CentOS ProjectCESA-2018:3521java security update
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.012 Low
EPSS
Percentile
85.2%
CentOS Errata and Security Advisory CESA-2018:3521
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
Security Fix(es):
-
OpenJDK: Improper field access checks (Hotspot, 8199226) (CVE-2018-3169)
-
OpenJDK: Unrestricted access to scripting engine (Scripting, 8202936) (CVE-2018-3183)
-
OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177) (CVE-2018-3149)
-
OpenJDK: Incorrect handling of unsigned attributes in signed Jar manifests (Security, 8194534) (CVE-2018-3136)
-
OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902) (CVE-2018-3139)
-
OpenJDK: Multi-Release attribute read from outside of the main manifest attributes (Utility, 8199171) (CVE-2018-3150)
-
OpenJDK: Missing endpoint identification algorithm check during TLS session resumption (JSSE, 8202613) (CVE-2018-3180)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-December/085267.html
https://lists.centos.org/pipermail/centos-cr-announce/2018-November/032020.html
Affected packages:
java-11-openjdk
java-11-openjdk-debug
java-11-openjdk-demo
java-11-openjdk-demo-debug
java-11-openjdk-devel
java-11-openjdk-devel-debug
java-11-openjdk-headless
java-11-openjdk-headless-debug
java-11-openjdk-javadoc
java-11-openjdk-javadoc-debug
java-11-openjdk-javadoc-zip
java-11-openjdk-javadoc-zip-debug
java-11-openjdk-jmods
java-11-openjdk-jmods-debug
java-11-openjdk-src
java-11-openjdk-src-debug
Upstream details at:
https://access.redhat.com/errata/RHSA-2018:3521
Related
9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.012 Low
EPSS
Percentile
85.2%