Security Fix(es) :

  - OpenJDK: Side-channel attack risks in Elliptic Curve     (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in     deserialization (Utilities, 8212328) (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during     deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Missing URL format validation (Networking,     8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers     (JCE, 8223511) (CVE-2019-2842)

  - OpenJDK: Insufficient restriction of privileges in     AccessController (Security, 8216381) (CVE-2019-2786)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1816 advisory.

    [1:1.8.0.222.b10-0]
    - Update to aarch64-shenandoah-jdk8u222-b10.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b09-0]
    - Update to aarch64-shenandoah-jdk8u222-b09.
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b08-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b08.
    - Adjust PR3083/RH134640 to apply after JDK-8182999
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b07-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b06-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b06.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b05-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b05.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b04-0.0.ea]
    - Update new format sources file.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b04-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b04.
    - Drop remaining JDK-8210425/RH1632174 patch now AArch64 part is upstream.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b03-0.1.ea]
    - Update to aarch64-shenandoah-jdk8u222-b03.
    - Drop 8210425 patches applied upstream. Still need to add AArch64 version in aarch64/shenandoah-jdk8u.
    - Re-generate JDK-8141570 & JDK-8143245 patches due to 8210425 zeroshark.make changes.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b02-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u222-b02.
    - Drop 8064786/PR3599 & 8210416/RH1632174 as applied upstream (8064786 silently in 8176100).
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-1]
    - Switch to EA mode
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-1]
    - Allow Recommends and Suggests on Fedora platforms too.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-0]
    - Make use of Recommends and Suggests dependent on RHEL 8+ environment.
    - Resolves: rhbz#1724452

    [1:1.8.0.222.b01-0]
    - Update to aarch64-shenandoah-jdk8u222-b01.
    - Refactor PR2888 after inclusion of 8129988 upstream. Now includes PR3575.
    - Drop 8171000 & 8197546 as applied upstream.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Fix value of built_doc_archive for javadoc debug package.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Drop unused use_shenandoah_hotspot variable.
    - Resolves: rhbz#1724452

    [1:1.8.0.212.b04-2]
    - Update to aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30.
    - Update version logic to handle -shenandoah* tag suffix.
    - Drop PR3634 as applied upstream.
    - Adjust 8214206 fix for S390 as BinaryMagnitudeSeq moved to shenandoahNumberSeq.cpp
    - Update 8214206 to use log2_long rather than casting to intptr_t, which may be smaller than size_t.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-7317: Improve PNG support options (bsc#1141780).

CVE-2019-2818: Better Poly1305 support (bsc#1141788).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2821: Improve TLS negotiation (bsc#1141781).

Certificate validation improvements

Non-security issues fixed: Do not fail installation when the manpages are not present (bsc#1115375)

Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2842: Extended AES support (bsc#1141786).

CVE-2019-7317: Improve PNG support (bsc#1141780).

Certificate validation improvements

Non-security issue fixed: Fixed an issue where the installation failed when the manpages are not present (bsc#1115375)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for java-1_8_0-openjdk to version 8u222 fixes the following issues :

Security issues fixed :

  - CVE-2019-2745: Improved ECC Implementation     (bsc#1141784).

  - CVE-2019-2762: Exceptional throw cases (bsc#1141782).

  - CVE-2019-2766: Improve file protocol handling     (bsc#1141789).

  - CVE-2019-2769: Better copies of CopiesList     (bsc#1141783).

  - CVE-2019-2786: More limited privilege usage     (bsc#1141787).

  - CVE-2019-2816: Normalize normalization (bsc#1141785).

  - CVE-2019-2842: Extended AES support (bsc#1141786).

  - CVE-2019-7317: Improve PNG support (bsc#1141780).

  - Certificate validation improvements

Non-security issue fixed :

  - Fixed an issue where the installation failed when the     manpages are not present (bsc#1115375)

This update was imported from the SUSE:SLE-15:Update update project.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1816 advisory.

  - OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - OpenJDK: Missing array bounds check in crypto providers (JCE, 8223511) (CVE-2019-2842)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 8 < 8.222.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2019-Jul-16 advisory.

  - Security (CVE-2019-2745, CVE-2019-2786)

  - Utilities (CVE-2019-2762, CVE-2019-2769)

  - Networking (CVE-2019-2766, CVE-2019-2816)

  - JCE (CVE-2019-2842)

  - AWT (libpng) (CVE-2019-7317)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
126974	Scientific Linux Security Update : java-1.7.0-openjdk on SL6.x i386/x86_64 (20190723)	Nessus	Scientific Linux Local Security Checks	2019/7/24	2024/5/8	medium
127034	Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20190724)	Nessus	Scientific Linux Local Security Checks	2019/7/25	2024/5/8	medium
127601	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2019-1816)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/10/22	medium
127745	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:2002-1)	Nessus	SuSE Local Security Checks	2019/8/12	2025/2/24	medium
127762	SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2019:2036-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	medium
128004	openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2019-1912)	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	medium
145650	CentOS 8 : java-1.8.0-openjdk (CESA-2019:1816)	Nessus	CentOS Local Security Checks	2021/1/29	2022/5/11	medium
159424	Amazon Corretto Java 8.x < 8.222.10.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/1	2023/11/3	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium