Bug 1790944 (CVE-2020-2604)
| Summary: | CVE-2020-2604 OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | ahughes, bkearney, dbhole, java-qa, jvanek, security-response-team, tlestach, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: |
A flaw was found in the serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-02-27 15:49:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1785757, 1785758, 1785759, 1785760, 1785761, 1785762, 1785763, 1785764, 1785765, 1785766, 1785767, 1789444, 1789445, 1789446, 1796801, 1796802, 1796803, 1796804, 1796805, 1796806, 1796807, 1796808, 1799108, 1803860, 1803861 | ||
| Bug Blocks: | 1785754 | ||
|
Description
Tomas Hoger
2020-01-14 15:09:09 UTC
This change is documented in the release notes for Oracle Java SE 13.0.2, 11.0.6, 8u241, and 7u251 as: """ core-libs/java.io:serialization ➜ Better Serial Filter Handling The jdk.serialFilter system property can only be set on the command line. If the filter has not been set on the command line, it can be set can be set with java.io.ObjectInputFilter.Config.setSerialFilter. Setting the jdk.serialFilter with java.lang.System.setProperty has no effect. """ https://www.oracle.com/technetwork/java/javase/13-0-2-relnotes-5812268.html https://www.oracle.com/technetwork/java/javase/11-0-6-oracle-relnotes-5813175.html https://www.oracle.com/technetwork/java/javase/8u241-relnotes-5813177.html https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_251 Public now via Oracle CPU January 2020: https://www.oracle.com/security-alerts/cpujan2020.html#AppendixJAVA Fixed in Oracle Java SE 13.0.2, 11.0.6, 8u241, and 7u251. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:0128 https://access.redhat.com/errata/RHSA-2020:0128 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0122 https://access.redhat.com/errata/RHSA-2020:0122 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:0157 https://access.redhat.com/errata/RHSA-2020:0157 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0196 https://access.redhat.com/errata/RHSA-2020:0196 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:0202 https://access.redhat.com/errata/RHSA-2020:0202 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:0231 https://access.redhat.com/errata/RHSA-2020:0231 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:0232 https://access.redhat.com/errata/RHSA-2020:0232 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:0465 https://access.redhat.com/errata/RHSA-2020:0465 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2020:0467 https://access.redhat.com/errata/RHSA-2020:0467 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2020:0469 https://access.redhat.com/errata/RHSA-2020:0469 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2020:0468 https://access.redhat.com/errata/RHSA-2020:0468 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2020:0470 https://access.redhat.com/errata/RHSA-2020:0470 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:0541 https://access.redhat.com/errata/RHSA-2020:0541 OpenJDK-7 upstream commit: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/bd2168874bbd OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/decb51098c77 OpenJDK-11 upstream commit: http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/4c2769189ed5 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:0632 https://access.redhat.com/errata/RHSA-2020:0632 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-2604 External References: https://www.oracle.com/technetwork/java/javase/13-0-2-relnotes-5812268.html https://www.oracle.com/technetwork/java/javase/11-0-6-oracle-relnotes-5813175.html https://www.oracle.com/technetwork/java/javase/8u241-relnotes-5813177.html https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_251 This issue has been addressed in the following products: Red Hat Satellite 5.8 Via RHSA-2020:0856 https://access.redhat.com/errata/RHSA-2020:0856 |