What Are You Looking For?

Sign Up

   SUSE Security Update: Security update for java-11-openjdk
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:1511-1
Rating:             important
References:         #1167462 #1169511 
Cross-References:   CVE-2020-2754 CVE-2020-2755 CVE-2020-2756
                    CVE-2020-2757 CVE-2020-2767 CVE-2020-2773
                    CVE-2020-2778 CVE-2020-2781 CVE-2020-2800
                    CVE-2020-2803 CVE-2020-2805 CVE-2020-2816
                    CVE-2020-2830
Affected Products:
                    SUSE Linux Enterprise Server for SAP 15
                    SUSE Linux Enterprise Server 15-LTSS
                    SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2
                    SUSE Linux Enterprise Module for Basesystem 15-SP2
                    SUSE Linux Enterprise Module for Basesystem 15-SP1
                    SUSE Linux Enterprise High Performance Computing 15-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-ESPOS
______________________________________________________________________________

   An update that fixes 13 vulnerabilities is now available.

Description:

   This update for java-11-openjdk fixes the following issues:

   Java was updated to jdk-11.0.7+10 (April 2020 CPU, bsc#1169511).

   Security issues fixed:

   - CVE-2020-2754: Fixed an incorrect handling of regular expressions that
     could have resulted in denial of service (bsc#1169511).
   - CVE-2020-2755: Fixed an incorrect handling of regular expressions that
     could have resulted in denial of service (bsc#1169511).
   - CVE-2020-2756: Fixed an incorrect handling of regular expressions that
     could have resulted in denial of service (bsc#1169511).
   - CVE-2020-2757: Fixed an object deserialization issue that could have
     resulted in denial of service via crafted serialized input (bsc#1169511).
   - CVE-2020-2767: Fixed an incorrect handling of certificate messages
     during TLS handshakes (bsc#1169511).
   - CVE-2020-2773: Fixed the incorrect handling of exceptions thrown by
     unmarshalKeyInfo() and unmarshalXMLSignature() (bsc#1169511).
   - CVE-2020-2778: Fixed the incorrect handling of SSLParameters in
     setAlgorithmConstraints(), which could have been abused to override the
     defined systems security policy and lead to the use of weak crypto
     algorithms (bsc#1169511).
   - CVE-2020-2781: Fixed the incorrect re-use of single null TLS sessions
     (bsc#1169511).
   - CVE-2020-2800: Fixed an HTTP header injection issue caused by
     mishandling of CR/LF in header values (bsc#1169511).
   - CVE-2020-2803: Fixed a boundary check and type check issue that could
     have led to a sandbox bypass (bsc#1169511).
   - CVE-2020-2805: Fixed a boundary check and type check issue that could
     have led to a sandbox bypass (bsc#1169511).
   - CVE-2020-2816: Fixed an incorrect handling of application data packets
     during TLS handshakes  (bsc#1169511).
   - CVE-2020-2830: Fixed an incorrect handling of regular expressions that
     could have resulted in denial of service (bsc#1169511).


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server for SAP 15:

      zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1511=1

   - SUSE Linux Enterprise Server 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-SLES-15-2020-1511=1

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2020-1511=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP2:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-1511=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP1:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-1511=1

   - SUSE Linux Enterprise High Performance Computing 15-LTSS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1511=1

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS:

      zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1511=1



Package List:

   - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4

   - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (noarch):

      java-11-openjdk-javadoc-11.0.7.0-3.42.4

   - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4

   - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4

   - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4

   - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64):

      java-11-openjdk-11.0.7.0-3.42.4
      java-11-openjdk-debuginfo-11.0.7.0-3.42.4
      java-11-openjdk-debugsource-11.0.7.0-3.42.4
      java-11-openjdk-demo-11.0.7.0-3.42.4
      java-11-openjdk-devel-11.0.7.0-3.42.4
      java-11-openjdk-headless-11.0.7.0-3.42.4


References:

   https://www.suse.com/security/cve/CVE-2020-2754.html
   https://www.suse.com/security/cve/CVE-2020-2755.html
   https://www.suse.com/security/cve/CVE-2020-2756.html
   https://www.suse.com/security/cve/CVE-2020-2757.html
   https://www.suse.com/security/cve/CVE-2020-2767.html
   https://www.suse.com/security/cve/CVE-2020-2773.html
   https://www.suse.com/security/cve/CVE-2020-2778.html
   https://www.suse.com/security/cve/CVE-2020-2781.html
   https://www.suse.com/security/cve/CVE-2020-2800.html
   https://www.suse.com/security/cve/CVE-2020-2803.html
   https://www.suse.com/security/cve/CVE-2020-2805.html
   https://www.suse.com/security/cve/CVE-2020-2816.html
   https://www.suse.com/security/cve/CVE-2020-2830.html
   https://bugzilla.suse.com/1167462
   https://bugzilla.suse.com/1169511

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
https://lists.suse.com/mailman/listinfo/sle-security-updates

SUSE: 2020:1511-1 important: java-11-openjdk

May 29, 2020
An update that fixes 13 vulnerabilities is now available

Summary

This update for java-11-openjdk fixes the following issues: Java was updated to jdk-11.0.7+10 (April 2020 CPU, bsc#1169511). Security issues fixed: - CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2755: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2756: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). - CVE-2020-2757: Fixed an object deserialization issue that could have resulted in denial of service via crafted serialized input (bsc#1169511). - CVE-2020-2767: Fixed an incorrect handling of certificate messages during TLS handshakes (bsc#1169511). - CVE-2020-2773: Fixed the incorrect handling of exceptions thrown by unmarshalKeyInfo() and unmarshalXMLSignature() (bsc#1169511). - CVE-2020-2778: Fixed the incorrect handling of SSLParameters in setAlgorithmConstraints(), which could have been abused to override the defined systems security policy and lead to the use of weak crypto algorithms (bsc#1169511). - CVE-2020-2781: Fixed the incorrect re-use of single null TLS sessions (bsc#1169511). - CVE-2020-2800: Fixed an HTTP header injection issue caused by mishandling of CR/LF in header values (bsc#1169511). - CVE-2020-2803: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511). - CVE-2020-2805: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511). - CVE-2020-2816: Fixed an incorrect handling of application data packets during TLS handshakes (bsc#1169511). - CVE-2020-2830: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 15: zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1511=1 - SUSE Linux Enterprise Server 15-LTSS: zypper in -t patch SUSE-SLE-Product-SLES-15-2020-1511=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP2-2020-1511=1 - SUSE Linux Enterprise Module for Basesystem 15-SP2: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP2-2020-1511=1 - SUSE Linux Enterprise Module for Basesystem 15-SP1: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-1511=1 - SUSE Linux Enterprise High Performance Computing 15-LTSS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1511=1 - SUSE Linux Enterprise High Performance Computing 15-ESPOS: zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1511=1 Package List: - SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4 - SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2 (noarch): java-11-openjdk-javadoc-11.0.7.0-3.42.4 - SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4 - SUSE Linux Enterprise High Performance Computing 15-LTSS (aarch64 x86_64): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4 - SUSE Linux Enterprise High Performance Computing 15-ESPOS (aarch64 x86_64): java-11-openjdk-11.0.7.0-3.42.4 java-11-openjdk-debuginfo-11.0.7.0-3.42.4 java-11-openjdk-debugsource-11.0.7.0-3.42.4 java-11-openjdk-demo-11.0.7.0-3.42.4 java-11-openjdk-devel-11.0.7.0-3.42.4 java-11-openjdk-headless-11.0.7.0-3.42.4

References

#1167462 #1169511

Cross- CVE-2020-2754 CVE-2020-2755 CVE-2020-2756

CVE-2020-2757 CVE-2020-2767 CVE-2020-2773

CVE-2020-2778 CVE-2020-2781 CVE-2020-2800

CVE-2020-2803 CVE-2020-2805 CVE-2020-2816

CVE-2020-2830

Affected Products:

SUSE Linux Enterprise Server for SAP 15

SUSE Linux Enterprise Server 15-LTSS

SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP2

SUSE Linux Enterprise Module for Basesystem 15-SP2

SUSE Linux Enterprise Module for Basesystem 15-SP1

SUSE Linux Enterprise High Performance Computing 15-LTSS

SUSE Linux Enterprise High Performance Computing 15-ESPOS

https://www.suse.com/security/cve/CVE-2020-2754.html

https://www.suse.com/security/cve/CVE-2020-2755.html

https://www.suse.com/security/cve/CVE-2020-2756.html

https://www.suse.com/security/cve/CVE-2020-2757.html

https://www.suse.com/security/cve/CVE-2020-2767.html

https://www.suse.com/security/cve/CVE-2020-2773.html

https://www.suse.com/security/cve/CVE-2020-2778.html

https://www.suse.com/security/cve/CVE-2020-2781.html

https://www.suse.com/security/cve/CVE-2020-2800.html

https://www.suse.com/security/cve/CVE-2020-2803.html

https://www.suse.com/security/cve/CVE-2020-2805.html

https://www.suse.com/security/cve/CVE-2020-2816.html

https://www.suse.com/security/cve/CVE-2020-2830.html

https://bugzilla.suse.com/1167462

https://bugzilla.suse.com/1169511

Severity
Announcement ID: SUSE-SU-2020:1511-1
Rating: important

Related News

Kubernetes Security on AWS: A Practical Guide

Nov 18, 2023

Nitrux 3.2.0 Linux Distro Released with Enhanced Security and New Features

Nov 28, 2023

Kinsing Hackers Exploit Apache ActiveMQ Vulnerability to Deploy Linux Rootkits

Nov 25, 2023

Severe Firefox, Thunderbird Bugs Could Lead to System Takeover

Dec 2, 2023

News

Advisories

HOWTOs

Features

Critical Linux Kernel Bugs Lead to DoS, Privilege Escalation - Patch Now!
Unlocking the Future of Authentication: Passkeys vs. Passwords
Empowering MSPs with Straightforward Linux Device Management
A Complete Guide to Torrenting Safely in 2024
Cloud Security Basics for Small Businesses

About Us

Powered By

Footer Logo