Ubuntu 20.10 LTS: USN-4892-1 Critical OpenJDK Jar Bypass

ubuntu

April 27, 2021

OpenJDK's security restriction could be bypassed when verifying Jar signatures.

Summary

OpenJDK's security restriction could be bypassed when verifying Jar

signatures.

Software Description:

- openjdk-8: Open Source Java implementation

- openjdk-lts: Open Source Java implementation

Details:

It was discovered that OpenJDK incorrectly verified Jar signatures. An

attacker could possibly use this issue to bypass intended security

restrictions when using Jar files signed with a disabled algorithm.

Topics Covered

security advisory security issue critical software update Ubuntu open source ubuntu openjdk OpenJDK jar bypass Jar bypass

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  openjdk-11-jdk                  11.0.11+9-0ubuntu2~20.10
  openjdk-11-jre                  11.0.11+9-0ubuntu2~20.10
  openjdk-11-jre-headless         11.0.11+9-0ubuntu2~20.10
  openjdk-11-jre-zero             11.0.11+9-0ubuntu2~20.10
  openjdk-8-jdk                   8u292-b10-0ubuntu1~20.10
  openjdk-8-jre                   8u292-b10-0ubuntu1~20.10
  openjdk-8-jre-headless          8u292-b10-0ubuntu1~20.10
  openjdk-8-jre-zero              8u292-b10-0ubuntu1~20.10

Ubuntu 20.04 LTS:
  openjdk-11-jdk                  11.0.11+9-0ubuntu2~20.04
  openjdk-11-jre                  11.0.11+9-0ubuntu2~20.04
  openjdk-11-jre-headless         11.0.11+9-0ubuntu2~20.04
  openjdk-11-jre-zero             11.0.11+9-0ubuntu2~20.04
  openjdk-8-jdk                   8u292-b10-0ubuntu1~20.04
  openjdk-8-jre                   8u292-b10-0ubuntu1~20.04
  openjdk-8-jre-headless          8u292-b10-0ubuntu1~20.04
  openjdk-8-jre-zero              8u292-b10-0ubuntu1~20.04

Ubuntu 18.04 LTS:
  openjdk-11-jdk                  11.0.11+9-0ubuntu2~18.04
  openjdk-11-jre                  11.0.11+9-0ubuntu2~18.04
  openjdk-11-jre-headless         11.0.11+9-0ubuntu2~18.04
  openjdk-11-jre-zero             11.0.11+9-0ubuntu2~18.04
  openjdk-8-jdk                   8u292-b10-0ubuntu1~18.04
  openjdk-8-jre                   8u292-b10-0ubuntu1~18.04
  openjdk-8-jre-headless          8u292-b10-0ubuntu1~18.04
  openjdk-8-jre-zero              8u292-b10-0ubuntu1~18.04

Ubuntu 16.04 LTS:
  openjdk-8-jdk                   8u292-b10-0ubuntu1~16.04.1
  openjdk-8-jre                   8u292-b10-0ubuntu1~16.04.1
  openjdk-8-jre-headless          8u292-b10-0ubuntu1~16.04.1
  openjdk-8-jre-zero              8u292-b10-0ubuntu1~16.04.1

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.