Issued:
2018-03-14
Updated:
2018-03-14

RHSA-2018:0521 - Security Advisory

Synopsis

Important: java-1.7.1-ibm security update

Type/Severity

Security Advisory: Important

Topic

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP20.

Security Fix(es):

  • OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962) (CVE-2018-2582)
  • OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606) (CVE-2018-2633)
  • OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600) (CVE-2018-2634)
  • OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998) (CVE-2018-2637)
  • OpenJDK: GTK library loading use-after-free (AWT, 8185325) (CVE-2018-2641)
  • OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449) (CVE-2018-2588)
  • OpenJDK: DnsClient missing source port randomization (JNDI, 8182125) (CVE-2018-2599)
  • OpenJDK: loading of classes from untrusted locations (I18n, 8182601) (CVE-2018-2602)
  • OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387) (CVE-2018-2603)
  • OpenJDK: insufficient strength of key agreement (JCE, 8185292) (CVE-2018-2618)
  • Oracle JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization) (CVE-2018-2657)
  • OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284) (CVE-2018-2663)
  • OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289) (CVE-2018-2677)
  • OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142) (CVE-2018-2678)
  • OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525) (CVE-2018-2579)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server 6 x86_64
  • Red Hat Enterprise Linux Server 6 i386
  • Red Hat Enterprise Linux Workstation 6 x86_64
  • Red Hat Enterprise Linux Workstation 6 i386
  • Red Hat Enterprise Linux Desktop 6 x86_64
  • Red Hat Enterprise Linux Desktop 6 i386
  • Red Hat Enterprise Linux for IBM z Systems 6 s390x
  • Red Hat Enterprise Linux for Power, big endian 6 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

  • BZ - 1534263 - CVE-2018-2678 OpenJDK: unbounded memory allocation in BasicAttributes deserialization (JNDI, 8191142)
  • BZ - 1534288 - CVE-2018-2677 OpenJDK: unbounded memory allocation during deserialization (AWT, 8190289)
  • BZ - 1534296 - CVE-2018-2663 OpenJDK: ArrayBlockingQueue deserialization to an inconsistent state (Libraries, 8189284)
  • BZ - 1534298 - CVE-2018-2579 OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525)
  • BZ - 1534299 - CVE-2018-2588 OpenJDK: LdapLoginModule insufficient username encoding in LDAP query (LDAP, 8178449)
  • BZ - 1534525 - CVE-2018-2602 OpenJDK: loading of classes from untrusted locations (I18n, 8182601)
  • BZ - 1534543 - CVE-2018-2599 OpenJDK: DnsClient missing source port randomization (JNDI, 8182125)
  • BZ - 1534553 - CVE-2018-2603 OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387)
  • BZ - 1534762 - CVE-2018-2618 OpenJDK: insufficient strength of key agreement (JCE, 8185292)
  • BZ - 1534766 - CVE-2018-2641 OpenJDK: GTK library loading use-after-free (AWT, 8185325)
  • BZ - 1534768 - CVE-2018-2582 OpenJDK: insufficient validation of the invokeinterface instruction (Hotspot, 8174962)
  • BZ - 1534943 - CVE-2018-2634 OpenJDK: use of global credentials for HTTP/SPNEGO (JGSS, 8186600)
  • BZ - 1534970 - CVE-2018-2637 OpenJDK: SingleEntryRegistry incorrect setup of deserialization filter (JMX, 8186998)
  • BZ - 1535036 - CVE-2018-2633 OpenJDK: LDAPCertStore insecure handling of LDAP referrals (JNDI, 8186606)
  • BZ - 1535353 - CVE-2018-2657 Oracle JDK: unspecified vulnerability fixed in 6u181 and 7u171 (Serialization)

CVEs

References

Red Hat Enterprise Linux Server 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: a35efea04bde7b8699eff50bcb87f405ddc50b1afdd1427e5c2398f8424f3b32
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 8f7dd2576dcc39d6c64c421dc2ca9b92714debb4477358bd9f198ec46142d3d7
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 19b3e3b07bf4e5164a1d686eb7962163f1fdf6380891dc9d9ddb1bad40d30e6d
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: d7909933e791d8806ef20e0ccf6aea657de14c156834bb57016f749127f0344b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 60c8737793c1ba63dad7231ef42e66e8f84cad8f73b43a4ac876cb6b60f62cc4
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 482548de80cea69c7d2dac396a0f89fc1c9b76cc4ea534b07d509bd4f15095d3
i386
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 4312154f6e09265bd7c257cdd0ff47d131bcc8e4ae01598f7004dcfe5fd4c537
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 0b6da58fa9c576b02f84bfedea5ed1d9322f9aa0f044332ca1171ada4ec070f8
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: c905d6c68ef04bb43cbef89e5ccf8014e4dff634cec9f83af05c11a0610fb12f
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 72e6ad78a8baf2075b4951af8de5291f26d4ce86c24a9d05240b292ca7ed4f8b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: af8f9cb648b75562849466d230d98c7d6f9f5f9bdd1e53f6241b38b9a1efc89a
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 019a8b2a1eae7e3dbf5fd3d85a74ea5175c5625560ed64594477249827be65b5

Red Hat Enterprise Linux Workstation 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: a35efea04bde7b8699eff50bcb87f405ddc50b1afdd1427e5c2398f8424f3b32
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 8f7dd2576dcc39d6c64c421dc2ca9b92714debb4477358bd9f198ec46142d3d7
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 19b3e3b07bf4e5164a1d686eb7962163f1fdf6380891dc9d9ddb1bad40d30e6d
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: d7909933e791d8806ef20e0ccf6aea657de14c156834bb57016f749127f0344b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 60c8737793c1ba63dad7231ef42e66e8f84cad8f73b43a4ac876cb6b60f62cc4
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 482548de80cea69c7d2dac396a0f89fc1c9b76cc4ea534b07d509bd4f15095d3
i386
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 4312154f6e09265bd7c257cdd0ff47d131bcc8e4ae01598f7004dcfe5fd4c537
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 0b6da58fa9c576b02f84bfedea5ed1d9322f9aa0f044332ca1171ada4ec070f8
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: c905d6c68ef04bb43cbef89e5ccf8014e4dff634cec9f83af05c11a0610fb12f
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 72e6ad78a8baf2075b4951af8de5291f26d4ce86c24a9d05240b292ca7ed4f8b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: af8f9cb648b75562849466d230d98c7d6f9f5f9bdd1e53f6241b38b9a1efc89a
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 019a8b2a1eae7e3dbf5fd3d85a74ea5175c5625560ed64594477249827be65b5

Red Hat Enterprise Linux Desktop 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: a35efea04bde7b8699eff50bcb87f405ddc50b1afdd1427e5c2398f8424f3b32
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 8f7dd2576dcc39d6c64c421dc2ca9b92714debb4477358bd9f198ec46142d3d7
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 19b3e3b07bf4e5164a1d686eb7962163f1fdf6380891dc9d9ddb1bad40d30e6d
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: d7909933e791d8806ef20e0ccf6aea657de14c156834bb57016f749127f0344b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 60c8737793c1ba63dad7231ef42e66e8f84cad8f73b43a4ac876cb6b60f62cc4
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 482548de80cea69c7d2dac396a0f89fc1c9b76cc4ea534b07d509bd4f15095d3
i386
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 4312154f6e09265bd7c257cdd0ff47d131bcc8e4ae01598f7004dcfe5fd4c537
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 0b6da58fa9c576b02f84bfedea5ed1d9322f9aa0f044332ca1171ada4ec070f8
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: c905d6c68ef04bb43cbef89e5ccf8014e4dff634cec9f83af05c11a0610fb12f
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 72e6ad78a8baf2075b4951af8de5291f26d4ce86c24a9d05240b292ca7ed4f8b
java-1.7.1-ibm-plugin-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: af8f9cb648b75562849466d230d98c7d6f9f5f9bdd1e53f6241b38b9a1efc89a
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.i686.rpm SHA-256: 019a8b2a1eae7e3dbf5fd3d85a74ea5175c5625560ed64594477249827be65b5

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
s390x
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.s390x.rpm SHA-256: 80c28ab6a24d6d505ec1531190e38f2f4348f5ff7b7d30673485afc1dc517253
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.s390x.rpm SHA-256: 8630f39d1483646c866e3560f24a918ccdc8bfa6b2050f7883737099b4d6b708
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.s390x.rpm SHA-256: c1213e4f4ed3a1f39259190878ed22c091d5657405e94b97fa7f3313ae85d4f0
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.s390x.rpm SHA-256: c2fec9ad27b11a6fdcd74abc0b0a49fcc9bfd9140cbbca5ed033f5ad4f61f717
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.s390x.rpm SHA-256: d4796d895f80eea22408af912988b3ac94aa970fef197bb00d5ba83ce6fa2922

Red Hat Enterprise Linux for Power, big endian 6

SRPM
ppc64
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.ppc64.rpm SHA-256: 7a2f77d46608e5e0ba6383f64cf8c8c59f6eb0b542291e40a3fa211547a821aa
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.ppc64.rpm SHA-256: 0eeb289aa967aa30f7b4aed6a5e27089fe85b0307137d1bffc690a5aea99d0d1
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.ppc64.rpm SHA-256: 5e3d7b0bc955a9d82ea2347655e985047c197743e79aaa8449416bd9f7f587c8
java-1.7.1-ibm-jdbc-1.7.1.4.20-1jpp.3.el6_9.ppc64.rpm SHA-256: 08283fd4643354b5a972b27547efebe4b1143c940630d7d36bf037513a6db1c3
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.ppc64.rpm SHA-256: 8f062efa0f33a2dd997b38224fe8ee6a9a592f3621c1113e1d1becc6777cea93

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: a35efea04bde7b8699eff50bcb87f405ddc50b1afdd1427e5c2398f8424f3b32
java-1.7.1-ibm-demo-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 8f7dd2576dcc39d6c64c421dc2ca9b92714debb4477358bd9f198ec46142d3d7
java-1.7.1-ibm-devel-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 19b3e3b07bf4e5164a1d686eb7962163f1fdf6380891dc9d9ddb1bad40d30e6d
java-1.7.1-ibm-src-1.7.1.4.20-1jpp.3.el6_9.x86_64.rpm SHA-256: 482548de80cea69c7d2dac396a0f89fc1c9b76cc4ea534b07d509bd4f15095d3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.