It was discovered that the ProcessImpl class implementation for the Windows platform in the Libraries component of OpenJDK did not properly perform escaping of special characters in arguments for the command to be started. This could possibly allow an attacker to cause an external process to be started with unexpected arguments. This issue only affected OpenJDK for the Microsoft Windows platform. Linux builds were not affected by this issue.
Public via Oracle CPU October 2019: https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA Fixed in Oracle Java SE 13.0.1, 11.0.5, 8u231, and 7u241.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-2958
OpenJDK-11 upstream commit: http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/a2ddb1a585cf OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/9e42cbb6a9ed OpenJDK-7 upstream commit: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/07674ab552ee