Bug 1443007 (CVE-2017-3511)

Summary:	CVE-2017-3511 OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dbhole, jvanek, security-response-team, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-05-10 13:47:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1438752

Description Tomas Hoger 2017-04-18 09:36:35 UTC

A untrusted library search path flaw was found in the JCE (Java Cryptography Extension) component of OpenJDK, caused by a problem with the handling of paths to extension directories in the sun.misc.Launcher class.  A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and therefore escalate their privileges.

Comment 1 Tomas Hoger 2017-04-18 22:17:39 UTC

Public now via Oracle CPU April 20167, fixed in Oracle JDK 8u131 and 7u141.

External References:

http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html#AppendixJAVA

Comment 2 Tomas Hoger 2017-04-19 11:31:14 UTC

OpenJDK8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/af0e709d28f9

Comment 3 errata-xmlrpc 2017-04-20 19:27:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:1109 https://access.redhat.com/errata/RHSA-2017:1109

Comment 4 errata-xmlrpc 2017-04-21 02:11:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1108 https://access.redhat.com/errata/RHSA-2017:1108

Comment 5 errata-xmlrpc 2017-04-24 11:17:07 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:1118 https://access.redhat.com/errata/RHSA-2017:1118

Comment 6 errata-xmlrpc 2017-04-24 11:18:02 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:1117 https://access.redhat.com/errata/RHSA-2017:1117

Comment 7 errata-xmlrpc 2017-05-09 10:47:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1204 https://access.redhat.com/errata/RHSA-2017:1204

Comment 8 errata-xmlrpc 2017-05-10 12:48:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1221 https://access.redhat.com/errata/RHSA-2017:1221

Comment 9 errata-xmlrpc 2017-05-10 12:51:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary
  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:1220 https://access.redhat.com/errata/RHSA-2017:1220

Comment 10 errata-xmlrpc 2017-12-13 16:50:40 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 5.8
  Red Hat Satellite 5.8 ELS

Via RHSA-2017:3453 https://access.redhat.com/errata/RHSA-2017:3453