Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.2926
java-1.7.1-ibm security update
31 August 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: java-1.7.1-ibm
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Modify Arbitrary Files -- Remote with User Interaction
Denial of Service -- Remote/Unauthenticated
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2021-2432 CVE-2021-2369 CVE-2021-2341
Reference: ESB-2021.2925
ESB-2021.2675
ESB-2021.2474
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:3293
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: java-1.7.1-ibm security update
Advisory ID: RHSA-2021:3293-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://access.redhat.com/errata/RHSA-2021:3293
Issue date: 2021-08-30
CVE Names: CVE-2021-2341 CVE-2021-2369 CVE-2021-2432
=====================================================================
1. Summary:
An update for java-1.7.1-ibm is now available for Red Hat Enterprise Linux
7 Supplementary.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64
3. Description:
IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment
and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 7 to version 7R1 SR4-FP90.
Security Fix(es):
* OpenJDK: FTP PASV command response can cause FtpClient to connect to
arbitrary host (Networking, 8258432) (CVE-2021-2341)
* OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF
files (Library, 8260967) (CVE-2021-2369)
* Oracle JDK: unspecified vulnerability fixed in 7u311 (JNDI)
(CVE-2021-2432)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
All running instances of IBM Java must be restarted for this update to take
effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1982874 - CVE-2021-2341 OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432)
1982879 - CVE-2021-2369 OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967)
1994980 - CVE-2021-2432 Oracle JDK: unspecified vulnerability fixed in 7u311 (JNDI)
6. Package List:
Red Hat Enterprise Linux Client Supplementary (v. 7):
x86_64:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Supplementary (v. 7):
x86_64:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Server Supplementary (v. 7):
ppc64:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.ppc64.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.ppc64.rpm
ppc64le:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.ppc64le.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.ppc64le.rpm
s390x:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.s390x.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.s390x.rpm
x86_64:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 7):
x86_64:
java-1.7.1-ibm-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-demo-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-devel-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-jdbc-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-plugin-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
java-1.7.1-ibm-src-1.7.1.4.90-1jpp.1.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-2341
https://access.redhat.com/security/cve/CVE-2021-2369
https://access.redhat.com/security/cve/CVE-2021-2432
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYSyRLtzjgjWX9erEAQi9YQ/9GrF3mDCd+ZBuWtLsjubuAwsSMBBCvoon
xc8Ih26FOpvLxjv5H4yx7lbu7U0xKrHOZ3rAEXTHhPmOThNVF1edn5xFqiVkg//f
fwhXzmBoxNZbzbHXLGDuXrDATP00DPRyWQvkOs9NIHvVrngB66jwnkTXsi8Mmv/7
8GR1ro4obqfDSzZbkQjXIzrgOcWYwqf7IZH5zV9ymnHl1ffHuCZOBNv8NYZCa35E
IhxkWzt5DMuECVc6+Px9d7QXaj2xqXf7QaQiZQyuRbWsGtiHUHQ0Gs9BdPqmuYrV
SClnD0Gcddo4+RakpgalvTlZMpq/RUzF5IY9U1sPvbE7MyeWaW6VwLqIcUuWpS3r
b8uucMba8vuVcEAnxx5TZqtLNJik7aj5obegkUUEtKKpZPy1G7NkXjCTjsJaVxYA
GogPVAsHcaEmnjC0366A0NXb99DqwgT4ayl7+p441O7M8ExBMZpfvW+Z5vWSAK9U
nSQ2twPl+VwS8dduLNx4pxZWc+YrexcmSVIBP1Uhz4IBJBLHuLAqDGo3Kht6lth8
JEk7Bvm+M7LkM1u5VdkC3d5MEU/yUf8g09dE89kh/itfhy/ntqPvKxM6B3C2WYSe
NMyeqT+S17Ajip2G62OO19TQyTpI6OvfrHX7XpsF+eVV/iVzwCsw8pfVak1j78Xe
QbZXnIxAaw4=
=YEMY
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYS1sjONLKJtyKPYoAQjLyRAAjQlRI/8pJHnYiX4oqKQwjdorhJI5d3Jq
cfPkc7zylz+EIFzLaB9YrJyU/zTHftPi+wqoB9E7zdDpLSwvN3eMkRjAE+COTibv
Mtu1EGXkXHydAKV6TJwLlHhG13Yd7I41qAteUvriGWdPw0RhhWri0il0FQA9q6SN
1Td+AnGFJedfGUzng1fsJkIA2c/i2gDrWsr0xYHZsI86sVGMAP814UIbzC0whtav
9O5LxYQjnipn69Ksiy02ma7xCkgeq9S7Xvb7b9nnRObc7BOs0HWcTOosCqj6Usog
TckQVIO0+QbePleH0FRmFSEPxDAQRqdWH1dkVW+yChkkRuemKhvKrqM63EywvSVN
7u6F3i4tH0bzzRczpvgCrQC0JuNAAcZI5ci+2H8eaKemxGDJ0F1goEIhE5Qc6669
a55gnAN445rKJ+Fr/KA4tAySDU84Xn9tUOqzf5/8sFFnjMvDmVixr87PioDjZN06
U4iI3mK9qdnxIuSPSamnYPvKHFn5Y1M9wWo8DLY/ifqvB9we52cRSsKvK2CcRihg
WzuHQYKnQc9cyGdJCksqCnz27glKWUKyncuJWsE8HNE/i/Nt7o6RjCEM18sXXtI4
MgqASgk2VJgaBYhWdyZybwXk4NxrSjrL7eYXIV+sYiQhXAXNMKGtZVZFqAvdVqkP
ILskoR+Db7k=
=+JUb
-----END PGP SIGNATURE-----