It was discovered that crypto provider implementations in the JCE component of OpenJDK for crypto algorithms such as AES or SHA did not perform array bounds checks. This could lead to out-of-bounds access if compiler intrinsics were used instead of the Java runtime implementations of the specific operations.
Public now via Oracle CPU July 2019: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html#AppendixJAVA Fixed in Oracle Java SE 8u221.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:1811 https://access.redhat.com/errata/RHSA-2019:1811
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1815 https://access.redhat.com/errata/RHSA-2019:1815
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2019:1816 https://access.redhat.com/errata/RHSA-2019:1816
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:1840 https://access.redhat.com/errata/RHSA-2019:1840
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1839 https://access.redhat.com/errata/RHSA-2019:1839
OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/rev/55f693ba975d http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/bdf644065d87 OpenJDK-7 upstream commit: http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/f9541fe46eae http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d15ed96035d0