Bug 1053266 (CVE-2013-5896)
| Summary: | CVE-2013-5896 OpenJDK: com.sun.corba.se. should be restricted package (CORBA, 8025022) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahughes, dbhole, java-qa, jkurik, jvanek, omajid, pfrields |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | icedtea 2.4.4, icedtea 2.3.13, icedtea 1.12.8, icedtea 1.13.1 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-02-06 15:41:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1049945 | ||
|
Description
Tomas Hoger
2014-01-14 22:06:00 UTC
Public now via Oracle CPU January 2014. Fixed in Oracle JDK 7u51, 6u71 and 5.0u61. External References: http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html Related note in the release notes: http://www.oracle.com/technetwork/java/javase/7u51-relnotes-2085002.html Area:otherlibs/corba Synopsis:com.sun.corba.se.** should be on restricted package list. The JDK internal package com.sun.corba.se and its sub-packages have been added to the restricted package list and therefore cannot be used directly when running with a security manager. Workaround: Applications running with a security manager that make direct use of classes in these JDK internal packages, need to adjust their security policy to grant access. See Java Security Policy Files documentation. See 8021257. This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2014:0027 https://rhn.redhat.com/errata/RHSA-2014-0027.html This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2014:0026 https://rhn.redhat.com/errata/RHSA-2014-0026.html OpenJDK7 upstream commits: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/694ad155b344 http://hg.openjdk.java.net/jdk7u/jdk7u/corba/rev/f15d0e49b1d8 This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0030 https://rhn.redhat.com/errata/RHSA-2014-0030.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Via RHSA-2014:0097 https://rhn.redhat.com/errata/RHSA-2014-0097.html Fixed in: IcedTea7 2.3.13 and 2.4.4: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025800.html IcedTea6 1.12.8 and 1.13.1: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-January/025947.html OpenJDK 6 B30: http://mail.openjdk.java.net/pipermail/jdk6-dev/2014-January/003212.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0135 https://rhn.redhat.com/errata/RHSA-2014-0135.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2014:0134 https://rhn.redhat.com/errata/RHSA-2014-0134.html This issue has been addressed in following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 5 Via RHSA-2014:0414 https://rhn.redhat.com/errata/RHSA-2014-0414.html This issue has been addressed in following products: Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2014:0705 https://rhn.redhat.com/errata/RHSA-2014-0705.html This issue has been addressed in following products: Red Hat Network Satellite Server v 5.4 Red Hat Network Satellite Server v 5.5 Red Hat Satellite Server v 5.6 Via RHSA-2014:0982 https://rhn.redhat.com/errata/RHSA-2014-0982.html Mitigation: Applications running with a security manager that make direct use of classes in these JDK internal packages, need to adjust their security policy to grant access. See Java Security Policy Files documentation. |