Security update for java-1_8_0-ibm

Announcement ID:	SUSE-SU-2022:4290-1
Rating:	moderate
References:	bsc#1204468 bsc#1204471 bsc#1204472 bsc#1204473 bsc#1204475 bsc#1204480 bsc#1205302
Cross-References:	CVE-2022-21618 CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628 CVE-2022-39399
CVSS scores:	CVE-2022-21618 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21618 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21619 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21619 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21624 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-21626 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21626 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-21628 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2022-39399 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2022-39399 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products:	SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9

An update that solves six vulnerabilities and has one security fix can now be installed.

Description:

This update for java-1_8_0-ibm fixes the following issues:

• CVE-2022-21626: An unauthenticated attacker with network access via HTTPS can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204471).
• CVE-2022-21618: An unauthenticated attacker with network access via Kerberos can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204468).
• CVE-2022-21619: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE (bsc#1204473).
• CVE-2022-21628: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204472).
• CVE-2022-21624: An unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise (bsc#1204475).

• CVE-2022-39399: An unauthenticated attacker with network access via HTTP can compromise Oracle Java SE, Oracle GraalVM Enterprise Edition (bsc#1204480).

• Update to Java 8.0 Service Refresh 7 Fix Pack 20 [bsc#1205302]

• Security:
  • The IBM ORB Does Not Support Object-Serialisation Data Filtering
  • Large Allocation In CipherSuite
  • Avoid Evaluating Sslalgorithmconstraints Twice
  • Cache The Results Of Constraint Checks
  • An incorrect ShortBufferException is thrown by IBMJCEPlus, IBMJCEPlusFIPS during cipher update operation
  • Disable SHA-1 Signed Jars For Ea
  • JSSE Performance Improvement
  • Oracle Road Map Kerberos Deprecation Of 3DES And RC4 Encryption
• Java 8/Orb:
  • Upgrade ibmcfw.jar To Version o2228.02
• Class Libraries:
  • Crash In Libjsor.So During An Rdma Failover
  • High CPU Consumption Observed In ZosEventPort$EventHandlerTask.run
  • Update Timezone Information To The Latest tzdata2022c
• Jit Compiler:
  • Crash During JIT Compilation
  • Incorrect JIT Optimization Of Java Code
  • Incorrect Return From Class.isArray()
  • Unexpected ClassCastException
  • Performance Regression When Calling VM Helper Code On X86

• X/Os Extentions:

  • Add RSA-OAEP Cipher Function To IBMJCECCA

• Update to Java 8.0 Service Refresh 7 Fix Pack 16

• Java Virtual Machine
  • Assertion failure at ClassLoaderRememberedSet.cpp
  • Assertion failure at StandardAccessBarrier.cpp when -Xgc:concurrentScavenge is set.
  • GC can have unflushed ownable synchronizer objects which can eventually lead to heap corruption and failure when -Xgc:concurrentScavenge is set.
• JIT Compiler:
  • Incorrect JIT optimization of Java code
  • JAVA JIT Power: JIT compile time assert on AIX or LINUXPPC
• Reliability and Serviceability:
  • javacore with "kill -3" SIGQUIT signal freezes Java process

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE OpenStack Cloud 9
  zypper in -t patch SUSE-OpenStack-Cloud-9-2022-4290=1
• SUSE OpenStack Cloud Crowbar 9
  zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2022-4290=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4
  zypper in -t patch SUSE-SLE-SAP-12-SP4-2022-4290=1
• SUSE Linux Enterprise Software Development Kit 12 SP5
  zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-4290=1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2
  zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2022-4290=1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3
  zypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2022-4290=1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2022-4290=1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4
  zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2022-4290=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4290=1
• SUSE Linux Enterprise Server 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4290=1
• SUSE Linux Enterprise High Performance Computing 12 SP5
  zypper in -t patch SUSE-SLE-SERVER-12-SP5-2022-4290=1

Package List:

• SUSE OpenStack Cloud 9 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE OpenStack Cloud 9 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE OpenStack Cloud Crowbar 9 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE OpenStack Cloud Crowbar 9 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP4 (x86_64)
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Software Development Kit 12 SP5 (nosrc)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Software Development Kit 12 SP5 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP3 BCL 12-SP3 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (x86_64)
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (nosrc ppc64le x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP5 (x86_64)
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP5 (nosrc ppc64le s390x x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP5 (ppc64le s390x x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise Server 12 SP5 (x86_64)
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (nosrc x86_64)
  • java-1_8_0-ibm-1.8.0_sr7.20-30.99.1
• SUSE Linux Enterprise High Performance Computing 12 SP5 (x86_64)
  • java-1_8_0-ibm-devel-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-plugin-1.8.0_sr7.20-30.99.1
  • java-1_8_0-ibm-alsa-1.8.0_sr7.20-30.99.1

References:

• https://www.suse.com/security/cve/CVE-2022-21618.html
• https://www.suse.com/security/cve/CVE-2022-21619.html
• https://www.suse.com/security/cve/CVE-2022-21624.html
• https://www.suse.com/security/cve/CVE-2022-21626.html
• https://www.suse.com/security/cve/CVE-2022-21628.html
• https://www.suse.com/security/cve/CVE-2022-39399.html
• https://bugzilla.suse.com/show_bug.cgi?id=1204468
• https://bugzilla.suse.com/show_bug.cgi?id=1204471
• https://bugzilla.suse.com/show_bug.cgi?id=1204472
• https://bugzilla.suse.com/show_bug.cgi?id=1204473
• https://bugzilla.suse.com/show_bug.cgi?id=1204475
• https://bugzilla.suse.com/show_bug.cgi?id=1204480
• https://bugzilla.suse.com/show_bug.cgi?id=1205302