Issued:

2019-10-17

Updated:

2019-10-17

RHSA-2019:3135 - Important: java-11-openjdk security update

Synopsis

Important: java-11-openjdk security update

Type/Severity

Security Advisory Important

Topic

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

• OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

• OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) (CVE-2019-2975)

• OpenJDK: Out of bounds access in optimized String indexof implementation (Hotspot, 8224062) (CVE-2019-2977)

• OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

• OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

• OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

• OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

• OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964)

• OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973)

• OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

• OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983)

• OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

• OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

• OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

• OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of OpenJDK Java must be restarted for this update to take effect.

Affected Products

Updated Packages

• java-11-openjdk-src-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-devel-slowdebug-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-slowdebug-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-debugsource-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-devel-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-javadoc-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-javadoc-zip-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-javadoc-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-slowdebug-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-devel-slowdebug-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-headless-slowdebug-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-debugsource-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-headless-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-demo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-debugsource-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-headless-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-src-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-devel-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-headless-slowdebug-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-jmods-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-headless-slowdebug-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-slowdebug-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-headless-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-jmods-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-javadoc-zip-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-devel-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-devel-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-devel-slowdebug-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-headless-slowdebug-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-devel-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-headless-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-headless-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-demo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-headless-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-javadoc-zip-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-jmods-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-src-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-headless-debuginfo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-demo-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-devel-slowdebug-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-javadoc-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-demo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-devel-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-jmods-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-slowdebug-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-debugsource-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-headless-debuginfo-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-src-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-devel-debuginfo-11.0.5.10-0.el8_0.aarch64.rpm
• java-11-openjdk-11.0.5.10-0.el8_0.s390x.rpm
• java-11-openjdk-devel-debuginfo-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-javadoc-11.0.5.10-0.el8_0.x86_64.rpm
• java-11-openjdk-javadoc-zip-11.0.5.10-0.el8_0.ppc64le.rpm
• java-11-openjdk-11.0.5.10-0.el8_0.src.rpm

Fixes

• This content is not included.BZ - 1760963
• This content is not included.BZ - 1760969
• This content is not included.BZ - 1760978
• This content is not included.BZ - 1760980
• This content is not included.BZ - 1760992
• This content is not included.BZ - 1760999
• This content is not included.BZ - 1761002
• This content is not included.BZ - 1761006
• This content is not included.BZ - 1761146
• This content is not included.BZ - 1761149
• This content is not included.BZ - 1761262
• This content is not included.BZ - 1761266
• This content is not included.BZ - 1761594
• This content is not included.BZ - 1761596
• This content is not included.BZ - 1761601

CVEs

• CVE-2019-2945
• CVE-2019-2949
• CVE-2019-2962
• CVE-2019-2964
• CVE-2019-2973
• CVE-2019-2975
• CVE-2019-2977
• CVE-2019-2978
• CVE-2019-2981
• CVE-2019-2983
• CVE-2019-2987
• CVE-2019-2988
• CVE-2019-2989
• CVE-2019-2992
• CVE-2019-2999

References

• https://access.redhat.com/security/updates/classification/#important

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.