Bug 1076366 – VUL-0: java-1_7_0-openjdk,java-1_8_0-openjdk,java-1_9_0-openjdk: various security issues fixed in Oracle Jan 2018 CPU

Bug 1076366 - VUL-0: java-1_7_0-openjdk,java-1_8_0-openjdk,java-1_9_0-openjdk: various security issues fixed in Oracle Jan 2018 CPU


Summary:	VUL-0: java-1_7_0-openjdk,java-1_8_0-openjdk,java-1_9_0-openjdk: various secu...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Fridrich Strba
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/198401/
Whiteboard:	CVSSv3:UNK(Oracle):CVE-2018-2634:6.8:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2018-01-17 10:39 UTC by Marcus Meissner
Modified:	2019-05-01 14:06 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Marcus Meissner 2018-01-17 10:39:26 UTC

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA


- OpenJDK 9.0.4 (January 2018 CPU)
  * Security fixes:
    + S8172525, CVE-2018-2579: Improve key keying case
    + S8174962, CVE-2018-2582: Better interface invocations
    + S8178449, CVE-2018-2588: Improve LDAP logins
    + S8182125, CVE-2018-2599: Improve reliability of DNS lookups
    + S8182387, CVE-2018-2603: Improve PKCS usage
    + S8182601, CVE-2018-2602: Improve usage messages
    + S8185292, CVE-2018-2618: Stricter key generation
    + S8185325, CVE-2018-2641: Improve GTK initialization
    + S8186212, CVE-2018-2629: Improve GSS handling
    + S8186600, CVE-2018-2634: Improve property negotiations
    + S8186606, CVE-2018-2633: Improve LDAP lookup robustness
    + S8186998, CVE-2018-2637: Improve JMX supportive features
    + S8189284, CVE-2018-2663: More refactoring for deserialization
      cases
    + S8190289, CVE-2018-2677: More refactoring for client
      deserialization cases
    + S8191142, CVE-2018-2678: More refactoring for naming
      deserialization cases

Comment 1 Swamp Workflow Management 2018-03-12 17:08:16 UTC

SUSE-SU-2018:0661-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 1076366
CVE References: CVE-2018-2579,CVE-2018-2588,CVE-2018-2599,CVE-2018-2602,CVE-2018-2603,CVE-2018-2618,CVE-2018-2629,CVE-2018-2633,CVE-2018-2634,CVE-2018-2637,CVE-2018-2641,CVE-2018-2663,CVE-2018-2677,CVE-2018-2678
Sources used:
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    java-1_7_0-openjdk-1.7.0.171-43.12.1
SUSE Linux Enterprise Server 12-SP3 (src):    java-1_7_0-openjdk-1.7.0.171-43.12.1
SUSE Linux Enterprise Server 12-SP2 (src):    java-1_7_0-openjdk-1.7.0.171-43.12.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    java-1_7_0-openjdk-1.7.0.171-43.12.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    java-1_7_0-openjdk-1.7.0.171-43.12.1

Comment 2 Swamp Workflow Management 2018-03-12 17:09:39 UTC

SUSE-SU-2018:0663-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1076366
CVE References: CVE-2018-2579,CVE-2018-2582,CVE-2018-2588,CVE-2018-2599,CVE-2018-2602,CVE-2018-2603,CVE-2018-2618,CVE-2018-2629,CVE-2018-2633,CVE-2018-2634,CVE-2018-2637,CVE-2018-2641,CVE-2018-2663,CVE-2018-2677,CVE-2018-2678
Sources used:
SUSE OpenStack Cloud 6 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Server 12-SP3 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Server 12-SP2 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    java-1_8_0-openjdk-1.8.0.161-27.13.1

Comment 3 Swamp Workflow Management 2018-03-15 02:07:35 UTC

openSUSE-SU-2018:0679-1: An update that fixes 15 vulnerabilities is now available.

Category: security (important)
Bug References: 1076366
CVE References: CVE-2018-2579,CVE-2018-2582,CVE-2018-2588,CVE-2018-2599,CVE-2018-2602,CVE-2018-2603,CVE-2018-2618,CVE-2018-2629,CVE-2018-2633,CVE-2018-2634,CVE-2018-2637,CVE-2018-2641,CVE-2018-2663,CVE-2018-2677,CVE-2018-2678
Sources used:
openSUSE Leap 42.3 (src):    java-1_8_0-openjdk-1.8.0.161-21.1

Comment 4 Andreas Stieger 2018-03-15 09:11:45 UTC

showing as done here

Comment 5 Swamp Workflow Management 2018-03-15 11:13:18 UTC

openSUSE-SU-2018:0684-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 1076366
CVE References: CVE-2018-2579,CVE-2018-2588,CVE-2018-2599,CVE-2018-2602,CVE-2018-2603,CVE-2018-2618,CVE-2018-2629,CVE-2018-2633,CVE-2018-2634,CVE-2018-2637,CVE-2018-2641,CVE-2018-2663,CVE-2018-2677,CVE-2018-2678
Sources used:
openSUSE Leap 42.3 (src):    java-1_7_0-openjdk-1.7.0.171-48.3, java-1_7_0-openjdk-bootstrap-1.7.0.171-48.3