Ubuntu 19.10: USN-4337-1 Critical: OpenJDK Denial Of Service Risks

ubuntu

April 22, 2020

Several security issues were fixed in OpenJDK.

Summary

Several security issues were fixed in OpenJDK.

Software Description:

- openjdk-8: Open Source Java implementation

- openjdk-lts: Open Source Java implementation

Details:

It was discovered that OpenJDK incorrectly handled certain regular

expressions. An attacker could possibly use this issue to cause a denial of

service while processing a specially crafted regular expression.

(CVE-2020-2754, CVE-2020-2755)

It was discovered that OpenJDK incorrectly handled class descriptors and

catching exceptions during object stream deserialization. An attacker could

possibly use this issue to cause a denial of service while processing a

specially crafted serialized input. (CVE-2020-2756, CVE-2020-2757)

Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and

Robert Merget discovered that OpenJDK incorrectly handled certificate messages

during TLS handshake. An attacker could possibly use this issue to bypass

certificate verification and insert, edit or obtain sensitive info...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu security issues OpenJDK TLS handshake Java implementation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  openjdk-11-jdk                  11.0.7+10-2ubuntu2~19.10
  openjdk-11-jre                  11.0.7+10-2ubuntu2~19.10
  openjdk-11-jre-headless         11.0.7+10-2ubuntu2~19.10
  openjdk-11-jre-zero             11.0.7+10-2ubuntu2~19.10
  openjdk-8-jdk                   8u252-b09-1~19.10
  openjdk-8-jre                   8u252-b09-1~19.10
  openjdk-8-jre-headless          8u252-b09-1~19.10
  openjdk-8-jre-zero              8u252-b09-1~19.10

Ubuntu 18.04 LTS:
  openjdk-11-jdk                  11.0.7+10-2ubuntu2~18.04
  openjdk-11-jre                  11.0.7+10-2ubuntu2~18.04
  openjdk-11-jre-headless         11.0.7+10-2ubuntu2~18.04
  openjdk-11-jre-zero             11.0.7+10-2ubuntu2~18.04
  openjdk-8-jdk                   8u252-b09-1~18.04
  openjdk-8-jre                   8u252-b09-1~18.04
  openjdk-8-jre-headless          8u252-b09-1~18.04
  openjdk-8-jre-zero              8u252-b09-1~18.04

Ubuntu 16.04 LTS:
  openjdk-8-jdk                   8u252-b09-1~16.04
  openjdk-8-jre                   8u252-b09-1~16.04
  openjdk-8-jre-headless          8u252-b09-1~16.04
  openjdk-8-jre-jamvm             8u252-b09-1~16.04
  openjdk-8-jre-zero              8u252-b09-1~16.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.