Security update for java-1_8_0-ibm

Announcement ID:	SUSE-SU-2022:4166-1
Rating:	important
References:	bsc#1201684 bsc#1201685 bsc#1201692 bsc#1201694 bsc#1202427 bsc#1204468 bsc#1204471 bsc#1204472 bsc#1204473 bsc#1204475 bsc#1204480 bsc#1205302
Cross-References:	CVE-2022-21540 CVE-2022-21541 CVE-2022-21549 CVE-2022-21618 CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628 CVE-2022-34169 CVE-2022-39399
CVSS scores:	CVE-2022-21540 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21540 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2022-21541 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-21541 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-21549 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21549 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21618 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21618 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21619 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21619 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21626 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21626 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-34169 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-34169 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2022-39399 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-39399 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products:	Legacy Module 15-SP3 Legacy Module 15-SP4 openSUSE Leap 15.4 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 LTSS 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3

An update that solves 10 vulnerabilities and has two security fixes can now be installed.

Description:

This update for java-1_8_0-ibm fixes the following issues:

• CVE-2022-21626: An unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204471).
• CVE-2022-21618: An unauthenticated attacker with network access via Kerberos can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204468).
• CVE-2022-21619: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE (bsc#1204473).
• CVE-2022-21628: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204472).
• CVE-2022-21624: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise (bsc#1204475).
• CVE-2022-39399: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204480).
• CVE-2022-21549: Fixed exponentials issue (bsc#1201685).
• CVE-2022-21541: Fixed an improper restriction of MethodHandle.invokeBasic() (bsc#1201692).
• CVE-2022-34169; Fixed an integer truncation issue in Xalan (bsc#1201684).

• CVE-2022-21540: Fixed a class compilation issue (bsc#1201694).

• Update to Java 8.0 Service Refresh 7 Fix Pack 20.

• Security:
  • The IBM ORB Does Not Support Object-Serialisation Data Filtering
  • Large Allocation In CipherSuite
  • Avoid Evaluating Sslalgorithmconstraints Twice
  • Cache The Results Of Constraint Checks
  • An incorrect ShortBufferException is thrown by IBMJCEPlus, IBMJCEPlusFIPS during cipher update operation
  • Disable SHA-1 Signed Jars For Ea
  • JSSE Performance Improvement
  • Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
• Java 8/Orb:
  • Upgrade ibmcfw.jar To Version o2228.02
• Class Libraries:
  • Crash In Libjsor.So During An Rdma Failover
  • High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  • Update Timezone Information To The Latest tzdata2022c
• Jit Compiler:
  • Crash During JIT Compilation
  • Incorrect JIT Optimization Of Java Code
  • Incorrect Return From Class.isArray()
  • Unexpected ClassCastException
  • Performance Regression When Calling VM Helper Code On X86

• X/Os Extentions:

  • Add RSA-OAEP Cipher Function To IBMJCECCA

• Update to Java 8.0 Service Refresh 7 Fix Pack 16

• Java Virtual Machine
  • Assertion failure at ClassLoaderRememberedSet.cpp
  • Assertion failure at StandardAccessBarrier.cpp when -Xgc:concurrentScavenge is set.
  • GC can have unflushed ownable synchronizer objects which can eventually lead to heap corruption and failure when -Xgc:concurrentScavenge is set.
• JIT Compiler:
  • Incorrect JIT optimization of Java code
  • JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
• Reliability and Serviceability:
  • javacore with "kill -3" SIGQUIT signal freezes Java process

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4
  zypper in -t patch openSUSE-SLE-15.4-2022-4166=1
• Legacy Module 15-SP3
  zypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2022-4166=1
• Legacy Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2022-4166=1
• SUSE Linux Enterprise Server 15 LTSS 15
  zypper in -t patch SUSE-SLE-Product-SLES-15-2022-4166=1
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4166=1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4166=1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-4166=1
• SUSE Linux Enterprise Server for SAP Applications 15
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-4166=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4166=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-4166=1
• SUSE Manager Proxy 4.1
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-4166=1
• SUSE Manager Retail Branch Server 4.1
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-4166=1
• SUSE Manager Server 4.1
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-4166=1
• SUSE Enterprise Storage 6
  zypper in -t patch SUSE-Storage-6-2022-4166=1
• SUSE Enterprise Storage 7
  zypper in -t patch SUSE-Storage-7-2022-4166=1
• SUSE CaaS Platform 4.0
  To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

Package List:

• openSUSE Leap 15.4 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• openSUSE Leap 15.4 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-32bit-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-32bit-1.8.0_sr7.20-150000.3.65.1
• openSUSE Leap 15.4 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-src-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-demo-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP3 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP3 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP3 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP4 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP4 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• Legacy Module 15-SP4 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 LTSS 15 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 LTSS 15 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 LTSS 15 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 (ppc64le x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Proxy 4.1 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Proxy 4.1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Retail Branch Server 4.1 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Retail Branch Server 4.1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Server 4.1 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Server 4.1 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
• SUSE Manager Server 4.1 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Enterprise Storage 6 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Enterprise Storage 6 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE Enterprise Storage 7 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE Enterprise Storage 7 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1
• SUSE CaaS Platform 4.0 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-150000.3.65.1
• SUSE CaaS Platform 4.0 (x86_64)
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-150000.3.65.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-150000.3.65.1

References:

• https://www.suse.com/security/cve/CVE-2022-21540.html
• https://www.suse.com/security/cve/CVE-2022-21541.html
• https://www.suse.com/security/cve/CVE-2022-21549.html
• https://www.suse.com/security/cve/CVE-2022-21618.html
• https://www.suse.com/security/cve/CVE-2022-21619.html
• https://www.suse.com/security/cve/CVE-2022-21624.html
• https://www.suse.com/security/cve/CVE-2022-21626.html
• https://www.suse.com/security/cve/CVE-2022-21628.html
• https://www.suse.com/security/cve/CVE-2022-34169.html
• https://www.suse.com/security/cve/CVE-2022-39399.html
• https://bugzilla.suse.com/show_bug.cgi?id=1201684
• https://bugzilla.suse.com/show_bug.cgi?id=1201685
• https://bugzilla.suse.com/show_bug.cgi?id=1201692
• https://bugzilla.suse.com/show_bug.cgi?id=1201694
• https://bugzilla.suse.com/show_bug.cgi?id=1202427
• https://bugzilla.suse.com/show_bug.cgi?id=1204468
• https://bugzilla.suse.com/show_bug.cgi?id=1204471
• https://bugzilla.suse.com/show_bug.cgi?id=1204472
• https://bugzilla.suse.com/show_bug.cgi?id=1204473
• https://bugzilla.suse.com/show_bug.cgi?id=1204475
• https://bugzilla.suse.com/show_bug.cgi?id=1204480
• https://bugzilla.suse.com/show_bug.cgi?id=1205302