An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1817 advisory.

    [1:11.0.4.11-0]
    - Update to shenandoah-jdk-11.0.4+11 (GA)
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:11.0.4.10-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+10 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.9-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+9 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.8-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+8 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.7-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+7 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.1.ea]
    - Debug packages should be called 'slowdebug' on RHEL 8
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+6 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.5-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+5 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.4-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+4 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.3-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+3 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+2 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Package jspawnhelper (see JDK-8220360).
    - Resolves: rhbz#1724452

    [1:11.0.3.7-4]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-4]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-3]
    - Don't build the test images needlessly.
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2842: Extended AES support (bsc#1141786).

CVE-2019-7317: Improve PNG support (bsc#1141780).

Certificate validation improvements

Non-security issue fixed: Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openjdk package has been released.

An update of the openjdk8 package has been released.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
126993	CentOS 6 : java-1.7.0-openjdk (CESA-2019:1840)	Nessus	CentOS Local Security Checks	7/25/2019	5/19/2022	medium
127602	Oracle Linux 8 : java-11-openjdk (ELSA-2019-1817)	Nessus	Oracle Linux Local Security Checks	8/12/2019	2/24/2025	medium
127757	SUSE SLED15 / SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:2021-1)	Nessus	SuSE Local Security Checks	8/12/2019	5/6/2024	medium
128710	Photon OS 1.0: Openjdk PHSA-2019-1.0-0250	Nessus	PhotonOS Local Security Checks	9/12/2019	2/24/2025	medium
128736	Photon OS 2.0: Openjdk8 PHSA-2019-2.0-0173	Nessus	PhotonOS Local Security Checks	9/12/2019	2/24/2025	medium
134409	NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	3/11/2020	1/14/2021	high
144227	Virtuozzo 7 : java-1.7.0-openjdk / etc (VZLSA-2019-1839)	Nessus	Virtuozzo Local Security Checks	12/15/2020	5/11/2022	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

high

medium