Bug 1483736 (CVE-2017-1376)

Summary:	CVE-2017-1376 IBM JDK: class verifier allowing Security Manager bypass
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	bkearney, ggainey, jvanek, meissner, taw, thomas, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-23 09:45:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1466515

Description Tomas Hoger 2017-08-21 20:05:35 UTC

IBM JDK security update from August 2017 fixes documents one security issue specific to IBM JDKs:

https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_August_2017

CVE-2017-1376, fixed in versions 6.1.8.50, 7.0.10.10, 7.1.4.10, and 8.0.4.5.

The above Security Vulnerabilities page links the following page for further details:

http://www-01.ibm.com/support/docview.wss?uid=swg22006695

However, the linked page is not currently available.

The CVE can be found mentioned in the "Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Operations Analytics Predictive Insights" document at:

http://www-01.ibm.com/support/docview.wss?uid=swg22007305

CVEID: CVE-2017-1376
DESCRIPTION: A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/126873 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Comment 1 Tomas Hoger 2017-09-18 19:21:23 UTC

(In reply to Tomas Hoger from comment #0)
> https://developer.ibm.com/javasdk/support/security-vulnerabilities/
> #IBM_Security_Update_August_2017
> 
> CVE-2017-1376, fixed in versions 6.1.8.50, 7.0.10.10, 7.1.4.10, and 8.0.4.5.

The upstream security page was updated to note that IBM JDK 8 was fixed in version 8.0.4.7.