Bug 21324 - java-1.8.0-openjdk new security issues
Summary: java-1.8.0-openjdk new security issues
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA5TOO MGA5-64-OK MGA6-64-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-07-22 21:16 CEST by David Walser
Modified: 2017-07-30 17:59 CEST (History)
5 users (show)

See Also:
Source RPM: java-1.8.0-openjdk-1.8.0.131-1.b12.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-07-22 21:16:01 CEST
RedHat has issued an advisory on July 20:
https://rhn.redhat.com/errata/RHSA-2017-1789.html

Corresponding Oracle CPU:
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
Comment 1 David Walser 2017-07-22 21:17:21 CEST
I've already checked the needed update for java-1.8.0-openjdk into Mageia 5, Mageia 6, and Cauldron SVN.  I still need to resync copy-jdk-configs if needed.

There is new openjfx stuff added to the SPEC for this update, so I'm assigning to Nicolas to review what effect this has on his java-1.8.0-openjfx package before I push it.

Whiteboard: (none) => MGA5TOO
Assignee: bugsquad => nicolas.salguero

Comment 2 David Walser 2017-07-22 22:10:12 CEST
copy-jdk-configs update to 2.3 also checked into SVN.
Comment 3 David Walser 2017-07-22 22:46:32 CEST
Fedora advisory link for the copy-jdk-configs update (for the advisory):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NDHUFK52KRCLSHVSLH4Y7B4HJHXZYXRV/
Comment 4 Nicolas Salguero 2017-07-25 09:16:38 CEST
(In reply to David Walser from comment #1)
> There is new openjfx stuff added to the SPEC for this update, so I'm
> assigning to Nicolas to review what effect this has on his
> java-1.8.0-openjfx package before I push it.

The openjfx stuff from that package will conflict with java-1.8.0-openjfx so we need to disable it in all cases (at line 167, set "with_openjfx_binding" to "0").

Openjfx in fedora in only for x86 and x86_64, is built without webkit and media and comes from a development version whereas java-1.8.0-openjfx also builds with ARM, is built with webkit (except for armv5tl) and media and is synced with java-1.8.0-openjdk.

Moreover, because java-1.8.0-openjfx is synced with java-1.8.0-openjdk, I suggest that, starting with Mga6, the bugs reports for java-1.8.0-openjdk updates also integrates java-1.8.0-openjfx updates to be sure all the packages are pushed from updates_testing to updates at the same time (otherwise that will break dependencies).

Currently java-1.8.0-openjfx has been updated in SVN (Cauldron, Mga6 and Mga5 backports).  I will submit java-1.8.0-openjfx to the build system and create a separate bug report only for Mga5 (because it is a backport).
Comment 5 Nicolas Salguero 2017-07-25 09:24:05 CEST
Err, finally, if someone can submit java-1.8.0-openjfx to the build system for me because when I try, I get:
svn: E000111: Can't connect to host 'svn.mageia.org': Connection refused
Comment 6 Nicolas Salguero 2017-07-25 10:16:29 CEST
Finally, I wa
Comment 7 Nicolas Salguero 2017-07-25 10:16:58 CEST
Finally, I was able to submit java-1.8.0-openjfx.
Comment 8 David Walser 2017-07-26 04:35:17 CEST
Advisory:
========================

Updated java-1.8.0-openjdk packages fix security vulnerabilities:

It was discovered that the DCG implementation in the RMI component of OpenJDK
failed to correctly handle references. A remote attacker could possibly use
this flaw to execute arbitrary code with the privileges of RMI registry or a
Java RMI application (CVE-2017-10102).

Multiple flaws were discovered in the RMI, JAXP, ImageIO, Libraries, AWT,
Hotspot, and Security components in OpenJDK. An untrusted Java application or
applet could use these flaws to completely bypass Java sandbox restrictions
(CVE-2017-10107, CVE-2017-10096, CVE-2017-10101, CVE-2017-10089,
CVE-2017-10090, CVE-2017-10087, CVE-2017-10111, CVE-2017-10110,
CVE-2017-10074, CVE-2017-10067).

It was discovered that the LDAPCertStore class in the Security component of
OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP
referral URL could cause LDAPCertStore to communicate with non-LDAP servers
(CVE-2017-10116).

It was discovered that the Nashorn JavaScript engine in the Scripting
component of OpenJDK could allow scripts to access Java APIs even when access
to Java APIs was disabled. An untrusted JavaScript executed by Nashorn could
use this flaw to bypass intended restrictions (CVE-2017-10078).

It was discovered that the Security component of OpenJDK could fail to
properly enforce restrictions defined for processing of X.509 certificate
chains. A remote attacker could possibly use this flaw to make Java accept
certificate using one of the disabled algorithms (CVE-2017-10198).

A covert timing channel flaw was found in the DSA implementation in the JCE
component of OpenJDK. A remote attacker able to make a Java application
generate DSA signatures on demand could possibly use this flaw to extract
certain information about the used key via a timing side channel
(CVE-2017-10115).

A covert timing channel flaw was found in the PKCS#8 implementation in the JCE
component of OpenJDK. A remote attacker able to make a Java application
repeatedly compare PKCS#8 key against an attacker controlled value could
possibly use this flaw to determine the key via a timing side channel
(CVE-2017-10135).

It was discovered that the BasicAttribute and CodeSource classes in OpenJDK
did not limit the amount of memory allocated when creating object instances
from a serialized form. A specially crafted serialized input stream could
cause Java to consume an excessive amount of memory (CVE-2017-10108,
CVE-2017-10109).

Multiple flaws were found in the Hotspot and Security components in OpenJDK.
An untrusted Java application or applet could use these flaws to bypass
certain Java sandbox restrictions (CVE-2017-10081, CVE-2017-10193).

It was discovered that the JPEGImageReader implementation in the 2D component
of OpenJDK would, in certain cases, read all image data even if it was not
used later. A specially crafted image could cause a Java application to
temporarily use an excessive amount of CPU and memory (CVE-2017-10053).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10053
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10067
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10074
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10078
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10081
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10087
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10089
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10096
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10101
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10102
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10107
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10108
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10109
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10110
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10111
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10115
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10135
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10198
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
https://rhn.redhat.com/errata/RHSA-2017-1789.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NDHUFK52KRCLSHVSLH4Y7B4HJHXZYXRV/
========================

Updated packages in core/updates_testing:
========================
copy-jdk-configs-2.3-1.mga5
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-headless-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-devel-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-demo-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-src-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-javadoc-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-accessibility-1.8.0.141-1.b16.1.mga5
copy-jdk-configs-2.3-1.mga6
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-headless-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-devel-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-demo-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-src-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-javadoc-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-accessibility-1.8.0.141-1.b16.1.mga6

from SRPMS:
copy-jdk-configs-2.3-1.mga5.src.rpm
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga5.src.rpm
copy-jdk-configs-2.3-1.mga6.src.rpm
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga6.src.rpm

CC: (none) => nicolas.salguero
Assignee: nicolas.salguero => qa-bugs

Comment 9 Nicolas Salguero 2017-07-26 15:16:30 CEST
Hi David,

Could you add java-1.8.0-openjfx-1.8.0.141-1.b14.1.mga6 from java-1.8.0-openjfx-1.8.0.141-1.b14.1.mga6.src.rpm to the list of updated packages?

Or do you want I create a separate bug report for java-1.8.0-openjfx where both that bug report and the one for java-1.8.0-openjfx depend on each other?

Best regards,

Nico.
Comment 10 David Walser 2017-07-26 15:25:51 CEST
Just make a separate bug for openjfx.  They don't need to depend on each other (apparently the updates pushing script ignores that anyway) as we don't need it holding up a critical security update.  If you can get the bundled one to have all of the features of the package you made, it would be easier and you wouldn't have to worry about it anymore.  Please submit a diff to Fedora if you do implement that.
Comment 11 Nicolas Salguero 2017-07-26 16:04:10 CEST
Okay.  I created bug 21361 for java-1.8.0-openjfx.
Comment 12 PC LX 2017-07-27 21:42:16 CEST
Installed and tested with several java program (e.g. netbeans) without any noticeable issues.

System: x86_64, Plasma, nVidia (proprietary driver)

$ uname -a
Linux marte 4.4.78-desktop-1.mga5 #1 SMP Mon Jul 24 20:49:58 UTC 2017 x86_64 x86_64 
$ rpm -qa | egrep '^java-|copy-jdk'
copy-jdk-configs-2.3-1.mga5
java-1.8.0-openjdk-headless-1.8.0.141-1.b16.1.mga5
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga5

Whiteboard: MGA5TOO => MGA5TOO MGA5-64-OK
CC: (none) => mageia

Lewis Smith 2017-07-28 10:37:50 CEST

CC: (none) => lewyssmith
Whiteboard: MGA5TOO MGA5-64-OK => MGA5TOO MGA5-64-OK advisory

Comment 13 Herman Viaene 2017-07-28 17:35:31 CEST
MGA6-32 on Asus A6000VM MATE
No installation issues
Tried to use Gpsprune (used it about two years ago). At CLI:
$ java -jar /usr/share/java/gpsprune_18.6.jar 
java.io.IOException: Cannot run program "/opt/X11/bin/xprop": error=2, Bestand of map bestaat niet
	at java.lang.ProcessBuilder.start(ProcessBuilder.java:1048)
etc.....
Googled and found : "Looks like you're running into a bug in the Java accessibility toolkit: java-1.8.0-openjdk-accessibility. It is beta. If you don't need it, then uninstall it."

CC: (none) => herman.viaene

Comment 14 Herman Viaene 2017-07-28 18:00:01 CEST
Uninstalling java-1.8.0-openjdk-accessibility gets rid off the error and let Gpsprune run OK.
Comment 15 Rémi Verschelde 2017-07-30 13:26:33 CEST
Installed those three packages on Mageia 6 x86_64 and played Minecraft a bit, works fine:

copy-jdk-configs-2.3-1.mga6
java-1.8.0-openjdk-headless-1.8.0.141-1.b16.1.mga6
java-1.8.0-openjdk-1.8.0.141-1.b16.1.mga6

Whiteboard: MGA5TOO MGA5-64-OK advisory => MGA5TOO MGA5-64-OK MGA6-64-OK advisory

Comment 16 Rémi Verschelde 2017-07-30 13:26:44 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 17 Mageia Robot 2017-07-30 17:59:46 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0233.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.