【CESA-2017:1108】最新バージョンのjava-1.8.0-openjdkが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました

CESA-2017:1108

最新バージョンのjava-1.8.0-openjdkが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment
and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

* An untrusted library search path flaw was found in the JCE component of
OpenJDK. A local attacker could possibly use this flaw to cause a Java
application using JCE to load an attacker-controlled library and hence escalate
their privileges. (CVE-2017-3511)

* It was found that the JAXP component of OpenJDK failed to correctly enforce
parse tree size limits when parsing XML document. An attacker able to make a
Java application parse a specially crafted XML document could use this flaw to
make it consume an excessive amount of CPU and memory. (CVE-2017-3526)

* It was discovered that the HTTP client implementation in the Networking
component of OpenJDK could cache and re-use an NTLM authenticated connection in
a different security context. A remote attacker could possibly use this flaw to
make a Java application perform HTTP requests authenticated with credentials of
a different user. (CVE-2017-3509)

Note: This update adds support for the “jdk.ntlm.cache” system property which,
when set to false, prevents caching of NTLM connections and authentications and
hence prevents this issue. However, caching remains enabled by default.

* It was discovered that the Security component of OpenJDK did not allow users
to restrict the set of algorithms allowed for Jar integrity verification. This
flaw could allow an attacker to modify content of the Jar file that used weak
signing key or hash algorithm. (CVE-2017-3539)

Note: This updates extends the fix for CVE-2016-5542 released as part of the
RHSA-2016:2079 erratum to no longer allow the MD5 hash algorithm during the Jar
integrity verification by adding it to the jdk.jar.disabledAlgorithms security
property.

* Newline injection flaws were discovered in FTP and SMTP client implementations
in the Networking component in OpenJDK. A remote attacker could possibly use
these flaws to manipulate FTP or SMTP connections established by a Java
application. (CVE-2017-3533, CVE-2017-3544)

Note: If the web browser plug-in provided by the icedtea-web package was
installed, the issues exposed via Java applets could have been exploited without
user interaction if a user visited a malicious website.

Bug Fix(es):

* When a method is called using the Java Debug Wire Protocol (JDWP)
“invokeMethod” command in a target Java virtual machine, JDWP creates global
references for every Object that is implied in the method invocation, as well as
for the returned argument of the reference type. Previously, the global
references created for such arguments were not collected (deallocated) by the
garbage collector after “invokeMethod” finished. This consequently caused memory
leaks, and because references to such objects were never released, the debugged
application could be terminated with an Out of Memory error. This bug has been
fixed, and the described problem no longer occurs. (BZ#1442162)

Bugs Fixed

1442162 – Using jdb triggers OOME on the debugged application
1443007 – CVE-2017-3511 OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)
1443052 – CVE-2017-3509 OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)
1443068 – CVE-2017-3544 OpenJDK: newline injection in the SMTP client (Networking, 8171533)
1443083 – CVE-2017-3533 OpenJDK: newline injection in the FTP client (Networking, 8170222)
1443097 – CVE-2017-3539 OpenJDK: MD5 allowed for jar verification (Security, 8171121)
1443252 – CVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)