- Issued:
- 2017-01-20
- Updated:
- 2017-01-20
RHSA-2017:0180 - Critical: java-1.8.0-openjdk security update
Synopsis
Critical: java-1.8.0-openjdk security update
Type/Severity
Security Advisory Critical
Topic
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.
Security Fix(es):
- It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. (CVE-2017-3241)
This issue was addressed by introducing whitelists of classes that can be deserialized by RMI registry or DCG. These whitelists can be customized using the newly introduced sun.rmi.registry.registryFilter and sun.rmi.transport.dgcFilter security properties.
-
Multiple flaws were discovered in the Libraries and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289)
-
A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker could possibly use this flaw to extract certain information about the used key via a timing side channel. (CVE-2016-5548)
-
It was discovered that the Libraries component of OpenJDK accepted ECSDA signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools. (CVE-2016-5546)
-
It was discovered that the 2D component of OpenJDK performed parsing of iTXt and zTXt PNG image chunks even when configured to ignore metadata. An attacker able to make a Java application parse a specially crafted PNG image could cause the application to consume an excessive amount of memory. (CVE-2017-3253)
-
It was discovered that the Libraries component of OpenJDK did not validate the length of the object identifier read from the DER input before allocating memory to store the OID. An attacker able to make a Java application decode a specially crafted DER input could cause the application to consume an excessive amount of memory. (CVE-2016-5547)
-
It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN. (CVE-2017-3252)
-
It was discovered that the Networking component of OpenJDK failed to properly parse user info from the URL. A remote attacker could cause a Java application to incorrectly parse an attacker supplied URL and interpret it differently from other applications processing the same URL. (CVE-2016-5552)
-
Multiple flaws were found in the Networking components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2017-3261, CVE-2017-3231)
-
A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183)
This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to the list of legacy algorithms (defined using the jdk.tls.legacyAlgorithms security property) so they are only used if connecting TLS/SSL client and server do not share any other non-legacy cipher suite.
Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website.
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of OpenJDK Java must be restarted for this update to take effect.
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 7.7 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 7.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 7.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 7.3 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.7 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.5 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 7.3 | x86_64 |
| Red Hat Enterprise Linux for Scientific Computing | 7 | x86_64 |
| Red Hat Enterprise Linux for Scientific Computing | 6 | x86_64 |
| Red Hat Enterprise Linux for Power, little endian | 7 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.7 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.6 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.5 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.4 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 7.3 | ppc64le |
| Red Hat Enterprise Linux for Power, big endian | 7 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.7 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.6 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.5 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.4 | ppc64 |
| Red Hat Enterprise Linux for Power, big endian - Extended Update Support | 7.3 | ppc64 |
| Red Hat Enterprise Linux for IBM z Systems | 7 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.7 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.6 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.5 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.4 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 7.3 | s390x |
| Red Hat Enterprise Linux Workstation | 7 | x86_64 |
| Red Hat Enterprise Linux Workstation | 6 | x86_64 |
| Red Hat Enterprise Linux Workstation | 6 | i386 |
| Red Hat Enterprise Linux Server | 7 | x86_64 |
| Red Hat Enterprise Linux Server | 6 | x86_64 |
| Red Hat Enterprise Linux Server | 6 | i386 |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 7.7 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 7.6 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 7.4 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 7.3 | ppc64le |
| Red Hat Enterprise Linux Server - TUS | 7.7 | x86_64 |
| Red Hat Enterprise Linux Server - TUS | 7.6 | x86_64 |
| Red Hat Enterprise Linux Server - TUS | 7.3 | x86_64 |
| Red Hat Enterprise Linux Server - Retired Extended Life Cycle Support | 6 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support | 7 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support | 6 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support | 6 | i386 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian | 7 | ppc64le |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian | 7 | ppc64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension | 6 | x86_64 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension | 6 | i386 |
| Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) | 7 | s390x |
| Red Hat Enterprise Linux Server - AUS | 7.7 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 7.6 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 7.4 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 7.3 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.7 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.6 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.5 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.4 | x86_64 |
| Red Hat Enterprise Linux EUS Compute Node | 7.3 | x86_64 |
| Red Hat Enterprise Linux Desktop | 7 | x86_64 |
| Red Hat Enterprise Linux Desktop | 6 | x86_64 |
| Red Hat Enterprise Linux Desktop | 6 | i386 |
Updated Packages
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-javadoc-zip-1.8.0.121-0.b13.el7_3.noarch.rpm
- java-1.8.0-openjdk-javadoc-1.8.0.121-0.b13.el7_3.noarch.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.src.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-javadoc-debug-1.8.0.121-0.b13.el7_3.noarch.rpm
- java-1.8.0-openjdk-accessibility-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.src.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-javadoc-debug-1.8.0.121-0.b13.el6_8.noarch.rpm
- java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-accessibility-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-devel-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.121-0.b13.el7_3.noarch.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.s390x.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-devel-debug-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-accessibility-debug-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-accessibility-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-src-debug-1.8.0.121-0.b13.el7_3.aarch64.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.i686.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-demo-debug-1.8.0.121-0.b13.el7_3.x86_64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el6_8.i686.rpm
- java-1.8.0-openjdk-demo-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-headless-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-headless-debug-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el6_8.x86_64.rpm
- java-1.8.0-openjdk-accessibility-1.8.0.121-0.b13.el7_3.ppc64le.rpm
- java-1.8.0-openjdk-debuginfo-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-javadoc-1.8.0.121-0.b13.el6_8.noarch.rpm
- java-1.8.0-openjdk-src-1.8.0.121-0.b13.el7_3.ppc64.rpm
- java-1.8.0-openjdk-debug-1.8.0.121-0.b13.el6_8.i686.rpm
Fixes
- This content is not included.BZ - 1369383
- This content is not included.BZ - 1413554
- This content is not included.BZ - 1413562
- This content is not included.BZ - 1413583
- This content is not included.BZ - 1413653
- This content is not included.BZ - 1413717
- This content is not included.BZ - 1413764
- This content is not included.BZ - 1413882
- This content is not included.BZ - 1413906
- This content is not included.BZ - 1413911
- This content is not included.BZ - 1413920
- This content is not included.BZ - 1413955
CVEs
- CVE-2016-5546
- CVE-2016-5547
- CVE-2016-5548
- CVE-2016-5552
- CVE-2017-3231
- CVE-2017-3241
- CVE-2017-3252
- CVE-2017-3253
- CVE-2017-3261
- CVE-2017-3272
- CVE-2017-3289
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.