Alerts This Week
Warning Icon 1 677
Alerts This Week
Warning Icon 1 677

RedHat 7: RHSA-2018-2568 Important: Java Update Severe DoS Risk

Calendar Aug 27, 2018 • User Avatar LinuxSecurity Advisories
4 - 8 min read
Redhat Large Esm H500
Topics%20covered

Topics Covered

security advisory privilege escalation DoS Red Hat Enterprise Linux openssl path traversal IBM Java
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: java-1.8.0-ibm security update
Advisory ID:       RHSA-2018:2568-01
Product:           Red Hat Enterprise Linux Supplementary
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2568
Issue date:        2018-08-27
CVE Names:         CVE-2016-0705 CVE-2017-3732 CVE-2017-3736 
                   CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 
                   CVE-2018-2952 CVE-2018-2973 CVE-2018-12539 
====================================================================
1. Summary:

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64

3. Description:

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.

This update upgrades IBM Java SE 8 to version 8 SR5-FP20.

Security Fix(es):

* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)

* openssl: BN_mod_exp may produce incorrect results on x86_64
(CVE-2017-3732)

* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

* IBM JDK: DoS in the java.math component (CVE-2018-1517)

* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)

* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)

* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)

* OpenSSL: Double-free in DSA code (CVE-2016-0705)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the
original reporter of CVE-2016-0705.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take
effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code
1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64
1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)
1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)
1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API
1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component

6. Package List:

Red Hat Enterprise Linux Client Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Supplementary (v. 7):

ppc64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64.rpm

ppc64le:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm

s390x:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.s390x.rpm

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation Supplementary (v. 7):

x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key

7. References:

https://access.redhat.com/security/cve/CVE-2016-0705
https://access.redhat.com/security/cve/CVE-2017-3732
https://access.redhat.com/security/cve/CVE-2017-3736
https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW4QI1dzjgjWX9erEAQgiBRAApZ4yMTz6VaYwLOqGPcoQdZzEkg64CARM
k1LrzpzgD6tRbaKya/LqvJvIhQlJ4LWs0AAlOM0VNrwdx8ntZ4lGHURqSM1Y14L/
TScLgA22CTbL4u+8BEOrsNCcjnp+5YALbfPv1DCdYvbRwi1J503w4ccwBfttb+1/
EaYh7nrWooa6R6qlkopmk1zprZGCgv3azYOqphcnrooeCC3ZqcBEWZNo/H1TnxWv
kXfgxmZS3Rq5399umMOuWh2HDme2tO1OWTdY1+REfZh0Ex5v1rqYm/s+8d2FrEWm
Oqk5Azstjt/l5OZfVg/WJd/iy1ob2m5yRUp5mhLFfkctIN/stxqbqLzO17dimdEn
mhBwG/IkaGkMqQgEEZ65SXNyS+kW7hS8P4F0BuzmHIfaO3ALpCWOczyyiKHPHMng
ZPYeV+roqRVeZ7TY8dfcUOh3eOKivfQBL921x4YdciCgPxBR7eRx8/aw8QL7VFot
CRFMkS36Q2YqgfP9XH06AZdUEVJp/dpB1/f+EtR8e6YDdHSSgJvoV9pP0S2DhWnA
o5V5efe12Jv3MQgiy5n0Ws4/mhcxthZSTcdBKQfyTsfqngCr1TTnGotN9GI1B0qe
XX7pry5RkLnq/l/0T4d6JJceMnK5n/DebajHM+4B1rWQZS+4KUPDN5rYuo4OkI6L
KZ2NcbK0Lfw=5oM3
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
This email address is being protected from spambots. You need JavaScript enabled to view it.

RedHat 7: RHSA-2018-2568 Important: Java Update Severe DoS Risk

red hat
Calendar Grey August 27, 2018
Dist Redhat Esm H88
Critical patch released for IBM Java 1.8.0 on RHEL 7, addressing multiple vulnerabilities.
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Summary

IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP20.
Security Fix(es):
* IBM JDK: privilege escalation via insufficiently restricted access to Attach API (CVE-2018-12539)
* openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
* IBM JDK: DoS in the java.math component (CVE-2018-1517)
* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework (CVE-2018-1656)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) (CVE-2018-2940)
* OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) (CVE-2018-2973)
* OpenSSL: Double-free in DSA code (CVE-2016-0705)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank the OpenSSL project for reporting CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the original reporter of CVE-2016-0705.

Topics%20covered

Topics Covered

security advisory privilege escalation DoS Red Hat Enterprise Linux openssl path traversal IBM Java

References

https://access.redhat.com/security/cve/CVE-2016-0705 https://access.redhat.com/security/cve/CVE-2017-3732 https://access.redhat.com/security/cve/CVE-2017-3736 https://access.redhat.com/security/cve/CVE-2018-1517 https://access.redhat.com/security/cve/CVE-2018-1656 https://access.redhat.com/security/cve/CVE-2018-2940 https://access.redhat.com/security/cve/CVE-2018-2952 https://access.redhat.com/security/cve/CVE-2018-2973 https://access.redhat.com/security/cve/CVE-2018-12539 https://access.redhat.com/security/updates/classification#important

Package List

Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
ppc64le: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm


Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:2568-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2568
Issue date: 2018-08-27

Topic

An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux7 Supplementary.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory privilege escalation DoS Red Hat Enterprise Linux openssl path traversal IBM Java

Relevant Releases Architectures

Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64

Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64

Bugs Fixed

1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code

1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64

1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64

1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)

1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE)

1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries)

1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API

1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework

1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here