Bug 1760969 (CVE-2019-2975)

Summary: CVE-2019-2975 OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahughes, bkearney, dbhole, java-qa, jvanek, security-response-team, tlestach
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-12-03 01:04:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1754086, 1754087, 1754088, 1754089, 1754094, 1754095, 1754096, 1754097, 1754098, 1760981, 1760982, 1777848, 1777849, 1777850, 1777851, 1777852, 1778949    
Bug Blocks: 1753424    

Description Tomas Hoger 2019-10-11 20:35:38 UTC
It was discovered that the regular expression handling implementation in the Nashorn JavaScript engine in the Scripting component of OpenJDK could unexpectedly throw StackOverflowError exception when processing a specially crafted regular expression.  A JavaScript script could cause the Nashorn engine to exit by compiling a malicious regular expression.

Comment 1 Tomas Hoger 2019-10-15 20:56:39 UTC
Public now via Oracle CPU October 2019:

https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA

Fixed in Oracle Java SE 13.0.1, 11.0.5, and 8u231.

Comment 2 errata-xmlrpc 2019-10-16 14:18:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3128 https://access.redhat.com/errata/RHSA-2019:3128

Comment 3 errata-xmlrpc 2019-10-16 14:45:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:3127 https://access.redhat.com/errata/RHSA-2019:3127

Comment 4 errata-xmlrpc 2019-10-17 09:57:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3134 https://access.redhat.com/errata/RHSA-2019:3134

Comment 5 errata-xmlrpc 2019-10-17 09:58:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:3135 https://access.redhat.com/errata/RHSA-2019:3135

Comment 8 errata-xmlrpc 2019-10-17 14:27:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:3136 https://access.redhat.com/errata/RHSA-2019:3136

Comment 9 Tomas Hoger 2019-11-29 07:22:48 UTC
OpenJDK-11 upstream commit:
http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/5f4e2a53afc9

OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/nashorn/rev/fba077f48da2

Comment 10 Product Security DevOps Team 2019-12-03 01:04:52 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-2975

Comment 11 errata-xmlrpc 2019-12-09 08:56:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2019:4113 https://access.redhat.com/errata/RHSA-2019:4113

Comment 12 errata-xmlrpc 2019-12-09 13:26:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2019:4115 https://access.redhat.com/errata/RHSA-2019:4115

Comment 16 errata-xmlrpc 2020-01-02 14:01:50 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 5.8

Via RHSA-2020:0006 https://access.redhat.com/errata/RHSA-2020:0006

Comment 17 errata-xmlrpc 2020-01-07 15:10:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0046 https://access.redhat.com/errata/RHSA-2020:0046