Bugzilla will be upgraded to version 5.0 on December 2, 2018. The outage period for the upgrade will start at 0:00 UTC and have a duration of 12 hours
Bug 1639442 - (CVE-2018-3139) CVE-2018-3139 OpenJDK: Leak of sensitive header data via HTTP redirect (Networking, 8196902)
CVE-2018-3139 OpenJDK: Leak of sensitive header data via HTTP redirect (Netwo...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20181016,repor...
: Security
Depends On:
Blocks: 1633819
  Show dependency treegraph
 
Reported: 2018-10-15 14:07 EDT by Tomas Hoger
Modified: 2018-11-14 12:45 EST (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2942 None None None 2018-10-17 17:22 EDT
Red Hat Product Errata RHSA-2018:2943 None None None 2018-10-17 17:22 EDT
Red Hat Product Errata RHSA-2018:3000 None None None 2018-10-24 18:05 EDT
Red Hat Product Errata RHSA-2018:3001 None None None 2018-10-24 18:06 EDT
Red Hat Product Errata RHSA-2018:3002 None None None 2018-10-24 18:07 EDT
Red Hat Product Errata RHSA-2018:3003 None None None 2018-10-24 18:07 EDT
Red Hat Product Errata RHSA-2018:3007 None None None 2018-10-24 17:39 EDT
Red Hat Product Errata RHSA-2018:3008 None None None 2018-10-24 17:39 EDT
Red Hat Product Errata RHSA-2018:3350 None None None 2018-10-30 05:18 EDT
Red Hat Product Errata RHSA-2018:3409 None None None 2018-10-30 12:59 EDT
Red Hat Product Errata RHSA-2018:3521 None None None 2018-11-07 13:13 EST
Red Hat Product Errata RHSA-2018:3533 None None None 2018-11-09 06:49 EST
Red Hat Product Errata RHSA-2018:3534 None None None 2018-11-09 06:49 EST

  None (edit)
Description Tomas Hoger 2018-10-15 14:07:49 EDT
An information leak flaw was found in the Networking component of OpenJDK.  The HttpURLConnection class implementation could re-send HTTP headers containing sensitive data (such as Cookie or Authorization headers) to a different host when following HTTP redirects.  This could lead to exposure of data to unintended HTTP hosts.
Comment 1 Tomas Hoger 2018-10-16 15:39:35 EDT
A related entry in the Oracle JDK 11.0.1, 8u191, 7u201, and 6u211:

  core-libs
  Better HTTP Redirection Support 

  In this release, the behavior of methods which application code uses to
  set request properties in java.net.HttpURLConnection has changed. When a
  redirect occurs automatically from the original destination server to a
  resource on a different server, then all such properties are cleared for
  the redirect and any subsequent redirects. If these properties are required
  to be set on the redirected requests, then the redirect responses should be
  handled by the application by calling
  HttpURLConnection.setInstanceFollowRedirects(false) for the original
  request.

  JDK-8196902 (not public)

https://www.oracle.com/technetwork/java/javase/11-0-1-relnotes-5032023.html
https://www.oracle.com/technetwork/java/javase/8u191-relnotes-5032181.html
https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_201
https://www.oracle.com/technetwork/java/javase/documentation/overview-156328.html#R160_211
Comment 2 Tomas Hoger 2018-10-16 17:01:36 EDT
Public now via Oracle CPU October 2018:

https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA

The issue was fixed in Oracle JDK 11.0.1, 8u191, 7u201, and 6u211.
Comment 4 errata-xmlrpc 2018-10-17 17:22:08 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2942 https://access.redhat.com/errata/RHSA-2018:2942
Comment 5 errata-xmlrpc 2018-10-17 17:22:40 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:2943 https://access.redhat.com/errata/RHSA-2018:2943
Comment 6 Tomas Hoger 2018-10-19 16:34:30 EDT
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/791a21c79ab0

OpenJDK-11 upstream commit:
http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/11c8538d53a7
Comment 7 errata-xmlrpc 2018-10-24 17:39:06 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3007 https://access.redhat.com/errata/RHSA-2018:3007
Comment 8 errata-xmlrpc 2018-10-24 17:39:40 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3008 https://access.redhat.com/errata/RHSA-2018:3008
Comment 9 errata-xmlrpc 2018-10-24 18:05:48 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3000 https://access.redhat.com/errata/RHSA-2018:3000
Comment 10 errata-xmlrpc 2018-10-24 18:06:27 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3001 https://access.redhat.com/errata/RHSA-2018:3001
Comment 11 errata-xmlrpc 2018-10-24 18:06:59 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3002 https://access.redhat.com/errata/RHSA-2018:3002
Comment 12 errata-xmlrpc 2018-10-24 18:07:41 EDT
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3003 https://access.redhat.com/errata/RHSA-2018:3003
Comment 14 errata-xmlrpc 2018-10-30 05:18:26 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3350 https://access.redhat.com/errata/RHSA-2018:3350
Comment 15 errata-xmlrpc 2018-10-30 12:59:32 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:3409 https://access.redhat.com/errata/RHSA-2018:3409
Comment 16 errata-xmlrpc 2018-11-07 13:13:15 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3521 https://access.redhat.com/errata/RHSA-2018:3521
Comment 17 errata-xmlrpc 2018-11-09 06:49:10 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2018:3533 https://access.redhat.com/errata/RHSA-2018:3533
Comment 18 errata-xmlrpc 2018-11-09 06:49:46 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2018:3534 https://access.redhat.com/errata/RHSA-2018:3534

Note You need to log in before you can comment on or make changes to this bug.