Bug 1866497 (CVE-2019-17639)

Summary:	CVE-2019-17639 IBM JDK: Information disclosure via calls to System.arraycopy() with invalid length
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	java-qa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-10 19:27:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1865914, 1865915, 1865916, 1865917, 1865919, 1865920, 1865921, 1866314
Bug Blocks:	1838813

Description Tomas Hoger 2020-08-05 17:58:32 UTC

IBM JDK 7 SR10 FP70 (7.0.10.70), 7.1 SR4 FP70 (7.1.4.70), and 8 SR6 FP15 (8.0.6.15) fix a flaw described by upstream as:

Eclipse OpenJ9 could allow a remote attacker to obtain sensitive information, caused by the premature return of the current method with an undefined return value. By invoking the System.arraycopy method with a length longer than the length of the source or destination array can, an attacker could exploit this vulnerability to obtain sensitive information.

IBM also notes that this issue is only applicable to IBM JDK on AIX and Linux on the Power platform.

OpenJ9 upstream bug:

https://bugs.eclipse.org/bugs/show_bug.cgi?id=563998

References:

https://www.ibm.com/support/pages/node/6256562
https://developer.ibm.com/javasdk/support/security-vulnerabilities/#IBM_Security_Update_August_2020

Comment 1 errata-xmlrpc 2020-08-10 15:13:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:3386 https://access.redhat.com/errata/RHSA-2020:3386

Comment 2 errata-xmlrpc 2020-08-10 15:16:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2020:3388 https://access.redhat.com/errata/RHSA-2020:3388

Comment 3 errata-xmlrpc 2020-08-10 15:16:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2020:3387 https://access.redhat.com/errata/RHSA-2020:3387

Comment 4 Product Security DevOps Team 2020-08-10 19:27:41 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-17639

Comment 8 errata-xmlrpc 2020-12-16 15:20:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2020:5585 https://access.redhat.com/errata/RHSA-2020:5585