Amazon Linux 2 : java-1.7.0-openjdk (ALAS-2018-1064)

Medium Nessus Plugin ID 112089

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit.
Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2018-2952)

Solution

Run 'yum update java-1.7.0-openjdk' to update your system.

See Also

https://alas.aws.amazon.com/AL2/ALAS-2018-1064.html

Plugin Details

Severity: Medium

ID: 112089

File Name: al2_ALAS-2018-1064.nasl

Version: 1.2

Type: local

Agent: unix

Published: 2018/08/24

Updated: 2018/08/31

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS v3.0

Base Score: 3.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:java-1.7.0-openjdk, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-accessibility, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-debuginfo, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-demo, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-devel, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-headless, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-javadoc, p-cpe:/a:amazon:linux:java-1.7.0-openjdk-src, cpe:/o:amazon:linux:2

Patch Publication Date: 2018/08/21

Reference Information

CVE: CVE-2018-2952

ALAS: 2018-1064