Bugzilla will be upgraded to version 5.0 on December 2, 2018. The outage period for the upgrade will start at 0:00 UTC and have a duration of 12 hours
Bug 1639293 - (CVE-2018-3169) CVE-2018-3169 OpenJDK: Improper field access checks (Hotspot, 8199226)
CVE-2018-3169 OpenJDK: Improper field access checks (Hotspot, 8199226)
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Red Hat Product Security
impact=critical,public=20181016,repor...
: Security
Depends On:
Blocks: 1633819
  Show dependency treegraph
 
Reported: 2018-10-15 09:09 EDT by Tomas Hoger
Modified: 2018-11-14 12:44 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2942 None None None 2018-10-17 17:22 EDT
Red Hat Product Errata RHSA-2018:2943 None None None 2018-10-17 17:22 EDT
Red Hat Product Errata RHSA-2018:3000 None None None 2018-10-24 18:05 EDT
Red Hat Product Errata RHSA-2018:3001 None None None 2018-10-24 18:06 EDT
Red Hat Product Errata RHSA-2018:3002 None None None 2018-10-24 18:06 EDT
Red Hat Product Errata RHSA-2018:3003 None None None 2018-10-24 18:07 EDT
Red Hat Product Errata RHSA-2018:3350 None None None 2018-10-30 05:18 EDT
Red Hat Product Errata RHSA-2018:3409 None None None 2018-10-30 12:59 EDT
Red Hat Product Errata RHSA-2018:3521 None None None 2018-11-07 13:13 EST
Red Hat Product Errata RHSA-2018:3533 None None None 2018-11-09 06:49 EST
Red Hat Product Errata RHSA-2018:3534 None None None 2018-11-09 06:49 EST

  None (edit)
Description Tomas Hoger 2018-10-15 09:09:30 EDT
It was discovered that the Hotspot component of OpenJDK did not perform access checks correctly in certain cases when performing field link resolution.  An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Comment 1 Tomas Hoger 2018-10-16 16:52:40 EDT
Public now via Oracle CPU October 2018:

https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA

The issue was fixed in Oracle JDK 11.0.1, 8u191, and 7u201.
Comment 3 errata-xmlrpc 2018-10-17 17:21:56 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2942 https://access.redhat.com/errata/RHSA-2018:2942
Comment 4 errata-xmlrpc 2018-10-17 17:22:29 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:2943 https://access.redhat.com/errata/RHSA-2018:2943
Comment 5 Tomas Hoger 2018-10-19 16:32:33 EDT
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/3af740792979

OpenJDK-11 upstream commit:
http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/5370691ecaff
Comment 6 errata-xmlrpc 2018-10-24 18:05:35 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3000 https://access.redhat.com/errata/RHSA-2018:3000
Comment 7 errata-xmlrpc 2018-10-24 18:06:12 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3001 https://access.redhat.com/errata/RHSA-2018:3001
Comment 8 errata-xmlrpc 2018-10-24 18:06:48 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3002 https://access.redhat.com/errata/RHSA-2018:3002
Comment 9 errata-xmlrpc 2018-10-24 18:07:30 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3003 https://access.redhat.com/errata/RHSA-2018:3003
Comment 11 errata-xmlrpc 2018-10-30 05:18:14 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3350 https://access.redhat.com/errata/RHSA-2018:3350
Comment 12 errata-xmlrpc 2018-10-30 12:59:30 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:3409 https://access.redhat.com/errata/RHSA-2018:3409
Comment 13 errata-xmlrpc 2018-11-07 13:13:12 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3521 https://access.redhat.com/errata/RHSA-2018:3521
Comment 14 errata-xmlrpc 2018-11-09 06:49:06 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2018:3533 https://access.redhat.com/errata/RHSA-2018:3533
Comment 15 errata-xmlrpc 2018-11-09 06:49:38 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2018:3534 https://access.redhat.com/errata/RHSA-2018:3534

Note You need to log in before you can comment on or make changes to this bug.