USN-4337-1: OpenJDK vulnerabilities<\/p>\n
A security issue affects these releases of Ubuntu and its derivatives:<\/p>\n
Several security issues were fixed in OpenJDK.<\/p>\n
It was discovered that OpenJDK incorrectly handled certain regular
\nexpressions. An attacker could possibly use this issue to cause a denial of
\nservice while processing a specially crafted regular expression.
\n(CVE-2020-2754, CVE-2020-2755)<\/p>\n
It was discovered that OpenJDK incorrectly handled class descriptors and
\ncatching exceptions during object stream deserialization. An attacker could
\npossibly use this issue to cause a denial of service while processing a
\nspecially crafted serialized input. (CVE-2020-2756, CVE-2020-2757)<\/p>\n
Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and
\nRobert Merget discovered that OpenJDK incorrectly handled certificate messages
\nduring TLS handshake. An attacker could possibly use this issue to bypass
\ncertificate verification and insert, edit or obtain sensitive information. This
\nissue only affected OpenJDK 11. (CVE-2020-2767)<\/p>\n
It was discovered that OpenJDK incorrectly handled exceptions thrown by
\nunmarshalKeyInfo() and unmarshalXMLSignature(). An attacker could possibly use
\nthis issue to cause a denial of service while reading key info or XML signature
\ndata from XML input. (CVE-2020-2773)<\/p>\n
Peter Dettman discovered that OpenJDK incorrectly handled SSLParameters in
\nsetAlgorithmConstraints(). An attacker could possibly use this issue to
\noverride the defined systems security policy and lead to the use of weak
\ncrypto algorithms that should be disabled. This issue only affected
\nOpenJDK 11. (CVE-2020-2778)<\/p>\n
Simone Bordet discovered that OpenJDK incorrectly re-used single null TLS
\nsessions for new TLS connections. A remote attacker could possibly use this
\nissue to cause a denial of service. (CVE-2020-2781)<\/p>\n
Dan Amodio discovered that OpenJDK did not restrict the use of CR and LF
\ncharacters in values for HTTP headers. An attacker could possibly use this
\nissue to insert, edit or obtain sensitive information. (CVE-2020-2800)<\/p>\n
Nils Emmerich discovered that OpenJDK incorrectly checked boundaries or
\nargument types. An attacker could possibly use this issue to bypass sandbox
\nrestrictions causing unspecified impact. (CVE-2020-2803, CVE-2020-2805)<\/p>\n
It was discovered that OpenJDK incorrectly handled application data packets
\nduring TLS handshake. An attacker could possibly use this issue to insert,
\nedit or obtain sensitive information. This issue only affected OpenJDK 11.
\n(CVE-2020-2816)<\/p>\n
It was discovered that OpenJDK incorrectly handled certain regular
\nexpressions. An attacker could possibly use this issue to cause a denial of
\nservice. (CVE-2020-2830)<\/p>\n
The problem can be corrected by updating your system to the following package versions:<\/p>\n
To update your system, please follow these instructions: https:\/\/wiki.ubuntu.com\/Security\/Upgrades<\/a>.<\/p>\n This update uses a new upstream release, which includes additional bug Source: USN-4337-1: OpenJDK vulnerabilities<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" USN-4337-1: OpenJDK vulnerabilities openjdk-8, openjdk-lts vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Summary Several security issues were fixed in OpenJDK. Software Description openjdk-8 – Open Source Java implementation openjdk-lts – Open Source Java implementation Details It was discovered that OpenJDK incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted regular expression. (CVE-2020-2754, CVE-2020-2755) It was discovered that OpenJDK incorrectly handled class descriptors and catching exceptions during object stream deserialization. An attacker could possibly use this issue to cause a denial of service while processing a specially crafted serialized input. (CVE-2020-2756, CVE-2020-2757) Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and Robert Merget discovered that OpenJDK incorrectly handled certificate messages during TLS handshake. [ more… ]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[586],"tags":[587],"class_list":["post-36424","post","type-post","status-publish","format-standard","hentry","category-ubuntu-usn","tag-ubuntu-usn"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/36424","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/comments?post=36424"}],"version-history":[{"count":1,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/36424\/revisions"}],"predecessor-version":[{"id":36425,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/posts\/36424\/revisions\/36425"}],"wp:attachment":[{"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/media?parent=36424"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/categories?post=36424"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jirak.net\/wp\/wp-json\/wp\/v2\/tags?post=36424"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nfixes. After a standard system update you need to restart any Java
\napplications or applets to make all the necessary changes.<\/p>\nReferences<\/h2>\n
\n