Bug 1790556 (CVE-2020-2590)

Summary: CVE-2020-2590 OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352)
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahughes, bkearney, dbhole, java-qa, jvanek, security-response-team, tlestach
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-27 15:49:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1785759, 1785762, 1785764, 1785767, 1789446, 1785757, 1785758, 1785760, 1785761, 1785763, 1785765, 1785766, 1789444, 1789445    
Bug Blocks: 1785754    

Description Tomas Hoger 2020-01-13 15:44:23 UTC
A flaw was found in the way the GssKrb5Base class in the Security component of OpenJDK validated properties of SASL messages included in Kerberos GSSAPI, omitting required token checks.  An remote attacker with ability to manipulate network traffic between server and client using Kerberos GSSAPI could possibly perform message modification that would not be detected during message decoding.

Comment 1 Tomas Hoger 2020-01-15 11:16:08 UTC
Public now via Oracle CPU January 2020:

https://www.oracle.com/security-alerts/cpujan2020.html#AppendixJAVA

Fixed in Oracle Java SE 13.0.2, 11.0.6, 8u241, and 7u251.

Comment 2 errata-xmlrpc 2020-01-16 13:02:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0128 https://access.redhat.com/errata/RHSA-2020:0128

Comment 3 errata-xmlrpc 2020-01-16 13:21:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0122 https://access.redhat.com/errata/RHSA-2020:0122

Comment 4 errata-xmlrpc 2020-01-21 03:02:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0157 https://access.redhat.com/errata/RHSA-2020:0157

Comment 5 errata-xmlrpc 2020-01-21 23:00:47 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0196 https://access.redhat.com/errata/RHSA-2020:0196

Comment 6 errata-xmlrpc 2020-01-22 13:04:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0202 https://access.redhat.com/errata/RHSA-2020:0202

Comment 7 errata-xmlrpc 2020-01-27 08:54:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0231 https://access.redhat.com/errata/RHSA-2020:0231

Comment 8 errata-xmlrpc 2020-01-27 08:55:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0232 https://access.redhat.com/errata/RHSA-2020:0232

Comment 13 errata-xmlrpc 2020-02-18 15:28:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0541 https://access.redhat.com/errata/RHSA-2020:0541

Comment 16 errata-xmlrpc 2020-02-27 15:27:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0632 https://access.redhat.com/errata/RHSA-2020:0632

Comment 17 Product Security DevOps Team 2020-02-27 15:49:39 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-2590