RHSA-2020:2970: Important: java-11-openjdk security and enhancement update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.Security Fix(es): OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access (Libraries, 8238920) (CVE-2020-14583) OpenJDK: Incomplete bounds checks in Affine Transformations (2D, 8240119) (CVE-2020-14593) OpenJDK: Incorrect handling of access control context in ForkJoinPool (Libraries, 8237117) (CVE-2020-14556) OpenJDK: Excessive memory usage in ImageIO TIFF plugin (ImageIO, 8233239) (CVE-2020-14562) OpenJDK: Incomplete interface type checks in Graal compiler (Hotspot, 8236867) (CVE-2020-14573) OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature (JAXP, 8242136) (CVE-2020-14621) OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form (JSSE, 8237592) (CVE-2020-14577) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Enhancement(s): Add -static-libs subpackage with statically linked OpenJDK libraries (BZ#1848701)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-debuginfo-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-debugsource-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-demo-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-devel-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-devel-debuginfo-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-headless-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-headless-debuginfo-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-javadoc-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-javadoc-zip-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-jmods-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-src-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-static-libs-11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-debuginfo-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-debugsource-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-demo-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-devel-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-devel-debuginfo-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-headless-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-headless-debuginfo-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-javadoc-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-javadoc-zip-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-jmods-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-src-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-static-libs-11.0.8.10-0.el8_2.aa - Upgrade
Upgrade
java-11-openjdk packages (OpenJDK 11)to a version that resolves this vulnerability.Patch BZ#1848701 - Operational
Restart all running instances of OpenJDK Java after applying the java-11-openjdk update so the changes take effect.
Event History
Frequently Asked Questions
What is the significance of RHSA-2020:2970?
RHSA-2020:2970 addresses a vulnerability in OpenJDK 11 that allows a bypass of boundary checks in nio.Buffer due to concurrent access.
How do I fix the vulnerability RHSA-2020:2970?
To fix the vulnerability RHSA-2020:2970, update to the latest version of the java-11-openjdk package provided by Red Hat, specifically version 11-openjdk-11.0.8.10-0.el8_2 or later.
What systems are affected by RHSA-2020:2970?
The vulnerability RHSA-2020:2970 affects systems running the specified version of the java-11-openjdk packages on Red Hat Enterprise Linux 8.
What is the level of severity for RHSA-2020:2970?
The severity level for RHSA-2020:2970 is classified as moderate due to the nature of the vulnerabilities it addresses.
Is it safe to use OpenJDK 11 without applying the fix for RHSA-2020:2970?
Using OpenJDK 11 without applying the fix for RHSA-2020:2970 may expose systems to security risks and potential exploits related to the identified vulnerabilities.