Bug 19328 - java-1.8.0-openjdk maintenance release 8u102-b14
Summary: java-1.8.0-openjdk maintenance release 8u102-b14
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: has_procedure MGA5-64-OK mga5-32-ok a...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-09-10 10:01 CEST by David Walser
Modified: 2017-04-24 17:43 CEST (History)
5 users (show)

See Also:
Source RPM: java-1.8.0-openjdk-1.8.0.101-1.b14.1.mga5.src.rpm, copy-jdk-configs-1.1-1.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-09-10 10:01:15 CEST
Fedora has issued an update on September 1:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZTED4NT5IEQ7UGHSKBOFFXM5ZMEPHRUA/

I've synced with Fedora in SVN, but as usual we need to update the missing files.

Nicolas, it looks like you wrote a script for it, but it isn't in SVN, so only you have access to it.  Would you mind running it again?

Reminder to self to also update copy-jdk-configs.
Comment 1 Nicolas Salguero 2016-09-10 21:38:26 CEST
(In reply to David Walser from comment #0)
> Nicolas, it looks like you wrote a script for it, but it isn't in SVN, so
> only you have access to it.  Would you mind running it again?

Hi,

In fact my script was in SVN but the synchronization with fedora deleted it.  In http://svnweb.mageia.org/packages?view=revision&revision=1051353, I can see "cauldron/java-1.8.0-openjdk/current/SOURCES/mga-add-missing-files.sh 	deleted".

Do you want to readd it yourself and run it or do you want I do that myself?

Best regards,

Nico.
Comment 2 David Walser 2016-09-11 00:27:37 CEST
Ahh thanks Nicolas.  I think I got it working.  I added as Source3 in the SPEC so it won't get removed again.

Summary: java-1.8.0-openjdk maintenance release 8u102b14 => java-1.8.0-openjdk maintenance release 8u102-b14

Comment 3 Nicolas Salguero 2016-09-16 13:11:22 CEST
See https://bugs.mageia.org/show_bug.cgi?id=14051#c4 for useful links to test java.

Suggested advisory:
========================

The updated java-1.8.0-openjdk packages contain some enhancements and changes not provided by version 8u101.
========================

Updated packages in core/updates_testing:
========================
i586:
java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-headless-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-devel-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-demo-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-src-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-javadoc-1.8.0.102-1.b14.1.mga5.i586.rpm
java-1.8.0-openjdk-accessibility-1.8.0.102-1.b14.1.mga5.i586.rpm

x86_64:
java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-headless-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-devel-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-demo-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-src-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-javadoc-1.8.0.102-1.b14.1.mga5.x86_64.rpm
java-1.8.0-openjdk-accessibility-1.8.0.102-1.b14.1.mga5.x86_64.rpm

Source RPMs:
java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.src.rpm

Status: NEW => ASSIGNED
Assignee: nicolas.salguero => qa-bugs
Whiteboard: (none) => has_procedure

Comment 4 David Walser 2016-09-16 14:45:04 CEST
copy-jdk-configs needed to be pushed for this update as well.

Suggested advisory:
========================

The updated java-1.8.0-openjdk packages contain some enhancements and changes
not provided by version 8u101.

Also, the copy-jdk-configs package had a typo that caused it to not handle
nss.cfg correctly.  This has been fixed.

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZTED4NT5IEQ7UGHSKBOFFXM5ZMEPHRUA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BW3IJ4YRCDURZNCZU7OZJDOGWI4U6YLX/
========================

Updated packages in core/updates_testing:
========================
copy-jdk-configs-1.2-1.mga5
java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-headless-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-devel-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-demo-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-src-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-javadoc-1.8.0.102-1.b14.1.mga5
java-1.8.0-openjdk-accessibility-1.8.0.102-1.b14.1.mga5

Source RPMs:
copy-jdk-configs-1.2-1.mga5.src.rpm
java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.src.rpm
Comment 5 Brian Rockwell 2016-09-30 00:30:17 CEST
The following 5 packages are going to be installed:

- java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.x86_64
- java-1.8.0-openjdk-demo-1.8.0.102-1.b14.1.mga5.x86_64
- java-1.8.0-openjdk-devel-1.8.0.102-1.b14.1.mga5.x86_64
- java-1.8.0-openjdk-headless-1.8.0.102-1.b14.1.mga5.x86_64
- java-1.8.0-openjdk-javadoc-1.8.0.102-1.b14.1.mga5.noarch

4.1MB of additional disk space will be used.

52MB of packages will be retrieved.

Installed Eclipse and went to Help | Installation Details | Configuration Details


java.endorsed.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.x86_64/jre/lib/endorsed
java.ext.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.x86_64/jre/lib/ext:/usr/java/packages/lib/ext
java.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.x86_64/jre
java.io.tmpdir=/tmp
java.library.path=/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib
java.runtime.name=OpenJDK Runtime Environment
java.runtime.version=1.8.0_102-b14

---

Added java perspective

---


Created Hello World app and compiled it.

Then ran it from Eclipse and from hand.

also ran java

$ java -version
openjdk version "1.8.0_102"
OpenJDK Runtime Environment (build 1.8.0_102-b14)
OpenJDK 64-Bit Server VM (build 25.102-b14, mixed mode)

CC: (none) => brtians1
Whiteboard: has_procedure => has_procedure MGA5-64-OK

Comment 6 Brian Rockwell 2016-09-30 01:06:14 CEST
The following 5 packages are going to be installed:

- copy-jdk-configs-1.2-1.mga5.noarch
- java-1.8.0-openjdk-1.8.0.102-1.b14.1.mga5.i586
- java-1.8.0-openjdk-demo-1.8.0.102-1.b14.1.mga5.i586
- java-1.8.0-openjdk-devel-1.8.0.102-1.b14.1.mga5.i586
- java-1.8.0-openjdk-headless-1.8.0.102-1.b14.1.mga5.i586

44MB of additional disk space will be used.

38MB of packages will be retrieved.

รข ran from command line

$ java -version
openjdk version "1.8.0_102"
OpenJDK Runtime Environment (build 1.8.0_102-b14)
OpenJDK Server VM (build 25.102-b14, mixed mode)
Brian Rockwell 2016-09-30 01:06:27 CEST

Whiteboard: has_procedure MGA5-64-OK => has_procedure MGA5-64-OK mga5-32-ok

Nicolas Salguero 2016-10-02 09:58:13 CEST

CC: (none) => nicolas.salguero
Source RPM: java-1.8.0-openjdk-1.8.0.101-1.b14.1.mga5.src.rpm => java-1.8.0-openjdk-1.8.0.101-1.b14.1.mga5.src.rpm, copy-jdk-configs-1.1-1.1.mga5.src.rpm

Dave Hodgins 2016-10-04 13:49:17 CEST

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA5-64-OK mga5-32-ok => has_procedure MGA5-64-OK mga5-32-ok advisory
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 7 Mageia Robot 2016-10-04 14:21:34 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGAA-2016-0117.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 8 Len Lawrence 2017-04-24 17:43:57 CEST
Testing on x86_64 real hardware - firefox 45.8

Installed missing packages before the update and the java plugin, which is actually called Iced Tea-Web.  The java console can be accessed via System menu -> Administration -> OpenJDK 8 Monitoring & Management....
$ java -version
openjdk version "1.8.0_121"
OpenJDK Runtime Environment (build 1.8.0_121-b14)
OpenJDK 64-Bit Server VM (build 25.121-b14, mixed mode)

The links supplied do not help much with testing the several vulnerabilities reported, one of which has actually been exploited in the wild to gain unauthorized access to celebrity Twitter accounts.  RedHat rates the severity of the issues as moderate.

Since these are development packages and therefore needing expert knowledge it is unlikely that QA can test the vulnerabilities, leaving just the installation check, unless somebody can explain how to run the demonstrations.
  
$ urpmq -i java-1.8.0-openjdk-demo
    $MIRRORLIST: media/core/release/media_info/20150615-211931-info.xml.lzma
    $MIRRORLIST: media/core/updates/media_info/20170424-072630-info.xml.lzma   
Name        : java-1.8.0-openjdk-demo                                          
Version     : 1.8.0.45
Release     : 6.b14.1.mga5
Group       : Development/Java
Size        : 4296531                      Architecture: x86_64
Source RPM  : java-1.8.0-openjdk-1.8.0.45-6.b14.1.mga5.src.rpm
URL         : http://openjdk.java.net/
Summary     : OpenJDK Demos
Description :
The OpenJDK demos.

Installed the Eclipse platform, which requires java-headless, and stumbled through the HelloWorld tutorial.  It worked fine.

Updated the packages.
$ java -version
openjdk version "1.8.0_131"
OpenJDK Runtime Environment (build 1.8.0_131-b12)
OpenJDK 64-Bit Server VM (build 25.131-b12, mixed mode)

Opened eclipse and edited the HelloWorld class and ran the script as a java application.  Everything OK.

CC: (none) => tarazed25


Note You need to log in before you can comment on or make changes to this bug.