Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2528.2
Important: java-1.8.0-ibm security update
29 August 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: java-1.8.0-ibm
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Execute Arbitrary Code/Commands -- Existing Account
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2018-12539 CVE-2018-2973 CVE-2018-2952
CVE-2018-2940 CVE-2018-1656 CVE-2018-1517
CVE-2017-3736 CVE-2017-3732 CVE-2016-0705
Reference: ASB-2018.0170
ASB-2017.0202
ESB-2018.2255
ESB-2018.2046
ESB-2018.0643
Original Bulletin:
https://access.redhat.com/errata/RHSA-2018:2568
https://access.redhat.com/errata/RHSA-2018:2575
Comment: This bulletin contains two (2) Red Hat security advisories.
Revision History: August 29 2018: Added bulletin for RHEL 6 patch releases
August 28 2018: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2018:2568-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2568
Issue date: 2018-08-27
CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736
CVE-2018-1517 CVE-2018-1656 CVE-2018-2940
CVE-2018-2952 CVE-2018-2973 CVE-2018-12539
=====================================================================
1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client Supplementary (v. 7)
- x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7)
- x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7)
- ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7)
- x86_64
3. Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP20.
Security Fix(es):
* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)
* openssl: BN_mod_exp may produce incorrect results on x86_64
(CVE-2017-3732)
* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
* IBM JDK: DoS in the java.math component (CVE-2018-1517)
* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)
* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)
* OpenSSL: Double-free in DSA code (CVE-2016-0705)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the
original reporter of CVE-2016-0705.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code
1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on
x86_64
1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in
PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201,
7u191, 8u181, and 10.0.2 (JSSE)
1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201,
7u191, 8u181, and 10.0.2 (Libraries)
1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently
restricted access to Attach API
1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling
Framework
1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component
6. Package List:
Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64.rpm
ppc64le:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm
s390x:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.s390x.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.s390x.rpm
x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 7):
x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-0705
https://access.redhat.com/security/cve/CVE-2017-3732
https://access.redhat.com/security/cve/CVE-2017-3736
https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/a
- -----------------------------------------------------------------------------
=====================================================================
Red Hat Security Advisory
Synopsis: Important: java-1.8.0-ibm security update
Advisory ID: RHSA-2018:2575-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2575
Issue date: 2018-08-28
CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736
CVE-2018-1517 CVE-2018-1656 CVE-2018-2940
CVE-2018-2952 CVE-2018-2973 CVE-2018-12539
=====================================================================
1. Summary:
An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux
6 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6)
- i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM
Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP20.
Security Fix(es):
* IBM JDK: privilege escalation via insufficiently restricted access to
Attach API (CVE-2018-12539)
* openssl: BN_mod_exp may produce incorrect results on x86_64
(CVE-2017-3732)
* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
* IBM JDK: DoS in the java.math component (CVE-2018-1517)
* IBM JDK: path traversal flaw in the Diagnostic Tooling Framework
(CVE-2018-1656)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (Libraries) (CVE-2018-2940)
* OpenJDK: insufficient index validation in PatternSyntaxException
getMessage() (Concurrency, 8199547) (CVE-2018-2952)
* Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and
10.0.2 (JSSE) (CVE-2018-2973)
* OpenSSL: Double-free in DSA code (CVE-2016-0705)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank the OpenSSL project for reporting
CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the
original reporter of CVE-2016-0705.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code
1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on
x86_64
1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64
1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in
PatternSyntaxException getMessage() (Concurrency, 8199547)
1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201,
7u191, 8u181, and 10.0.2 (JSSE)
1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201,
7u191, 8u181, and 10.0.2 (Libraries)
1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently
restricted access to Attach API
1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling
Framework
1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64:
java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
ppc64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.ppc64.rpm
s390x:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.s390x.rpm
x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.i686.rpm
x86_64:
java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el6_10.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-0705
https://access.redhat.com/security/cve/CVE-2017-3732
https://access.redhat.com/security/cve/CVE-2017-3736
https://access.redhat.com/security/cve/CVE-2018-1517
https://access.redhat.com/security/cve/CVE-2018-1656
https://access.redhat.com/security/cve/CVE-2018-2940
https://access.redhat.com/security/cve/CVE-2018-2952
https://access.redhat.com/security/cve/CVE-2018-2973
https://access.redhat.com/security/cve/CVE-2018-12539
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW4X2xGaOgq3Tt24GAQj0Pg//dGmnWiymviyPIyjO1l1jX1MVip2c0xxQ
9VyTzdBkfUKtHBo6otD4Ah+XpqmkcLRmodYmPim8TqCNIHv4J4Xjf0kgqL0jBo58
VQ7CWENvjAO/GZ4DB5OzrRZx5Vss7VUPHmbAZzLp/3AP05/q0zEhgXS1rt3HXX0f
0dQQ3r66K9UfeNKO9I0pTbVp7SmLnFyM9Z9PiPOyp4QzlRDafpbj6hSgzPvyJWIl
eOdKi68Xq47N+oa++7I9X04wvu/dRHL9HjWjq5CC8Aju6pKYA2+ZjnSI+Vqcj/ey
AVZWqdSnNBjryLBe/WFtWCSJkoPEUhSVSH7/rv4cyAT0StS1SfR08Y5T725lhLon
/L6dJhlND2eZ1WuTI+fREnKV9R/xULNckaZJfS4aFBOEvApEgpiQQGe8Bl0tQHG8
rI5CKh8VvYA3oTemymVjESk6KF2LWGDonPwmhPyxFGMvSUTpHKCInM8H9kkuBiN9
qDB4aPIu2vL42CmVo6y8yeW6y5WiqTC7JIZHmqlhsl2Twf7Mui1YESPfzkfvtouR
Aj0NGxYYdUfXEmWQmNZO6BnQkJgEyGD0M9lIDXR+5EJLLB9qbeet+wuDJg43nfTh
jb2mvlXTZCkJR2S2tqDTFRPDBaDnXVWbHHRNIXj+FhD76quvLzFDAwr5lePWj3Xu
YrMhCHthISo=
=9sZi
-----END PGP SIGNATURE-----