Ubuntu 20.10, 20.04 LTS: USN-4607-2 Moderate: OpenJDK Regression

ubuntu

November 12, 2020

USN-4607-1 introduced a regression in OpenJDK.

Summary

USN-4607-1 introduced a regression in OpenJDK.

Software Description:

- openjdk-8: Open Source Java implementation

- openjdk-lts: Open Source Java implementation

Details:

USN-4607-1 fixed vulnerabilities and added features in OpenJDK.

Unfortunately, that update introduced a regression that could cause TLS

connections with client certificate authentication to fail in some

situations. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that OpenJDK incorrectly handled deserializing Proxy

class objects with many interfaces. A remote attacker could possibly use

this issue to cause a denial of service (memory consumption) via a

specially crafted input. (CVE-2020-14779)

Sergey Ostanin discovered that OpenJDK incorrectly restricted

authentication mechanisms. A remote attacker could possibly use this

issue to obtain sensitive information over an unencrypted connection.

(CVE-2020-14781)

...

Read the Full Advisory

Topics Covered

security advisory authentication ubuntu TLS regression openjdk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  openjdk-11-jdk                  11.0.9.1+1-0ubuntu1~20.10
  openjdk-11-jre                  11.0.9.1+1-0ubuntu1~20.10
  openjdk-11-jre-headless         11.0.9.1+1-0ubuntu1~20.10
  openjdk-11-jre-zero             11.0.9.1+1-0ubuntu1~20.10
  openjdk-8-jdk                   8u275-b01-0ubuntu1~20.10
  openjdk-8-jre                   8u275-b01-0ubuntu1~20.10
  openjdk-8-jre-headless          8u275-b01-0ubuntu1~20.10
  openjdk-8-jre-zero              8u275-b01-0ubuntu1~20.10

Ubuntu 20.04 LTS:
  openjdk-11-jdk                  11.0.9.1+1-0ubuntu1~20.04
  openjdk-11-jre                  11.0.9.1+1-0ubuntu1~20.04
  openjdk-11-jre-headless         11.0.9.1+1-0ubuntu1~20.04
  openjdk-11-jre-zero             11.0.9.1+1-0ubuntu1~20.04
  openjdk-8-jdk                   8u275-b01-0ubuntu1~20.04
  openjdk-8-jre                   8u275-b01-0ubuntu1~20.04
  openjdk-8-jre-headless          8u275-b01-0ubuntu1~20.04
  openjdk-8-jre-zero              8u275-b01-0ubuntu1~20.04

Ubuntu 18.04 LTS:
  openjdk-11-jdk                  11.0.9.1+1-0ubuntu1~18.04
  openjdk-11-jre                  11.0.9.1+1-0ubuntu1~18.04
  openjdk-11-jre-headless         11.0.9.1+1-0ubuntu1~18.04
  openjdk-11-jre-zero             11.0.9.1+1-0ubuntu1~18.04
  openjdk-8-jdk                   8u275-b01-0ubuntu1~18.04
  openjdk-8-jre                   8u275-b01-0ubuntu1~18.04
  openjdk-8-jre-headless          8u275-b01-0ubuntu1~18.04
  openjdk-8-jre-zero              8u275-b01-0ubuntu1~18.04

Ubuntu 16.04 LTS:
  openjdk-8-jdk                   8u275-b01-0ubuntu1~16.04
  openjdk-8-jre                   8u275-b01-0ubuntu1~16.04
  openjdk-8-jre-headless          8u275-b01-0ubuntu1~16.04
  openjdk-8-jre-zero              8u275-b01-0ubuntu1~16.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.