An update of the openjdk package has been released.

# July 2020 OpenJDK security update for OpenJDK 11 Full release notes:
https://bitly.com/openjdk1108

## Security fixes

  - JDK-8230613: Better ASCII conversions

  - JDK-8231800: Better listing of arrays

  - JDK-8232014: Expand DTD support

  - JDK-8233234: Better Zip Naming

  - JDK-8233239, CVE-2020-14562: Enhance TIFF support

  - JDK-8233255: Better Swing Buttons

  - JDK-8234032: Improve basic calendar services

  - JDK-8234042: Better factory production of certificates

  - JDK-8234418: Better parsing with CertificateFactory

  - JDK-8234836: Improve serialization handling

  - JDK-8236191: Enhance OID processing

  - JDK-8236867, CVE-2020-14573: Enhance Graal interface     handling

  - JDK-8237117, CVE-2020-14556: Better ForkJoinPool     behavior

  - JDK-8237592, CVE-2020-14577: Enhance certificate     verification

  - JDK-8238002, CVE-2020-14581: Better matrix operations

  - JDK-8238013: Enhance String writing

  - JDK-8238804: Enhance key handling process

  - JDK-8238842: AIOOBE in     GIFImageReader.initializeStringTable

  - JDK-8238843: Enhanced font handing

  - JDK-8238920, CVE-2020-14583: Better Buffer support

  - JDK-8238925: Enhance WAV file playback

  - JDK-8240119, CVE-2020-14593: Less Affine Transformations

  - JDK-8240482: Improved WAV file playback

  - JDK-8241379: Update JCEKS support

  - JDK-8241522: Manifest improved jar headers redux

  - JDK-8242136, CVE-2020-14621: Better XML namespace     handling

## [JDK-8244167](https://bugs.openjdk.java.net/browse/JDK-8244167):
Removal of Comodo Root CA Certificate

The following expired Comodo root CA certificate was removed from the `cacerts` keystore: + alias name 'addtrustclass1ca [jdk]'

Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE

## [JDK-8244166](https://bugs.openjdk.java.net/browse/JDK-8244166):
Removal of DocuSign Root CA Certificate

The following expired DocuSign root CA certificate was removed from the `cacerts` keystore: + alias name 'keynectisrootca [jdk]'

Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR

## [JDK-8240191](https://bugs.openjdk.java.net/browse/JDK-8240191):
Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database

The SunPKCS11 security provider can now be initialized with NSS when FIPS-enabled external modules are configured in the Security Modules Database (NSSDB). Prior to this change, the SunPKCS11 provider would throw a RuntimeException with the message: 'FIPS flag set for non-internal module' when such a library was configured for NSS in non-FIPS mode.

This change allows the JDK to work properly with recent NSS releases in GNU/Linux operating systems when the system-wide FIPS policy is turned on.

Further information can be found in [JDK-8238555](https://bugs.openjdk.java.net/browse/JDK-8238555).

## [JDK-8245077](https://bugs.openjdk.java.net/browse/JDK-8245077):
Default SSLEngine Should Create in Server Role

In JDK 11 and later, `javax.net.ssl.SSLEngine` by default used client mode when handshaking. As a result, the set of default enabled protocols may differ to what is expected. `SSLEngine` would usually be used in server mode. From this JDK release onwards, `SSLEngine` will default to server mode. The `javax.net.ssl.SSLEngine.setUseClientMode(boolean mode)` method may be used to configure the mode.

## [JDK-8242147](https://bugs.openjdk.java.net/browse/JDK-8242147):
New System Properties to Configure the TLS Signature Schemes

Two new System Properties are added to customize the TLS signature schemes in JDK. `jdk.tls.client.SignatureSchemes` is added for TLS client side, and `jdk.tls.server.SignatureSchemes` is added for server side.

Each System Property contains a comma-separated list of supported signature scheme names specifying the signature schemes that could be used for the TLS connections.

The names are described in the 'Signature Schemes' section of the

*Java Security Standard Algorithm Names Specification*.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639

  - Class Libraries :

  - JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW     JAVA.LANG.INTERNALERROR

  - JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA     HEAP

  - TRANSLATION MESSAGES UPDATE FOR JCL

  - UPDATE TIMEZONE INFORMATION TO TZDATA2020A

  - Java Virtual Machine :

  - IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT

  - LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT

  - JIT Compiler :

  - CRASH IN THE INTERPRETER AFTER OSR FROM INLINED     SYNCHRONIZED METHOD IN DEBUGGING MODE

  - INTERMITTENT ASSERTION FAILURE REPORTED

  - CRASH IN RESOLVECLASSREF() DURING AOT LOAD

  - JIT CRASH DURING CLASS UNLOADING IN     J9METHOD_HT::ONCLASSUNLOADING()

  - SEGMENTATION FAULT WHILE COMPILING A METHOD

  - UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL     PARALLEL APPLICATION ON IBM Z PLATFORM

  - Security :

  - CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY     SET TO NON DEFAULT VALUE

  - CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS

  - IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED,     WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE

  - IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS     EXCEPTION FROM KEYFACTORY CLASS

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
139080	Photon OS 1.0: Openjdk PHSA-2020-1.0-0310	Nessus	PhotonOS Local Security Checks	2020/7/29	2022/5/12	high
139104	Fedora 31 : 1:java-11-openjdk (2020-93cc9c3ef2)	Nessus	Fedora Local Security Checks	2020/7/30	2024/2/27	high
140257	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2020:2461-1)	Nessus	SuSE Local Security Checks	2020/9/4	2024/11/29	medium
143318	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2020-2048)	Nessus	SuSE Local Security Checks	2020/11/30	2024/2/7	high

检测

插件搜索

high

high

medium

high