CVE-2019-2842

23.07.2019, 23:15

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.7 LOW	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
oracle	jdk	1.8.0
oracle	jre	1.8.0
opensuse	leap	15.0
opensuse	leap	15.1
hp	xp7_command_view	𝑥 < 8.7.0-00
mcafee	epolicy_orchestrator	5.9.0
mcafee	epolicy_orchestrator	5.9.1
mcafee	epolicy_orchestrator	5.10.0
mcafee	epolicy_orchestrator	5.10.0:update_1
mcafee	epolicy_orchestrator	5.10.0:update_2
mcafee	epolicy_orchestrator	5.10.0:update_3
mcafee	epolicy_orchestrator	5.10.0:update_4
canonical	ubuntu_linux	16.04

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

openjdk-8

sid	8u432-b06-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

openjdk-8

bionic	Fixed 8u222-b10-1ubuntu1~18.04.1 released
disco	Fixed 8u222-b10-1ubuntu1~19.04.1 released
trusty	dne
xenial	Fixed 8u222-b10-1ubuntu1~16.04.1 released

openSUSE / SLES Releases

openSUSE Product

Release

java-1_7_0-openjdk

suse enterprise sap 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP3	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-demo

suse enterprise sap 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP3	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-devel

suse enterprise sap 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP3	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_7_0-openjdk-headless

suse enterprise sap 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise sap 12 SP5	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP3	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP4	1.7.0.231-43.27.2 fixed
suse enterprise server 12 SP5	1.7.0.231-43.27.2 fixed

java-1_8_0-openjdk

suse enterprise sap 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP7	1.8.0.222-3.24.2 fixed
suse enterprise server 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP7	1.8.0.222-3.24.2 fixed

java-1_8_0-openjdk-demo

suse enterprise sap 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP7	1.8.0.222-3.24.2 fixed
suse enterprise server 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP7	1.8.0.222-3.24.2 fixed

java-1_8_0-openjdk-devel

suse enterprise sap 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP7	1.8.0.222-3.24.2 fixed
suse enterprise server 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP7	1.8.0.222-3.24.2 fixed

java-1_8_0-openjdk-headless

suse enterprise sap 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise sap 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise sap 15	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise sap 15 SP7	1.8.0.222-3.24.2 fixed
suse enterprise server 12 SP1	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP2	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP3	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP4	1.8.0.222-27.35.2 fixed
suse enterprise server 12 SP5	1.8.0.222-27.35.2 fixed
suse enterprise server 15	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP1	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP2	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP3	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP4	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP5	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP6	1.8.0.222-3.24.2 fixed
suse enterprise server 15 SP7	1.8.0.222-3.24.2 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

java-1.7.0-openjdk

RHEL 6	1:1.7.0.231-2.6.19.1.el6_10 fixed
RHEL 7	1:1.7.0.231-2.6.19.1.el7_6 fixed

java-1.7.0-openjdk-accessibility

RHEL 7

1:1.7.0.231-2.6.19.1.el7_6

fixed

java-1.7.0-openjdk-demo

RHEL 6	1:1.7.0.231-2.6.19.1.el6_10 fixed
RHEL 7	1:1.7.0.231-2.6.19.1.el7_6 fixed

java-1.7.0-openjdk-devel

RHEL 6	1:1.7.0.231-2.6.19.1.el6_10 fixed
RHEL 7	1:1.7.0.231-2.6.19.1.el7_6 fixed

java-1.7.0-openjdk-headless

RHEL 7

1:1.7.0.231-2.6.19.1.el7_6

fixed

java-1.7.0-openjdk-javadoc

RHEL 6	1:1.7.0.231-2.6.19.1.el6_10 fixed
RHEL 7	1:1.7.0.231-2.6.19.1.el7_6 fixed

java-1.7.0-openjdk-src

RHEL 6	1:1.7.0.231-2.6.19.1.el6_10 fixed
RHEL 7	1:1.7.0.231-2.6.19.1.el7_6 fixed

java-1.8.0-openjdk

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-accessibility

RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-accessibility-debug

RHEL 7

1:1.8.0.222.b10-0.el7_6

fixed

java-1.8.0-openjdk-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

java-1.8.0-openjdk-demo

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-demo-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

java-1.8.0-openjdk-devel

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-devel-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

java-1.8.0-openjdk-headless

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-headless-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

java-1.8.0-openjdk-javadoc

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-javadoc-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

java-1.8.0-openjdk-javadoc-zip

RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-javadoc-zip-debug

RHEL 7

1:1.8.0.222.b10-0.el7_6

fixed

java-1.8.0-openjdk-src

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed
RHEL 8	1:1.8.0.222.b10-0.el8_0 fixed
RHEL 8.0 E4S	1:1.8.0.222.b10-0.el8_0 fixed

java-1.8.0-openjdk-src-debug

RHEL 6	1:1.8.0.222.b10-0.el6_10 fixed
RHEL 7	1:1.8.0.222.b10-0.el7_6 fixed

Amazon Linux Releases

Amazon Package

Release

java-1.7.0-openjdk

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.7.0-openjdk-accessibility

Amazon Linux 2

1:1.7.0.231-2.6.19.1.amzn2.0.1

fixed

java-1.7.0-openjdk-debuginfo

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.7.0-openjdk-demo

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.7.0-openjdk-devel

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.7.0-openjdk-headless

Amazon Linux 2

1:1.7.0.231-2.6.19.1.amzn2.0.1

fixed

java-1.7.0-openjdk-javadoc

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.7.0-openjdk-src

Amazon Linux 1	1:1.7.0.231-2.6.19.1.80.amzn1 fixed
Amazon Linux 2	1:1.7.0.231-2.6.19.1.amzn2.0.1 fixed

java-1.8.0-openjdk

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-accessibility

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-accessibility-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-debuginfo

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-demo

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-demo-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-devel

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-devel-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-headless

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-headless-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-javadoc

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-javadoc-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-javadoc-zip

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-javadoc-zip-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

java-1.8.0-openjdk-src

Amazon Linux 1	1:1.8.0.222.b10-0.47.amzn1 fixed
Amazon Linux 2	1:1.8.0.222.b10-0.amzn2.0.1 fixed

java-1.8.0-openjdk-src-debug

Amazon Linux 2

1:1.8.0.222.b10-0.amzn2.0.1

fixed

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://kc.mcafee.com/corporate/index?page=content&id=SB10300

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us

https://usn.ubuntu.com/4080-1/

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html

http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

https://kc.mcafee.com/corporate/index?page=content&id=SB10300

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us

https://usn.ubuntu.com/4080-1/