Lucene search

K
almalinuxAlmaLinuxALBA-2021:0206
HistoryJan 21, 2021 - 10:00 a.m.

java-1.8.0-openjdk bug fix and enhancement update

2021-01-2110:00:00
errata.almalinux.org
39

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime
Environment and the OpenJDK 8 Java Software Development Kit.

Bug Fix(es) and Enhancement(s):

  • Currently, Java applications run with Speculative Store Bypass (SSB,
    CVE-2018-3639) disabled. Disabling SSB results in a performance degradation.
    With this update, SSB is only disabled when applications are run via the new
    ‘alt-java’ launcher. (BZ#1901706)
  • Rebase to OpenJDK quarterly update 8u282. See release notes for full
    details(BZ#1903906, BZ#1908976)
  • Support for FIPS was introduced in RHEL 8.3.0, which relies on existing support for RHEL crypto policies. When the crypto policy support was disabled with -Djava.security.disableSystemPropertiesFile, it was found that the FIPS support class failed to initialise. The class is now initialised in all scenarios. (BZ#1908784)
  • Support for FIPS in OpenJDK relies on the Network Security Services (NSS) library. However, this was not expressed as an RPM dependency, so systems without NSS installed already would fail in FIPS mode. The OpenJDK RPMs now depend on NSS explicitly. (BZ#1914056)

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N