Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1639834 - (CVE-2018-3149) CVE-2018-3149 OpenJDK: Incomplete enforcement of the trustURLCodebase restriction (JNDI, 8199177)
CVE-2018-3149 OpenJDK: Incomplete enforcement of the trustURLCodebase restric...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20181016,repo...
: Security
Depends On:
Blocks: 1633819
  Show dependency tree / graph
 
Reported: 2018-10-16 13:30 EDT by Tomas Hoger
Modified: 2018-10-30 12:59 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2942 None None None 2018-10-17 17:22 EDT
Red Hat Product Errata RHSA-2018:2943 None None None 2018-10-17 17:23 EDT
Red Hat Product Errata RHSA-2018:3000 None None None 2018-10-24 18:06 EDT
Red Hat Product Errata RHSA-2018:3001 None None None 2018-10-24 18:06 EDT
Red Hat Product Errata RHSA-2018:3002 None None None 2018-10-24 18:07 EDT
Red Hat Product Errata RHSA-2018:3003 None None None 2018-10-24 18:08 EDT
Red Hat Product Errata RHSA-2018:3007 None None None 2018-10-24 17:39 EDT
Red Hat Product Errata RHSA-2018:3008 None None None 2018-10-24 17:39 EDT
Red Hat Product Errata RHSA-2018:3350 None None None 2018-10-30 05:18 EDT
Red Hat Product Errata RHSA-2018:3409 None None None 2018-10-30 12:59 EDT

  None (edit)
Description Tomas Hoger 2018-10-16 13:30:21 EDT 
It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property.  In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.
Comment 1 Tomas Hoger 2018-10-16 15:21:41 EDT 
The restriction on loading classes from remote URL and the com.sun.jndi.ldap.object.trustURLCodebase system property was introduced via this commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/255dcd4f19b6

as the fix for CVE-2009-1094.
Comment 2 Tomas Hoger 2018-10-16 16:55:01 EDT 
Public now via Oracle CPU October 2018:

https://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html#AppendixJAVA

The issue was fixed in Oracle JDK 11.0.1, 8u191, 7u201, and 6u211.
Comment 4 errata-xmlrpc 2018-10-17 17:22:18 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2942 https://access.redhat.com/errata/RHSA-2018:2942
Comment 5 errata-xmlrpc 2018-10-17 17:22:56 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:2943 https://access.redhat.com/errata/RHSA-2018:2943
Comment 6 Tomas Hoger 2018-10-19 16:33:02 EDT 
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/28d4d67065ab

OpenJDK-11 upstream commit:
http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e62c1f2ef2dd
Comment 7 errata-xmlrpc 2018-10-24 17:39:17 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3007 https://access.redhat.com/errata/RHSA-2018:3007
Comment 8 errata-xmlrpc 2018-10-24 17:39:53 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3008 https://access.redhat.com/errata/RHSA-2018:3008
Comment 9 errata-xmlrpc 2018-10-24 18:06:01 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3000 https://access.redhat.com/errata/RHSA-2018:3000
Comment 10 errata-xmlrpc 2018-10-24 18:06:35 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3001 https://access.redhat.com/errata/RHSA-2018:3001
Comment 11 errata-xmlrpc 2018-10-24 18:07:11 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7

Via RHSA-2018:3002 https://access.redhat.com/errata/RHSA-2018:3002
Comment 12 errata-xmlrpc 2018-10-24 18:07:54 EDT 
This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 6

Via RHSA-2018:3003 https://access.redhat.com/errata/RHSA-2018:3003
Comment 14 errata-xmlrpc 2018-10-30 05:18:50 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3350 https://access.redhat.com/errata/RHSA-2018:3350
Comment 15 errata-xmlrpc 2018-10-30 12:59:46 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:3409 https://access.redhat.com/errata/RHSA-2018:3409
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.