5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.8%
This update for java-1_8_0-ibm fixes the following issues :
Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259, bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579 CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593 CVE-2020-14583 CVE-2019-17639
Class Libraries :
JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW JAVA.LANG.INTERNALERROR
JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA HEAP
TRANSLATION MESSAGES UPDATE FOR JCL
UPDATE TIMEZONE INFORMATION TO TZDATA2020A
Java Virtual Machine :
IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
JIT Compiler :
CRASH IN THE INTERPRETER AFTER OSR FROM INLINED SYNCHRONIZED METHOD IN DEBUGGING MODE
INTERMITTENT ASSERTION FAILURE REPORTED
CRASH IN RESOLVECLASSREF() DURING AOT LOAD
JIT CRASH DURING CLASS UNLOADING IN J9METHOD_HT::ONCLASSUNLOADING()
SEGMENTATION FAULT WHILE COMPILING A METHOD
UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL PARALLEL APPLICATION ON IBM Z PLATFORM
Security :
CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY SET TO NON DEFAULT VALUE
CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED, WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS EXCEPTION FROM KEYFACTORY CLASS
Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2020:2453-1.
# The text itself is copyright (C) SUSE.
#
include('compat.inc');
if (description)
{
script_id(140254);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/05/12");
script_cve_id(
"CVE-2019-17639",
"CVE-2020-14556",
"CVE-2020-14577",
"CVE-2020-14578",
"CVE-2020-14579",
"CVE-2020-14581",
"CVE-2020-14583",
"CVE-2020-14593",
"CVE-2020-14621"
);
script_name(english:"SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2020:2453-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"This update for java-1_8_0-ibm fixes the following issues :
Update to Java 8.0 Service Refresh 6 Fix Pack 15 [bsc#1175259,
bsc#1174157] CVE-2020-14577 CVE-2020-14578 CVE-2020-14579
CVE-2020-14581 CVE-2020-14556 CVE-2020-14621 CVE-2020-14593
CVE-2020-14583 CVE-2019-17639
- Class Libraries :
- JAVA.UTIL.ZIP.DEFLATER OPERATIONS THROW
JAVA.LANG.INTERNALERROR
- JAVA 8 DECODER OBJECTS CONSUME A LARGE AMOUNT OF JAVA
HEAP
- TRANSLATION MESSAGES UPDATE FOR JCL
- UPDATE TIMEZONE INFORMATION TO TZDATA2020A
- Java Virtual Machine :
- IBM JAVA REGISTERS A HANDLER BY DEFAULT FOR SIGABRT
- LARGE MEMORY FOOTPRINT HELD BY TRACECONTEXT OBJECT
- JIT Compiler :
- CRASH IN THE INTERPRETER AFTER OSR FROM INLINED
SYNCHRONIZED METHOD IN DEBUGGING MODE
- INTERMITTENT ASSERTION FAILURE REPORTED
- CRASH IN RESOLVECLASSREF() DURING AOT LOAD
- JIT CRASH DURING CLASS UNLOADING IN
J9METHOD_HT::ONCLASSUNLOADING()
- SEGMENTATION FAULT WHILE COMPILING A METHOD
- UNEXPECTED CLASSCASTEXCEPTION THROWN IN HIGH LEVEL
PARALLEL APPLICATION ON IBM Z PLATFORM
- Security :
- CERTIFICATEEXCEPTION OCCURS WHEN FILE.ENCODING PROPERTY
SET TO NON DEFAULT VALUE
- CHANGES TO IBMJCE AND IBMJCEPLUS PROVIDERS
- IBMJCEPLUS FAILS, WHEN THE SECURITY MANAGER IS ENABLED,
WITH DEFAULT PERMISSIONS, SPECIFIED IN JAVA.POLICY FILE
- IN CERTAIN INSTANCES, IBMJCEPLUS PROVIDER THROWS
EXCEPTION FROM KEYFACTORY CLASS
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1174157");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1175259");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-17639/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14556/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14577/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14578/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14579/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14581/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14583/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14593/");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-14621/");
# https://www.suse.com/support/update/announcement/2020/suse-su-20202453-1
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f318d73b");
script_set_attribute(attribute:"solution", value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.
Alternatively you can run the command listed for your product :
SUSE Linux Enterprise Server for SAP 15 :
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-2453=1
SUSE Linux Enterprise Server 15-LTSS :
zypper in -t patch SUSE-SLE-Product-SLES-15-2020-2453=1
SUSE Linux Enterprise Module for Legacy Software 15-SP2 :
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP2-2020-2453=1
SUSE Linux Enterprise Module for Legacy Software 15-SP1 :
zypper in -t patch SUSE-SLE-Module-Legacy-15-SP1-2020-2453=1");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-14556");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2020-14583");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2020/07/15");
script_set_attribute(attribute:"patch_publication_date", value:"2020/09/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/09/04");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"SuSE Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(0|1|2)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0/1/2", os_ver + " SP" + sp);
flag = 0;
if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"java-1_8_0-ibm-alsa-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", cpu:"x86_64", reference:"java-1_8_0-ibm-plugin-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"java-1_8_0-ibm-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"java-1_8_0-ibm-devel-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"0", cpu:"s390x", reference:"java-1_8_0-ibm-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"0", cpu:"s390x", reference:"java-1_8_0-ibm-devel-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"2", cpu:"x86_64", reference:"java-1_8_0-ibm-alsa-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"2", cpu:"x86_64", reference:"java-1_8_0-ibm-plugin-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"2", reference:"java-1_8_0-ibm-1.8.0_sr6.15-3.41.1")) flag++;
if (rpm_check(release:"SLES15", sp:"2", reference:"java-1_8_0-ibm-devel-1.8.0_sr6.15-3.41.1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
else security_warning(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "java-1_8_0-ibm");
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | java-1_8_0-ibm-devel | p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel |
novell | suse_linux | java-1_8_0-ibm | p-cpe:/a:novell:suse_linux:java-1_8_0-ibm |
novell | suse_linux | java-1_8_0-ibm-alsa | p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa |
novell | suse_linux | java-1_8_0-ibm-plugin | p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin |
novell | suse_linux | 15 | cpe:/o:novell:suse_linux:15 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17639
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14556
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14577
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14578
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14579
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14581
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14583
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14593
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14621
www.nessus.org/u?f318d73b
bugzilla.suse.com/show_bug.cgi?id=1174157
bugzilla.suse.com/show_bug.cgi?id=1175259
www.suse.com/security/cve/CVE-2019-17639/
www.suse.com/security/cve/CVE-2020-14556/
www.suse.com/security/cve/CVE-2020-14577/
www.suse.com/security/cve/CVE-2020-14578/
www.suse.com/security/cve/CVE-2020-14579/
www.suse.com/security/cve/CVE-2020-14581/
www.suse.com/security/cve/CVE-2020-14583/
www.suse.com/security/cve/CVE-2020-14593/
www.suse.com/security/cve/CVE-2020-14621/
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
8.3 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
71.8%