Bug 1534298 (CVE-2018-2579)

Summary: CVE-2018-2579 OpenJDK: unsynchronized access to encryption key data (Libraries, 8172525)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dbhole, jvanek, security-response-team, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
It was discovered that multiple encryption key classes in the Libraries component of OpenJDK did not properly synchronize access to their internal data. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of the use of a key that was zeroed out.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-03-14 15:40:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1528238, 1528239, 1528240, 1528241, 1528243, 1528244, 1528245, 1528246, 1535085, 1535086, 1535087, 1535088, 1535089, 1535090, 1535091, 1535092, 1535104, 1535105, 1535106, 1535107, 1546135, 1546136, 1546137, 1546138, 1546140, 1546141, 1546142, 1546143, 1549401, 1549402    
Bug Blocks: 1528235    

Description Tomas Hoger 2018-01-14 22:23:03 UTC
It was discovered that multiple encryption key classes (DESKey, DESedeKey, PBEKey, PBKDF2KeyImpl) in the crypto provider in the Libraries component of OpenJDK did not properly synchronize access to their internal key data from multiple threads.  This could possibly cause a multi-threaded Java application to apply weak encryption to data because of use of key that was zeroed out during object finalization.

Comment 1 Tomas Hoger 2018-01-16 21:39:13 UTC
Public now via Oracle CPU January 2018:

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA

The issue was fixed in Oracle JDK 9.0.4, 8u161, 7u171, and 6u181.

Comment 2 errata-xmlrpc 2018-01-17 17:34:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2018:0095 https://access.redhat.com/errata/RHSA-2018:0095

Comment 3 errata-xmlrpc 2018-01-18 21:56:46 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:0099 https://access.redhat.com/errata/RHSA-2018:0099

Comment 4 errata-xmlrpc 2018-01-18 21:59:47 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:0100 https://access.redhat.com/errata/RHSA-2018:0100

Comment 5 errata-xmlrpc 2018-01-22 20:41:39 UTC
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:0115 https://access.redhat.com/errata/RHSA-2018:0115

Comment 6 Tomas Hoger 2018-01-23 13:04:26 UTC
OpenJDK-8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/521f330bda2f

Comment 7 errata-xmlrpc 2018-02-26 21:32:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2018:0351 https://access.redhat.com/errata/RHSA-2018:0351

Comment 8 errata-xmlrpc 2018-02-26 21:37:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2018:0352 https://access.redhat.com/errata/RHSA-2018:0352

Comment 9 errata-xmlrpc 2018-02-26 22:20:47 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2018:0349 https://access.redhat.com/errata/RHSA-2018:0349

Comment 12 errata-xmlrpc 2018-03-07 10:33:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2018:0458 https://access.redhat.com/errata/RHSA-2018:0458

Comment 13 errata-xmlrpc 2018-03-14 15:23:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2018:0521 https://access.redhat.com/errata/RHSA-2018:0521

Comment 14 errata-xmlrpc 2018-05-15 15:31:26 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 5.8

Via RHSA-2018:1463 https://access.redhat.com/errata/RHSA-2018:1463

Comment 15 errata-xmlrpc 2018-06-07 16:04:45 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 5.6
  Red Hat Satellite 5.7

Via RHSA-2018:1812 https://access.redhat.com/errata/RHSA-2018:1812