CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
93.5%
CentOS Errata and Security Advisory CESA-2017:0269
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment
and the OpenJDK 7 Java Software Development Kit.
Security Fix(es):
This issue was addressed by introducing whitelists of classes that can be
deserialized by RMI registry or DCG. These whitelists can be customized using
the newly introduced sun.rmi.registry.registryFilter and
sun.rmi.transport.dgcFilter security properties.
Multiple flaws were discovered in the Libraries and Hotspot components in
OpenJDK. An untrusted Java application or applet could use these flaws to
completely bypass Java sandbox restrictions. (CVE-2017-3272, CVE-2017-3289)
A covert timing channel flaw was found in the DSA implementation in the
Libraries component of OpenJDK. A remote attacker could possibly use this flaw
to extract certain information about the used key via a timing side channel.
(CVE-2016-5548)
It was discovered that the Libraries component of OpenJDK accepted ECSDA
signatures using non-canonical DER encoding. This could cause a Java application
to accept signature in an incorrect format not accepted by other cryptographic
tools. (CVE-2016-5546)
It was discovered that the 2D component of OpenJDK performed parsing of iTXt
and zTXt PNG image chunks even when configured to ignore metadata. An attacker
able to make a Java application parse a specially crafted PNG image could cause
the application to consume an excessive amount of memory. (CVE-2017-3253)
It was discovered that the Libraries component of OpenJDK did not validate the
length of the object identifier read from the DER input before allocating memory
to store the OID. An attacker able to make a Java application decode a specially
crafted DER input could cause the application to consume an excessive amount of
memory. (CVE-2016-5547)
It was discovered that the JAAS component of OpenJDK did not use the correct
way to extract user DN from the result of the user search LDAP query. A
specially crafted user LDAP entry could cause the application to use an
incorrect DN. (CVE-2017-3252)
It was discovered that the Networking component of OpenJDK failed to properly
parse user info from the URL. A remote attacker could cause a Java application
to incorrectly parse an attacker supplied URL and interpret it differently from
other applications processing the same URL. (CVE-2016-5552)
Multiple flaws were found in the Networking components in OpenJDK. An
untrusted Java application or applet could use these flaws to bypass certain
Java sandbox restrictions. (CVE-2017-3261, CVE-2017-3231)
A flaw was found in the way the DES/3DES cipher was used as part of the
TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover
some plaintext data by capturing large amounts of encrypted traffic between
TLS/SSL server and client if the communication used a DES/3DES based
ciphersuite. (CVE-2016-2183)
This update mitigates the CVE-2016-2183 issue by adding 3DES cipher suites to
the list of legacy algorithms (defined using the jdk.tls.legacyAlgorithms
security property) so they are only used if connecting TLS/SSL client and server
do not share any other non-legacy cipher suite.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-February/084431.html
https://lists.centos.org/pipermail/centos-announce/2017-February/084432.html
https://lists.centos.org/pipermail/centos-announce/2017-February/084433.html
Affected packages:
java-1.7.0-openjdk
java-1.7.0-openjdk-accessibility
java-1.7.0-openjdk-demo
java-1.7.0-openjdk-devel
java-1.7.0-openjdk-headless
java-1.7.0-openjdk-javadoc
java-1.7.0-openjdk-src
Upstream details at:
https://access.redhat.com/errata/RHSA-2017:0269
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
93.5%