Better Poly1305 support (bsc#1141788).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2821: Improve TLS negotiation (bsc#1141781).

Certificate validation improvements

Non-security issues fixed: Do not fail installation when the manpages are not present (bsc#1115375)

Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2842: Extended AES support (bsc#1141786).

CVE-2019-7317: Improve PNG support (bsc#1141780).

Certificate validation improvements

Non-security issue fixed: Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14160-1 advisory.

  - AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and     privilege elevation by local users. (CVE-2019-11771)

  - All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a     value that is pulled out of the loop by versioning - for example if there is a condition that is moved out     of the loop that reads a field we may not privatize the value of that field in the modified copy of the     loop allowing the test to see one value of the field and subsequently the loop to see a modified field     value without retesting the condition moved out of the loop. This can lead to a variety of different     issues but read out of array bounds is one major consequence of these problems. (CVE-2019-11775)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1     (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2766)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2019-2816)

  - Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure     absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force     ID: 163984. (CVE-2019-4473)

  - png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function     is called under png_safe_execute. (CVE-2019-7317)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1816 advisory.

  - OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
126974	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190723)	Nessus	Scientific Linux Local Security Checks	2019/7/24	2024/5/8	medium
127034	Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20190724)	Nessus	Scientific Linux Local Security Checks	2019/7/25	2024/5/8	medium
127601	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1816)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/10/22	medium
127745	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:2002-1)	Nessus	SuSE Local Security Checks	2019/8/12	2025/2/24	medium
127762	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:2036-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
150540	SUSE SLES11 Security Update : java-1_7_1-ibm (SUSE-SU-2019:14160-1)	Nessus	SuSE Local Security Checks	2021/6/10	2023/12/26	high
145650	CentOS 8 : java-1.8.0-openjdk (CESA-2019:1816)	Nessus	CentOS Local Security Checks	2021/1/29	2022/5/11	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

high

medium