java-11-openjdk-11.0.9.11-0.el7

エラータID: AXSA:2020-867:10

リリース日: 
2020/11/07 Saturday - 10:35
題名: 
java-11-openjdk-11.0.9.11-0.el7
影響のあるチャネル: 
Asianux Server 7 for x86_64
Severity: 
Moderate
Description: 

以下項目について対処しました。

[Security Fix]
- Java SE Serialization コンポーネントには、Java SE、
又はJava SE Embedded を攻撃するために複数のプロトコルを
介してネットワークからアクセスしている認証されていない
攻撃者が、許可されていない権限を取得し、Java SE、
又は Java SE Embedded の部分的なサービス拒否を
引き起こす脆弱性があります。(CVE-2020-14779)

- Java SE の JDNI コンポーネントには、Java SE、
又はJava SE Embedded を攻撃するために複数の
プロトコルを介してネットワークからアクセスしている
認証されていない攻撃者が、Java SE、又は Java SE
Embedded のアクセス可能なデータのサブセットを
不正に読み込めてしまう脆弱性があります。(CVE-2020-14781)

- Java SE の Libraries コンポーネントには、
認証されていない攻撃者が複数のプロトコルの
ネットワークを介して、Java SE、Java SE Embedded の
アクセス可能なデータを不正に更新、挿入、
あるいは削除できてしまう脆弱性があります。(CVE-2020-14782)

- Java SE の Hotspot コンポーネントには、
認証されていない攻撃者が複数のプロトコルの
ネットワークアクセスを介して、Java SE、
Java SE Embedded のアクセス可能なデータの
サブセットを不正に読み込めてしまうとともに、
データを不正に更新、挿入、削除できてしまう
脆弱性があります。(CVE-2020-14792)

- Java SE の Libraries コンポーネントには、認証
されていない攻撃者が複数のプロトコルの
ネットワークアクセスを介して、 Java SE、
Java SE Embedded のアクセス可能なデータの
サブセットを不正に読み込めてしまう脆弱性が
あります。(CVE-2020-14796)

- Java SE の Libraries コンポーネントには、
認証されていない攻撃者が複数のネットワークアクセスを
介して、 Java SE 、 Java SE Embedded のアクセス可能な
データのサブセットを不正に読み込めてしまう
脆弱性があります。(CVE-2020-14803)

解決策: 

パッケージをアップデートしてください。

CVE: 
CVE-2020-14779
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2020-14781
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2020-14782
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2020-14792
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVE-2020-14796
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
CVE-2020-14797
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2020-14803
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
追加情報: 

N/A

ダウンロード: 

SRPMS
  1. java-11-openjdk-11.0.9.11-0.el7.src.rpm
    MD5: 52131a523e6c2c61d352ff3e2fb604b0
    SHA-256: 3e03400cdb973ad2a2230b3e9156dbdb3d3415467fc004f8c81fdba3cfeb95cc
    Size: 73.45 MB

Asianux Server 7 for x86_64
  1. java-11-openjdk-11.0.9.11-0.el7.x86_64.rpm
    MD5: 0fcf13e071b7ea5b9840dcfc85af6c88
    SHA-256: 87737338fc813cc59c3780da5c4319521d6bf41336843065580da7bbc717deea
    Size: 223.04 kB
  2. java-11-openjdk-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 101c66cebe2483f66626ebd19a5aa0d7
    SHA-256: 38acf5f734f4e61c9261497f77b8fe6760c3b6a4b9e201b6232ee0517bfd7206
    Size: 228.13 kB
  3. java-11-openjdk-demo-11.0.9.11-0.el7.x86_64.rpm
    MD5: 43c95793da02dbc5d49ed2bc29dd072a
    SHA-256: a3b30f932cce4724261e48d4ec3b6bb93e508f441dc927966c31a8d471469d39
    Size: 4.34 MB
  4. java-11-openjdk-demo-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 2232a865956a2cb34891d5540d6f1d95
    SHA-256: 256846b041201ea3724a014624d8cb9be0a980a6d6053543d6e0598ff5c8752a
    Size: 4.34 MB
  5. java-11-openjdk-devel-11.0.9.11-0.el7.x86_64.rpm
    MD5: 4f72f4c8947b9eed6f38618eabe8b6d3
    SHA-256: 923713ad6f8bbbe13a9215e6c30d2f6671e86f2207de53b7ce6d035277481dd5
    Size: 3.36 MB
  6. java-11-openjdk-devel-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 9087bdfef1fb1610edc95cfe6c9855bf
    SHA-256: 154689427fc5e1dc3efa40157ec078b46cc1b5f8a61bdaf280f9f3e58a3cde82
    Size: 3.37 MB
  7. java-11-openjdk-headless-11.0.9.11-0.el7.x86_64.rpm
    MD5: 17243d757a20715e0280b2833192a156
    SHA-256: 6ebb5e1efa7ff4fde52628bd77258a085f194e4405c1f6793a5956c9dc8021c3
    Size: 39.05 MB
  8. java-11-openjdk-headless-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 928cbca548d085d46e9b9fb10b1b8d35
    SHA-256: c0f619a6ddc8c7904a3cbee30fcf3a031a023a3b55f1e30133e9968d2b20bf03
    Size: 41.64 MB
  9. java-11-openjdk-javadoc-11.0.9.11-0.el7.x86_64.rpm
    MD5: 351222702c80d68793fa240d82fb003f
    SHA-256: f4b7cd39c743dcdce80fd696ac04c289f6343da0e74c09402cb62ae7b0d7be3a
    Size: 16.08 MB
  10. java-11-openjdk-javadoc-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 1642ce9fddac3a2e48f764fb9f76ec98
    SHA-256: 4e8871d291b0411d35bf1d6352bf5220f2d8ac26497bb109e5fc8da99c0e1db7
    Size: 16.08 MB
  11. java-11-openjdk-javadoc-zip-11.0.9.11-0.el7.x86_64.rpm
    MD5: aafe09c94df189ac95dcaf2ec177d0f6
    SHA-256: 5cf958dd470acbb137692cb0c3b17fe64764d6e9505b17438576c518f57f458a
    Size: 42.09 MB
  12. java-11-openjdk-javadoc-zip-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: bd7f3d5132fe9722622423307b19b22f
    SHA-256: c98c0be037de665d35ef1608f24f7292f6c0881d6a4b411a08185a4bc691ab64
    Size: 42.09 MB
  13. java-11-openjdk-jmods-11.0.9.11-0.el7.x86_64.rpm
    MD5: 536f572fccccca2ae915ed6b0019e679
    SHA-256: 7d3fef16792c7fa18726f6665242a5814b282b0ad806b4e8520627ae4d7bf846
    Size: 308.80 MB
  14. java-11-openjdk-jmods-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 032d9548b3b6913fedbc96b606e15ab8
    SHA-256: 14e2c5fb8a08add135835076ed5930f2306ff42b9e33e678172343cfe9b59827
    Size: 176.99 MB
  15. java-11-openjdk-src-11.0.9.11-0.el7.x86_64.rpm
    MD5: 9d39ee134d69019df9150cb31d79db0d
    SHA-256: 95549fac1acf2fd05bb01ad51ad3f7474f2bc0aefa64e7a10447d36f50a68019
    Size: 50.26 MB
  16. java-11-openjdk-src-debug-11.0.9.11-0.el7.x86_64.rpm
    MD5: 09696740966a2d643ab0c8e12263a66d
    SHA-256: 819cdfa2f081af57d23e001195060807b0e3f245f6e3c825eae04efc8daef581
    Size: 50.26 MB
  17. java-11-openjdk-11.0.9.11-0.el7.i686.rpm
    MD5: c435d8d599dd620802005a6fda01ca20
    SHA-256: 53e29f8c9afd30e1f2ae8f38ab4b158b6943a8d0aca7300bdc8b81044dadcbb6
    Size: 219.21 kB
  18. java-11-openjdk-debug-11.0.9.11-0.el7.i686.rpm
    MD5: a52af74e18a2901756a7406feb0718bb
    SHA-256: ef638df7d0f9e3d040ceda02017d79b7d7b6d309d848cf1e6a42d8b342890ed8
    Size: 222.25 kB
  19. java-11-openjdk-demo-11.0.9.11-0.el7.i686.rpm
    MD5: 75a46acd1d55887a8e14a525d89a2756
    SHA-256: 2bc1cbbfa0b5e52fe9d679757ba4881ee5faf3fce16777428e1808f6671eba0d
    Size: 4.34 MB
  20. java-11-openjdk-demo-debug-11.0.9.11-0.el7.i686.rpm
    MD5: 4e2137f2d1eb1494471c0791d9b548de
    SHA-256: ed826c9f2d875ca58d377f808957192a91a933f44994a44ad976270bfa5cdac0
    Size: 4.34 MB
  21. java-11-openjdk-devel-11.0.9.11-0.el7.i686.rpm
    MD5: e4d78a23679700dff4df426278bd326a
    SHA-256: f1225638dd68497949b1fa2d1299e8c748b20c12e0b9e223d5a7b3e87c2bbd01
    Size: 3.34 MB
  22. java-11-openjdk-devel-debug-11.0.9.11-0.el7.i686.rpm
    MD5: 2d42913f559f319b022b72e79064478c
    SHA-256: 73f83a0c2ad1867f92573735c00c33358a4e4aea3a63e7609e727f9f8cc1fb43
    Size: 3.34 MB
  23. java-11-openjdk-headless-11.0.9.11-0.el7.i686.rpm
    MD5: 6917df3e8df5e079278247638a9351c7
    SHA-256: 4b0697ca288246b9e464fc6e018d694842a3da60f8bd4289a6782510ed5d1aa0
    Size: 35.18 MB
  24. java-11-openjdk-headless-debug-11.0.9.11-0.el7.i686.rpm
    MD5: c96bc8845f69df63cffd9ecff093c16c
    SHA-256: 105abf867bf873b00029cdb748cfa5c87a86206d4da082041e9c9fc6fe625804
    Size: 37.17 MB
  25. java-11-openjdk-javadoc-11.0.9.11-0.el7.i686.rpm
    MD5: 1d8bc105e106983dee91fd5ae9de35ad
    SHA-256: beadfecd21d0fc519acd7ef0104a0acc882f3f1dbe7480d21f4fd2124d6fea53
    Size: 16.07 MB
  26. java-11-openjdk-javadoc-debug-11.0.9.11-0.el7.i686.rpm
    MD5: 29e77f0969f20cef27e012980c3fc3b5
    SHA-256: aa95c8009c16eef9425deaf768a035f55f215c9273999295d454a4a5e0303d94
    Size: 16.08 MB
  27. java-11-openjdk-javadoc-zip-11.0.9.11-0.el7.i686.rpm
    MD5: bba449d68deab6becafd8da72f345687
    SHA-256: ecd2a0d4ce4b41cf4c497fc472ee913377fa7fb7794bdeaf394ff3232d73b973
    Size: 42.12 MB
  28. java-11-openjdk-javadoc-zip-debug-11.0.9.11-0.el7.i686.rpm
    MD5: c25eaf71453638eecf4ef61b39d4c283
    SHA-256: db3808804795724e7e2d6aa4202349b22ac47ce7aff0e67bf15cea946e9e5966
    Size: 42.12 MB
  29. java-11-openjdk-jmods-11.0.9.11-0.el7.i686.rpm
    MD5: 4eb6ba978804e64e7c9eda5cb7d1d590
    SHA-256: a5cccf2b202be1d752a2a1db05b8552ee2fd7d11d4fc099a2c80a7f44bced42c
    Size: 260.89 MB
  30. java-11-openjdk-jmods-debug-11.0.9.11-0.el7.i686.rpm
    MD5: aa8bf92c4dd82041f6544fbc4b08cd6d
    SHA-256: bfafe5200875c356c1e6dd511c5bbbe85c00973f605cfae5718ed59878a96efa
    Size: 150.16 MB
  31. java-11-openjdk-src-11.0.9.11-0.el7.i686.rpm
    MD5: d516fcf76fabcad7cbabc95e2c128c9f
    SHA-256: 9021429163d4c4e0b9767b9b37573498ed0db0e81508723d7e432e3fb678749c
    Size: 45.52 MB
  32. java-11-openjdk-src-debug-11.0.9.11-0.el7.i686.rpm
    MD5: b3ed9f2c730992ed979777c6147dd616
    SHA-256: acd66f2f15c116f4b7e06cb7ea6a20a5784e8125690fb3ffe9b722bf076e5816
    Size: 45.52 MB