Security update for java-1_8_0-openjdk

Announcement ID:	SUSE-SU-2020:1569-1
Rating:	important
References:	bsc#1160398 bsc#1169511 bsc#1171352
Cross-References:	CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830
CVSS scores:	CVE-2020-2754 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2754 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2755 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2755 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2756 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2756 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2757 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2757 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2773 ( SUSE ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2773 ( NVD ): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2781 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2781 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2800 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-2800 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2020-2803 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2020-2803 ( NVD ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2020-2805 ( SUSE ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2020-2805 ( NVD ): 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVE-2020-2830 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2020-2830 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products:	Legacy Module 15-SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 LTSS 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0

An update that solves 10 vulnerabilities can now be installed.

Description:

This update for java-1_8_0-openjdk to version jdk8u252 fixes the following issues:

• CVE-2020-2754: Forward references to Nashorn (bsc#1169511)
• CVE-2020-2755: Improve Nashorn matching (bsc#1169511)
• CVE-2020-2756: Better mapping of serial ENUMs (bsc#1169511)
• CVE-2020-2757: Less Blocking Array Queues (bsc#1169511)
• CVE-2020-2773: Better signatures in XML (bsc#1169511)
• CVE-2020-2781: Improve TLS session handling (bsc#1169511)
• CVE-2020-2800: Better Headings for HTTP Servers (bsc#1169511)
• CVE-2020-2803: Enhance buffering of byte buffers (bsc#1169511)
• CVE-2020-2805: Enhance typing of methods (bsc#1169511)
• CVE-2020-2830: Better Scanner conversions (bsc#1169511)
• Ignore whitespaces after the header or footer in PEM X.509 cert (bsc#1171352)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Legacy Module 15-SP1
  zypper in -t patch SUSE-SLE-Module-Legacy-15-SP1-2020-1569=1
• SUSE Linux Enterprise Server 15 LTSS 15
  zypper in -t patch SUSE-SLE-Product-SLES-15-2020-1569=1
• SUSE Linux Enterprise Server for SAP Applications 15
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1569=1

Package List:

• Legacy Module 15-SP1 (aarch64 ppc64le s390x x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.252-3.35.3
• SUSE Linux Enterprise Server 15 LTSS 15 (aarch64 ppc64le s390x x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.252-3.35.3
• SUSE Linux Enterprise Server for SAP Applications 15 (ppc64le x86_64)
  • java-1_8_0-openjdk-debugsource-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-devel-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-demo-debuginfo-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-1.8.0.252-3.35.3
  • java-1_8_0-openjdk-headless-debuginfo-1.8.0.252-3.35.3

References:

• https://www.suse.com/security/cve/CVE-2020-2754.html
• https://www.suse.com/security/cve/CVE-2020-2755.html
• https://www.suse.com/security/cve/CVE-2020-2756.html
• https://www.suse.com/security/cve/CVE-2020-2757.html
• https://www.suse.com/security/cve/CVE-2020-2773.html
• https://www.suse.com/security/cve/CVE-2020-2781.html
• https://www.suse.com/security/cve/CVE-2020-2800.html
• https://www.suse.com/security/cve/CVE-2020-2803.html
• https://www.suse.com/security/cve/CVE-2020-2805.html
• https://www.suse.com/security/cve/CVE-2020-2830.html
• https://bugzilla.suse.com/show_bug.cgi?id=1160398
• https://bugzilla.suse.com/show_bug.cgi?id=1169511
• https://bugzilla.suse.com/show_bug.cgi?id=1171352