Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2690
USN-4453-1: OpenJDK 8 vulnerabilities
6 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: OpenJDK-8
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-14621 CVE-2020-14593 CVE-2020-14583
CVE-2020-14581 CVE-2020-14579 CVE-2020-14578
CVE-2020-14577 CVE-2020-14556
Reference: ASB-2020.0131
ASB-2020.0128
ESB-2020.2677
ESB-2020.2645
ESB-2020.2545
ESB-2020.2534
Original Bulletin:
https://usn.ubuntu.com/4453-1/
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-4453-1: OpenJDK 8 vulnerabilities
05 August 2020
Several security issues were fixed in OpenJDK 8.
Releases
o Ubuntu 20.04 LTS
o Ubuntu 18.04 LTS
o Ubuntu 16.04 LTS
Packages
o openjdk-8 - Open Source Java implementation
Details
Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control
contexts. An attacker could possibly use this issue to execute arbitrary
code. (CVE-2020-14556)
Philippe Arteau discovered that OpenJDK 8 incorrectly verified names in
TLS server's X.509 certificates. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2020-14577)
It was discovered that OpenJDK 8 incorrectly handled exceptions in
DerInputStream class and in the DerValue.equals() method. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2020-14578, CVE-2020-14579)
It was discovered that OpenJDK 8 incorrectly handled image files. An
attacker could possibly use this issue to obtain sensitive information.
(CVE-2020-14581)
Markus Loewe discovered that OpenJDK 8 incorrectly handled concurrent
access in java.nio.Buffer class. An attacker could use this issue to
bypass sandbox restrictions.
(CVE-2020-14583)
It was discovered that OpenJDK 8 incorrectly handled transformation of
images. An attacker could possibly use this issue to bypass sandbox
restrictions and insert, edit or obtain sensitive information.
(CVE-2020-14593)
Roman Shemyakin discovered that OpenJDK 8 incorrectly handled XML files.
An attacker could possibly use this issue to insert, edit or obtain
sensitive information. (CVE-2020-14621)
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 20.04
o openjdk-8-jdk - 8u265-b01-0ubuntu2~20.04
o openjdk-8-jre - 8u265-b01-0ubuntu2~20.04
o openjdk-8-jre-headless - 8u265-b01-0ubuntu2~20.04
o openjdk-8-jre-zero - 8u265-b01-0ubuntu2~20.04
Ubuntu 18.04
o openjdk-8-jdk - 8u265-b01-0ubuntu2~18.04
o openjdk-8-jre - 8u265-b01-0ubuntu2~18.04
o openjdk-8-jre-headless - 8u265-b01-0ubuntu2~18.04
o openjdk-8-jre-zero - 8u265-b01-0ubuntu2~18.04
Ubuntu 16.04
o openjdk-8-jdk - 8u265-b01-0ubuntu2~16.04
o openjdk-8-jre - 8u265-b01-0ubuntu2~16.04
o openjdk-8-jre-headless - 8u265-b01-0ubuntu2~16.04
o openjdk-8-jre-jamvm - 8u265-b01-0ubuntu2~16.04
o openjdk-8-jre-zero - 8u265-b01-0ubuntu2~16.04
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.
References
o CVE-2020-14556
o CVE-2020-14577
o CVE-2020-14578
o CVE-2020-14579
o CVE-2020-14581
o CVE-2020-14583
o CVE-2020-14593
o CVE-2020-14621
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXyuXNuNLKJtyKPYoAQhnyg//c8MwVd9KWGj1WlBx720+bgGX1tJciy8R
k6c0CSyoXw8WPc5gMM2o+3JC/qHkKaqFdDYTO6WceZKm/RQTOIn0qzw+Jr/zz6eo
HfaKw2XIdFDEVCHFFZdTob1owvHV8LNWFmF2nstrbDcraQuDv+0fsPl49RaZgqqK
6AHY7RQIZZnyGsK1HP3o4zpv9OWHAZK1b42l1Wd/Zp6IlWTX2mWaXMLqBPnNj3so
bLClesU8xdAaqS8k71uaSwFGXaL4VT9AOQqSsDEAoAO23GyOm9iEDy3dLgyNsDUz
oGIZ2T86WvO4jYWRaWfHFauM1mSMKKahkbDSO9CHkAkX0pHAgPDpOtnsRHGIqFGl
xzC/6J/h540aaWNsF8E+qY/u0s2KJuePur7c1GSConUYzSFBVmj5MXL93U5+UZc5
l4XuT4dcK/6WzSh5d9lFOygDJq6RtSvydORoeJ5zfxyakpDTGlQkMHmL5EVnu+ND
9jYO8fJzmgOaNr531cS9dV07NsbGo01dj1VqqOjXUupQKjMp/gF3eBstFi3CeXbg
ASCmoA9eyFfojEx+9jzeTxe7K3XYK5HnygeEK98EHkY9nI9XqLjeay2Mg2v9ljUl
uXJfQQFXQWedKxbuQ3bE6xiric4TMvds1L4nvTE65/8agVKJQw+zcgjMnyWiB2dl
e31Xc29hljk=
=/qlq
-----END PGP SIGNATURE-----