Bug 1700440 (CVE-2019-2602)

Summary: CVE-2019-2602 OpenJDK: Slow conversion of BigDecimal to long (Libraries, 8211936)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahughes, bkearney, dbhole, java-qa, jvanek, msiddiqu, security-response-team, tlestach, yozone
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:54:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1693471, 1693472, 1693473, 1693474, 1693475, 1695906, 1695907, 1695908, 1695909, 1698440, 1698441, 1698445, 1704238, 1704239, 1704240, 1704241, 1704242, 1704243, 1704244, 1704245, 1708139    
Bug Blocks: 1693469    

Description Tomas Hoger 2019-04-16 14:59:24 UTC
A flaw was found in the BigDecimal implementation in the Libraries component of OpenJDK.  An untrusted numeric value parsed by a Java application could the application to use an excessive amount of CPU time.

Comment 1 Tomas Hoger 2019-04-16 22:02:31 UTC
Public now via Oracle CPU April 2019:

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html#AppendixJAVA

Fixed in Oracle Java 12.0.1, 11.0.3, 8u211, and 7u221.

Comment 2 errata-xmlrpc 2019-04-17 15:37:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:0774 https://access.redhat.com/errata/RHSA-2019:0774

Comment 3 errata-xmlrpc 2019-04-17 15:37:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0775 https://access.redhat.com/errata/RHSA-2019:0775

Comment 4 errata-xmlrpc 2019-04-17 16:04:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0778 https://access.redhat.com/errata/RHSA-2019:0778

Comment 5 Tomas Hoger 2019-04-17 19:57:10 UTC
OpenJDK-11 upstream commit:

http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/59610bddd37a

OpenJDK-8 upstream commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/83c656d64088

Comment 6 errata-xmlrpc 2019-04-22 14:30:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:0790 https://access.redhat.com/errata/RHSA-2019:0790

Comment 7 errata-xmlrpc 2019-04-22 14:30:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0791 https://access.redhat.com/errata/RHSA-2019:0791

Comment 8 errata-xmlrpc 2019-05-13 07:01:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1146 https://access.redhat.com/errata/RHSA-2019:1146

Comment 9 errata-xmlrpc 2019-05-13 21:07:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2019:1163 https://access.redhat.com/errata/RHSA-2019:1163

Comment 10 errata-xmlrpc 2019-05-13 21:07:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2019:1164 https://access.redhat.com/errata/RHSA-2019:1164

Comment 11 errata-xmlrpc 2019-05-13 21:08:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2019:1165 https://access.redhat.com/errata/RHSA-2019:1165

Comment 12 errata-xmlrpc 2019-05-13 21:08:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2019:1166 https://access.redhat.com/errata/RHSA-2019:1166

Comment 13 errata-xmlrpc 2019-05-16 13:25:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1238 https://access.redhat.com/errata/RHSA-2019:1238

Comment 16 errata-xmlrpc 2019-06-04 13:24:47 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 5.8

Via RHSA-2019:1325 https://access.redhat.com/errata/RHSA-2019:1325

Comment 18 errata-xmlrpc 2019-06-18 17:19:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1518 https://access.redhat.com/errata/RHSA-2019:1518