An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP10.
Security Fix(es) :
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2018:0352. The text
# itself is copyright (C) Red Hat, Inc.
#
include("compat.inc");
if (description)
{
script_id(107019);
script_version("3.7");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/01/28");
script_cve_id("CVE-2018-1417", "CVE-2018-2579", "CVE-2018-2582", "CVE-2018-2588", "CVE-2018-2599", "CVE-2018-2602", "CVE-2018-2603", "CVE-2018-2618", "CVE-2018-2633", "CVE-2018-2634", "CVE-2018-2637", "CVE-2018-2638", "CVE-2018-2639", "CVE-2018-2641", "CVE-2018-2663", "CVE-2018-2677", "CVE-2018-2678");
script_xref(name:"RHSA", value:"2018:0352");
script_name(english:"RHEL 6 : java-1.8.0-ibm (RHSA-2018:0352)");
script_summary(english:"Checks the rpm output for the updated packages");
script_set_attribute(
attribute:"synopsis",
value:"The remote Red Hat host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"An update for java-1.8.0-ibm is now available for Red Hat Enterprise
Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security
impact of Critical. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.
IBM Java SE version 8 includes the IBM Java Runtime Environment and
the IBM Java Software Development Kit.
This update upgrades IBM Java SE 8 to version 8 SR5-FP10.
Security Fix(es) :
* This update fixes multiple vulnerabilities in the IBM Java Runtime
Environment and the IBM Java Software Development Kit. Further
information about these flaws can be found on the IBM Java Security
Vulnerabilities page listed in the References section. (CVE-2018-2579,
CVE-2018-2582, CVE-2018-2588, CVE-2018-2599, CVE-2018-2602,
CVE-2018-2603, CVE-2018-2618, CVE-2018-2633, CVE-2018-2634,
CVE-2018-2637, CVE-2018-2638, CVE-2018-2639, CVE-2018-2641,
CVE-2018-2663, CVE-2018-2677, CVE-2018-2678)"
);
script_set_attribute(
attribute:"see_also",
value:"https://developer.ibm.com/javasdk/support/security-vulnerabilities/"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/errata/RHSA-2018:0352"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-1417"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2579"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2582"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2588"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2599"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2602"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2603"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2618"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2633"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2634"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2637"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2638"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2639"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2641"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2663"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2677"
);
script_set_attribute(
attribute:"see_also",
value:"https://access.redhat.com/security/cve/cve-2018-2678"
);
script_set_attribute(attribute:"solution", value:"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/01/18");
script_set_attribute(attribute:"patch_publication_date", value:"2018/02/26");
script_set_attribute(attribute:"plugin_publication_date", value:"2018/02/27");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2018-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Red Hat Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo))
{
rhsa = "RHSA-2018:0352";
yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
if (!empty_or_null(yum_report))
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : yum_report
);
exit(0);
}
else
{
audit_message = "affected by Red Hat security advisory " + rhsa;
audit(AUDIT_OS_NOT, audit_message);
}
}
else
{
flag = 0;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-demo-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.8.0-ibm-demo-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-demo-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-devel-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.8.0-ibm-devel-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-devel-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-jdbc-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.8.0-ibm-jdbc-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-jdbc-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-plugin-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-plugin-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"i686", reference:"java-1.8.0-ibm-src-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"java-1.8.0-ibm-src-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"java-1.8.0-ibm-src-1.8.0.5.10-1jpp.1.el6_9")) flag++;
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get() + redhat_report_package_caveat()
);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "java-1.8.0-ibm / java-1.8.0-ibm-demo / java-1.8.0-ibm-devel / etc");
}
}
Vendor | Product | Version | CPE |
---|---|---|---|
redhat | enterprise_linux | java-1.8.0-ibm | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm |
redhat | enterprise_linux | java-1.8.0-ibm-demo | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo |
redhat | enterprise_linux | java-1.8.0-ibm-devel | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel |
redhat | enterprise_linux | java-1.8.0-ibm-jdbc | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc |
redhat | enterprise_linux | java-1.8.0-ibm-plugin | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin |
redhat | enterprise_linux | java-1.8.0-ibm-src | p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src |
redhat | enterprise_linux | 6 | cpe:/o:redhat:enterprise_linux:6 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1417
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2579
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2582
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2588
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2599
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2602
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2603
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2618
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2633
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2634
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2637
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2638
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2639
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2641
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2663
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2677
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2678
access.redhat.com/errata/RHSA-2018:0352
access.redhat.com/security/cve/cve-2018-1417
access.redhat.com/security/cve/cve-2018-2579
access.redhat.com/security/cve/cve-2018-2582
access.redhat.com/security/cve/cve-2018-2588
access.redhat.com/security/cve/cve-2018-2599
access.redhat.com/security/cve/cve-2018-2602
access.redhat.com/security/cve/cve-2018-2603
access.redhat.com/security/cve/cve-2018-2618
access.redhat.com/security/cve/cve-2018-2633
access.redhat.com/security/cve/cve-2018-2634
access.redhat.com/security/cve/cve-2018-2637
access.redhat.com/security/cve/cve-2018-2638
access.redhat.com/security/cve/cve-2018-2639
access.redhat.com/security/cve/cve-2018-2641
access.redhat.com/security/cve/cve-2018-2663
access.redhat.com/security/cve/cve-2018-2677
access.redhat.com/security/cve/cve-2018-2678
developer.ibm.com/javasdk/support/security-vulnerabilities/