Bug 1738559 (CVE-2019-11771)

Summary:	CVE-2019-11771 IBM JDK: Insecure RPATH in OpenJ9 on AIX
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, java-qa, tlestach
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-07 13:14:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1724463

Description Tomas Hoger 2019-08-07 13:12:25 UTC

IBM JDK 7 SR10 FP50 (7.0.10.50), 7.1 SR4 FP50 (7.1.4.50), and 8 SR5 FP40 (8.0.5.40) fix a flaw described by upstream as:

Eclipse OpenJ9 could allow a local attacker to gain elevated privileges on the system, caused by the inclusion of unused RPATHS in AIX builds. An attacker could exploit this vulnerability to inject code and gain elevated privileges on the system.

OpenJ9 upstream bug:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=548055
References:

https://www-01.ibm.com/support/docview.wss?uid=ibm10960422
https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_July_2019

Comment 1 Tomas Hoger 2019-08-07 13:14:26 UTC

Upstream indicates this only affected IBM JDK builds for the IBM AIX platform and hence did not affect Linux builds.

Comment 2 Tomas Hoger 2019-08-07 13:14:30 UTC

Statement:

This issue did not affect the Linux builds of IBM JDK, only version for AIX operating system were affected.