Issued:
2018-05-24
Updated:
2018-05-24

RHSA-2018:1723 - Security Advisory

Synopsis

Important: java-1.7.1-ibm security update

Type/Severity

Security Advisory: Important

Topic

An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux 7 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

This update upgrades IBM Java SE 7 to version 7R1 SR4-FP25.

Security Fix(es):

  • OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997) (CVE-2018-2794)
  • Oracle JDK: unspecified vulnerability fixed in 6u191, 7u171, and 8u161 (Security) (CVE-2018-2783)
  • OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977) (CVE-2018-2795)
  • OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981) (CVE-2018-2796)
  • OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985) (CVE-2018-2797)
  • OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989) (CVE-2018-2798)
  • OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993) (CVE-2018-2799)
  • OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833) (CVE-2018-2800)
  • OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969) (CVE-2018-2790)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of IBM Java must be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Workstation 7 x86_64
  • Red Hat Enterprise Linux Desktop 7 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 7 s390x
  • Red Hat Enterprise Linux for Power, big endian 7 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 7 x86_64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 1567126 - CVE-2018-2794 OpenJDK: unrestricted deserialization of data from JCEKS key stores (Security, 8189997)
  • BZ - 1567351 - CVE-2018-2795 OpenJDK: insufficient consistency checks in deserialization of multiple classes (Security, 8189977)
  • BZ - 1567542 - CVE-2018-2799 OpenJDK: unbounded memory allocation during deserialization in NamedNodeMapImpl (JAXP, 8189993)
  • BZ - 1567543 - CVE-2018-2798 OpenJDK: unbounded memory allocation during deserialization in Container (AWT, 8189989)
  • BZ - 1567545 - CVE-2018-2797 OpenJDK: unbounded memory allocation during deserialization in TabularDataSupport (JMX, 8189985)
  • BZ - 1567546 - CVE-2018-2796 OpenJDK: unbounded memory allocation during deserialization in PriorityBlockingQueue (Concurrency, 8189981)
  • BZ - 1568163 - CVE-2018-2800 OpenJDK: RMI HTTP transport enabled by default (RMI, 8193833)
  • BZ - 1568515 - CVE-2018-2790 OpenJDK: incorrect merging of sections in the JAR manifest (Security, 8189969)
  • BZ - 1569204 - CVE-2018-2783 Oracle JDK: unspecified vulnerability fixed in 6u191, 7u171, and 8u161 (Security)

CVEs

References

Red Hat Enterprise Linux Server 7

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 14078ccaab2d124e2115f721b87a3a9939c32dd495382354153707a53b98cd7b
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 5727867e6b084acc3b9b8abaef6b5b822401fe95fb6948c068f5508e6ae41083
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: cdd2db5ca38fce9db33008845bb3901cb012ff2b645de2ec3f647d5e1db9dd79
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 22b21199c3b7afba763c1f362a679350a79f79562c35de47f5f905af3aef7310
java-1.7.1-ibm-plugin-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: fcf6c41161afc5a903b370a7fbde82196d327bbae971daf4d3441e21477795eb
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: b07e68cde90b6a161029a8a90c59b245f92b14323f59580573b7d0db8041321e

Red Hat Enterprise Linux Workstation 7

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 14078ccaab2d124e2115f721b87a3a9939c32dd495382354153707a53b98cd7b
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 5727867e6b084acc3b9b8abaef6b5b822401fe95fb6948c068f5508e6ae41083
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: cdd2db5ca38fce9db33008845bb3901cb012ff2b645de2ec3f647d5e1db9dd79
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 22b21199c3b7afba763c1f362a679350a79f79562c35de47f5f905af3aef7310
java-1.7.1-ibm-plugin-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: fcf6c41161afc5a903b370a7fbde82196d327bbae971daf4d3441e21477795eb
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: b07e68cde90b6a161029a8a90c59b245f92b14323f59580573b7d0db8041321e

Red Hat Enterprise Linux Desktop 7

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 14078ccaab2d124e2115f721b87a3a9939c32dd495382354153707a53b98cd7b
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 5727867e6b084acc3b9b8abaef6b5b822401fe95fb6948c068f5508e6ae41083
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: cdd2db5ca38fce9db33008845bb3901cb012ff2b645de2ec3f647d5e1db9dd79
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 22b21199c3b7afba763c1f362a679350a79f79562c35de47f5f905af3aef7310
java-1.7.1-ibm-plugin-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: fcf6c41161afc5a903b370a7fbde82196d327bbae971daf4d3441e21477795eb
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: b07e68cde90b6a161029a8a90c59b245f92b14323f59580573b7d0db8041321e

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
s390x
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.s390x.rpm SHA-256: a501185705dcc718a9828d611690e3c2f07faccd31d5b4cb191fc0083af7b9a1
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.s390x.rpm SHA-256: cab74d5641666eae5f77a109da8529a4fb371960bee7a3225083ab1b9cbeed36
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.s390x.rpm SHA-256: 5676184b588a388fdc20f667e5f692e8f21420bfd1442c9567bad8e6ff2f4c35
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.s390x.rpm SHA-256: a28a2f27814d408d4df2eecee3adbbe92c3280f839abb3d8ba960108cbca2749
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.s390x.rpm SHA-256: 8478ca2ca64e636fe75f9192f84e6e4782db37db3c79539b0c915bfcd10ef968

Red Hat Enterprise Linux for Power, big endian 7

SRPM
ppc64
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.ppc64.rpm SHA-256: 88f915d13e1a806a485ab730ebc587c26d0013e1be8431e07e632dff81a5cc10
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.ppc64.rpm SHA-256: dca7d392c64941c8e45cff9862ad9b9625c9dc3b51dfbd0cd5c7619e4688200b
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.ppc64.rpm SHA-256: 065ea6cf09cf3e81ce5442c23a8b823cb88ab1dbc9c8dce21bd37b099818691e
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.ppc64.rpm SHA-256: a211912b14eac0c72ae8808353598382294ee95044a33b9bcf7d047838014481
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.ppc64.rpm SHA-256: 017a9d75f38e4e749f8178d76fe7910dcdf241c0da6033e6f030b2467a7e6442

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
x86_64
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 14078ccaab2d124e2115f721b87a3a9939c32dd495382354153707a53b98cd7b
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: 5727867e6b084acc3b9b8abaef6b5b822401fe95fb6948c068f5508e6ae41083
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: cdd2db5ca38fce9db33008845bb3901cb012ff2b645de2ec3f647d5e1db9dd79
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.x86_64.rpm SHA-256: b07e68cde90b6a161029a8a90c59b245f92b14323f59580573b7d0db8041321e

Red Hat Enterprise Linux for Power, little endian 7

SRPM
ppc64le
java-1.7.1-ibm-1.7.1.4.25-1jpp.3.el7.ppc64le.rpm SHA-256: db61f25702b040680397fc5bcdbaaae8e65c3a2cf7589f9f06bc861bfe519384
java-1.7.1-ibm-demo-1.7.1.4.25-1jpp.3.el7.ppc64le.rpm SHA-256: a4d54a729f20839859fa045672cdb94010ad8491fad3c324973b348f54aaff70
java-1.7.1-ibm-devel-1.7.1.4.25-1jpp.3.el7.ppc64le.rpm SHA-256: b9659683b59356fe56a66efc97a21d5cf0c4d8b2e28749d2452dccfdac9fd708
java-1.7.1-ibm-jdbc-1.7.1.4.25-1jpp.3.el7.ppc64le.rpm SHA-256: 460182b996f261d9a50a354c7d386420994630539267d9c9dc2c6eccfac043d1
java-1.7.1-ibm-src-1.7.1.4.25-1jpp.3.el7.ppc64le.rpm SHA-256: cec30224888d4a7e837266ac9dbbeafb4a15b665a3faf17986a315abe34449f7

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.