Linux Security
    Linux Security
    Linux Security

    Ubuntu 4257-1: OpenJDK vulnerabilities

    Date
    342
    Posted By
    Several security issues were fixed in OpenJDK.
    ==========================================================================
    Ubuntu Security Notice USN-4257-1
    January 28, 2020
    
    openjdk-8, openjdk-lts vulnerabilities
    ==========================================================================
    
    A security issue affects these releases of Ubuntu and its derivatives:
    
    - Ubuntu 19.10
    - Ubuntu 18.04 LTS
    - Ubuntu 16.04 LTS
    
    Summary:
    
    Several security issues were fixed in OpenJDK.
    
    Software Description:
    - openjdk-8: Open Source Java implementation
    - openjdk-lts: Open Source Java implementation
    
    Details:
    
    It was discovered that OpenJDK incorrectly handled exceptions during
    deserialization in BeanContextSupport. An attacker could possibly use this
    issue to cause a denial of service or other unspecified impact.
    (CVE-2020-2583)
    
    It was discovered that OpenJDK incorrectly validated properties of SASL
    messages included in Kerberos GSSAPI. An unauthenticated remote attacker
    with network access via Kerberos could possibly use this issue to insert,
    modify or obtain sensitive information. (CVE-2020-2590)
    
    It was discovered that OpenJDK incorrectly validated URLs. An attacker
    could possibly use this issue to insert, edit or obtain sensitive
    information. (CVE-2020-2593)
    
    It was discovered that OpenJDK Security component still used MD5 algorithm.
    A remote attacker could possibly use this issue to obtain sensitive
    information. (CVE-2020-2601)
    
    It was discovered that OpenJDK incorrectly handled the application of
    serialization filters. An attacker could possibly use this issue to bypass the
    intended filter during serialization. (CVE-2020-2604)
    
    Bo Zhang and Long Kuan discovered that OpenJDK incorrectly handled X.509
    certificates. An attacker could possibly use this issue to cause a denial
    of service. (CVE-2020-2654)
    
    Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and
    Robert Merget discovered that OpenJDK incorrectly handled CertificateVerify
    TLS handshake messages. A remote attacker could possibly use this issue to
    insert, edit or obtain sensitive information. This issue only affected
    OpenJDK 11. (CVE-2020-2655)
    
    It was discovered that OpenJDK incorrectly enforced the limit of datagram
    sockets that can be created by a code running within a Java sandbox. An
    attacker could possibly use this issue to bypass the sandbox restrictions
    causing a denial of service. This issue only affected OpenJDK 8.
    (CVE-2020-2659)
    
    Update instructions:
    
    The problem can be corrected by updating your system to the following
    package versions:
    
    Ubuntu 19.10:
      openjdk-11-jdk                  11.0.6+10-1ubuntu1~19.10.1
      openjdk-11-jre                  11.0.6+10-1ubuntu1~19.10.1
      openjdk-11-jre-headless         11.0.6+10-1ubuntu1~19.10.1
      openjdk-11-jre-zero             11.0.6+10-1ubuntu1~19.10.1
      openjdk-8-jdk                   8u242-b08-0ubuntu3~19.10
      openjdk-8-jre                   8u242-b08-0ubuntu3~19.10
      openjdk-8-jre-headless          8u242-b08-0ubuntu3~19.10
      openjdk-8-jre-zero              8u242-b08-0ubuntu3~19.10
    
    Ubuntu 18.04 LTS:
      openjdk-11-jdk                  11.0.6+10-1ubuntu1~18.04.1
      openjdk-11-jre                  11.0.6+10-1ubuntu1~18.04.1
      openjdk-11-jre-headless         11.0.6+10-1ubuntu1~18.04.1
      openjdk-11-jre-zero             11.0.6+10-1ubuntu1~18.04.1
      openjdk-8-jdk                   8u242-b08-0ubuntu3~18.04
      openjdk-8-jre                   8u242-b08-0ubuntu3~18.04
      openjdk-8-jre-headless          8u242-b08-0ubuntu3~18.04
      openjdk-8-jre-zero              8u242-b08-0ubuntu3~18.04
    
    Ubuntu 16.04 LTS:
      openjdk-8-jdk                   8u242-b08-0ubuntu3~16.04
      openjdk-8-jre                   8u242-b08-0ubuntu3~16.04
      openjdk-8-jre-headless          8u242-b08-0ubuntu3~16.04
      openjdk-8-jre-jamvm             8u242-b08-0ubuntu3~16.04
      openjdk-8-jre-zero              8u242-b08-0ubuntu3~16.04
    
    This update uses a new upstream release, which includes additional bug
    fixes. After a standard system update you need to restart any Java
    applications or applets to make all the necessary changes.
    
    References:
      https://usn.ubuntu.com/4257-1
      CVE-2020-2583, CVE-2020-2590, CVE-2020-2593, CVE-2020-2601,
      CVE-2020-2604, CVE-2020-2654, CVE-2020-2655, CVE-2020-2659
    
    Package Information:
      https://launchpad.net/ubuntu/+source/openjdk-8/8u242-b08-0ubuntu3~19.10
      https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.6+10-1ubuntu1~19.10.1
      https://launchpad.net/ubuntu/+source/openjdk-8/8u242-b08-0ubuntu3~18.04
      https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.6+10-1ubuntu1~18.04.1
      https://launchpad.net/ubuntu/+source/openjdk-8/8u242-b08-0ubuntu3~16.04
    

    Advisories

    LinuxSecurity Poll

    Which aspect of server security are you most interested in learning more about?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/38-which-aspect-of-server-security-are-you-most-interested-in-learning-more-about?task=poll.vote&format=json
    38
    radio
    [{"id":"131","title":"Preventing information leakage","votes":"1","type":"x","order":"1","pct":100,"resources":[]},{"id":"132","title":"Firewall considerations","votes":"0","type":"x","order":"2","pct":0,"resources":[]},{"id":"133","title":"Permissions ","votes":"0","type":"x","order":"3","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]