Security Fix(es) :

  - OpenJDK: Bypass of boundary checks in nio.Buffer via     concurrent access (Libraries, 8238920) (CVE-2020-14583)

  - OpenJDK: Incomplete bounds checks in Affine     Transformations (2D, 8240119) (CVE-2020-14593)

  - OpenJDK: Incorrect handling of access control context in     ForkJoinPool (Libraries, 8237117) (CVE-2020-14556)

  - OpenJDK: Unexpected exception raised by DerInputStream     (Libraries, 8237731) (CVE-2020-14578)

  - OpenJDK: Unexpected exception raised by     DerValue.equals() (Libraries, 8237736) (CVE-2020-14579)

  - OpenJDK: XML validation manipulation due to incomplete     application of the use-grammar-pool-only feature (JAXP,     8242136) (CVE-2020-14621)

  - OpenJDK: HostnameChecker does not ensure X.509     certificate names are in normalized form (JSSE, 8237592)     (CVE-2020-14577)

# July 2020 OpenJDK security update for OpenJDK 8.

Full release notes: https://bitly.com/oj8u262

## New features

  -     [JDK-8223147](https://bugs.openjdk.java.net/browse/JDK-8     223147): JFR Backport

## Security fixes

  - JDK-8028431, CVE-2020-14579: NullPointerException in     DerValue.equals(DerValue)

  - JDK-8028591, CVE-2020-14578: NegativeArraySizeException     in     sun.security.util.DerInputStream.getUnalignedBitString()

  - JDK-8230613: Better ASCII conversions

  - JDK-8231800: Better listing of arrays

  - JDK-8232014: Expand DTD support

  - JDK-8233255: Better Swing Buttons

  - JDK-8234032: Improve basic calendar services

  - JDK-8234042: Better factory production of certificates

  - JDK-8234418: Better parsing with CertificateFactory

  - JDK-8234836: Improve serialization handling

  - JDK-8236191: Enhance OID processing

  - JDK-8237117, CVE-2020-14556: Better ForkJoinPool     behavior

  - JDK-8237592, CVE-2020-14577: Enhance certificate     verification

  - JDK-8238002, CVE-2020-14581: Better matrix operations

  - JDK-8238804: Enhance key handling process

  - JDK-8238842: AIOOBE in     GIFImageReader.initializeStringTable

  - JDK-8238843: Enhanced font handing

  - JDK-8238920, CVE-2020-14583: Better Buffer support

  - JDK-8238925: Enhance WAV file playback

  - JDK-8240119, CVE-2020-14593: Less Affine Transformations

  - JDK-8240482: Improved WAV file playback

  - JDK-8241379: Update JCEKS support

  - JDK-8241522: Manifest improved jar headers redux

  - JDK-8242136, CVE-2020-14621: Better XML namespace     handling

## [JDK-8240687](https://bugs.openjdk.java.net/browse/JDK-8240687):
JDK Flight Recorder Integrated to OpenJDK 8u

OpenJDK 8u now contains the backport of JEP 328: Flight Recorder (https://openjdk.java.net/jeps/328) from later versions of OpenJDK.

JFR is a low-overhead framework to collect and provide data helpful to troubleshoot the performance of the OpenJDK runtime and of Java applications. It consists of a new API to define custom events under the jdk.jfr namespace and a JMX interface to interact with the framework. The recording can also be initiated with the application startup using the -XX:+FlightRecorder flag or via jcmd. JFR replaces the +XX:EnableTracing feature introduced in JEP 167, providing a more efficient way to retrieve the same information. For compatibility reasons, +XX:EnableTracing is still accepted, however no data will be printed.

While JFR is not built by default upstream, it is included in Fedora binaries for supported architectures (x86_64, AArch64 & PowerPC 64)

## [JDK-8205622](https://bugs.openjdk.java.net/browse/JDK-8205622):
JFR Start Failure After AppCDS Archive Created with JFR StartFlightRecording

JFR will be disabled with a warning message if it is enabled during CDS dumping. The user will see the following warning message :

OpenJDK 64-Bit Server VM warning: JFR will be disabled during CDS dumping

if JFR is enabled during CDS dumping such as in the following command line :

$ java -Xshare:dump -XX:StartFlightRecording=dumponexit=true

## [JDK-8244167](https://bugs.openjdk.java.net/browse/JDK-8244167):
Removal of Comodo Root CA Certificate

The following expired Comodo root CA certificate was removed from the `cacerts` keystore: + alias name 'addtrustclass1ca [jdk]'

Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE

## [JDK-8244166](https://bugs.openjdk.java.net/browse/JDK-8244166):
Removal of DocuSign Root CA Certificate

The following expired DocuSign root CA certificate was removed from the `cacerts` keystore: + alias name 'keynectisrootca [jdk]'

Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR

## [JDK-8240191](https://bugs.openjdk.java.net/browse/JDK-8240191):
Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database

The SunPKCS11 security provider can now be initialized with NSS when FIPS-enabled external modules are configured in the Security Modules Database (NSSDB). Prior to this change, the SunPKCS11 provider would throw a RuntimeException with the message: 'FIPS flag set for non-internal module' when such a library was configured for NSS in non-FIPS mode.

This change allows the JDK to work properly with recent NSS releases on GNU/Linux operating systems when the system-wide FIPS policy is turned on.

Further information can be found in [JDK-8238555](https://bugs.openjdk.java.net/browse/JDK-8238555).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2968 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920)     (CVE-2020-14583)

    * OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593)

    * OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)     (CVE-2020-14556)

    * OpenJDK: Unexpected exception raised by DerInputStream (Libraries, 8237731) (CVE-2020-14578)

    * OpenJDK: Unexpected exception raised by DerValue.equals() (Libraries, 8237736) (CVE-2020-14579)

    * OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature     (JAXP, 8242136) (CVE-2020-14621)

    * OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592)     (CVE-2020-14577)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2972 advisory.

  - OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117)     (CVE-2020-14556)

  - OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592)     (CVE-2020-14577)

  - OpenJDK: Unexpected exception raised by DerInputStream (Libraries, 8237731) (CVE-2020-14578)

  - OpenJDK: Unexpected exception raised by DerValue.equals() (Libraries, 8237736) (CVE-2020-14579)

  - OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920)     (CVE-2020-14583)

  - OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593)

  - OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature     (JAXP, 8242136) (CVE-2020-14621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3388 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP70.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920)     (CVE-2020-14583)

    * OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593)

    * IBM JDK: Information disclosure via calls to System.arraycopy() with invalid length (CVE-2019-17639)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Unexpected exception raised by DerInputStream (Libraries, 8237731) (CVE-2020-14578)

    * OpenJDK: Unexpected exception raised by DerValue.equals() (Libraries, 8237736) (CVE-2020-14579)

    * OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature     (JAXP, 8242136) (CVE-2020-14621)

    * OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592)     (CVE-2020-14577)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk8 package has been released.

ID	Name	Product	Family	Published	Updated	Severity
143318	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-2048)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	high
138585	Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20200716)	Nessus	Scientific Linux Local Security Checks	7/17/2020	3/1/2024	high
138827	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20200716)	Nessus	Scientific Linux Local Security Checks	7/22/2020	2/29/2024	high
138868	Fedora 32 : 1:java-1.8.0-openjdk (2020-e418151dc3)	Nessus	Fedora Local Security Checks	7/23/2020	2/29/2024	high
139455	RHEL 7 : java-1.8.0-openjdk (RHSA-2020:2968)	Nessus	Red Hat Local Security Checks	8/10/2020	11/7/2024	high
145916	CentOS 8 : java-1.8.0-openjdk (CESA-2020:2972)	Nessus	CentOS Local Security Checks	2/1/2021	5/10/2022	high
139465	RHEL 7 : java-1.7.1-ibm (RHSA-2020:3388)	Nessus	Red Hat Local Security Checks	8/10/2020	12/2/2024	medium
203588	Photon OS 4.0: Openjdk8 PHSA-2023-4.0-0413	Nessus	PhotonOS Local Security Checks	7/23/2024	7/24/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

medium

critical