Bug 1502640 (CVE-2017-10350)

Summary:	CVE-2017-10350 OpenJDK: unbounded memory allocation in JAXWSExceptionBase deserialization (JAX-WS, 8181100)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dbhole, jvanek, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-12-06 14:14:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1499213, 1499214, 1499215, 1499216, 1499223, 1499224, 1499225, 1499226, 1503325, 1503326, 1503327, 1503328, 1503329, 1503330, 1503331, 1503332, 1515469, 1515470, 1515471, 1515472, 1516384, 1516385, 1516386, 1516387
Bug Blocks:	1499210

Description Tomas Hoger 2017-10-16 11:33:48 UTC

It was discovered that the implementation of the JAXWSExceptionBase class in the JAX-WS component of OpenJDK did not limit the amount of memory allocated when creating object instance from a serialized form.  A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

Comment 2 Tomas Hoger 2017-10-17 20:54:23 UTC

Public now via Oracle CPU October 2017:

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixJAVA

The issue was fixed in Oracle JDK 9.0.1, 8u151, and 7u161.

Comment 5 Tomas Hoger 2017-10-18 09:50:24 UTC

OpenJDK-8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jaxws/rev/730acb5d508e

Comment 6 errata-xmlrpc 2017-10-20 11:34:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:2998 https://access.redhat.com/errata/RHSA-2017:2998

Comment 7 errata-xmlrpc 2017-10-23 07:49:38 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2017:2999 https://access.redhat.com/errata/RHSA-2017:2999

Comment 8 errata-xmlrpc 2017-10-24 12:19:32 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2017:3046 https://access.redhat.com/errata/RHSA-2017:3046

Comment 11 errata-xmlrpc 2017-11-27 18:06:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2017:3264 https://access.redhat.com/errata/RHSA-2017:3264

Comment 12 errata-xmlrpc 2017-11-28 20:41:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2017:3267 https://access.redhat.com/errata/RHSA-2017:3267

Comment 13 errata-xmlrpc 2017-11-28 20:44:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary
  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2017:3268 https://access.redhat.com/errata/RHSA-2017:3268

Comment 14 errata-xmlrpc 2017-12-06 13:44:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:3392 https://access.redhat.com/errata/RHSA-2017:3392

Comment 15 errata-xmlrpc 2017-12-13 16:55:48 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 5.8
  Red Hat Satellite 5.8 ELS

Via RHSA-2017:3453 https://access.redhat.com/errata/RHSA-2017:3453