RHSA-2017:0338CriticalCVSS 8.8

Red Hat Security Advisory: java-1.6.0-ibm security update

Published
February 28, 2017
Last Modified
October 23, 2026

🔗 CVE IDs covered (12)

CVE-2017-3231 →CVE-2017-3241 →CVE-2017-3253 →CVE-2017-3272 →CVE-2016-5548 →CVE-2016-5549 →CVE-2016-5552 →CVE-2017-3252 →CVE-2017-3259 →CVE-2017-3261 →CVE-2016-2183 →CVE-2016-5546 →

📋 Description

CVE-2016-2183 — SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) CVE-2016-5546 — OpenJDK: incorrect ECDSA signature extraction from the DER input (Libraries, 8168714) CVE-2016-5548 — OpenJDK: DSA implementation timing attack (Libraries, 8168728) CVE-2016-5549 — OpenJDK: ECDSA implementation timing attack (Libraries, 8168724) CVE-2016-5552 — OpenJDK: incorrect URL parsing in URLStreamHandler (Networking, 8167223) CVE-2017-3231 — OpenJDK: URLClassLoader insufficient access control checks (Networking, 8151934) CVE-2017-3241 — OpenJDK: untrusted input deserialization in RMI registry and DCG (RMI, 8156802) CVE-2017-3252 — OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743) CVE-2017-3253 — OpenJDK: imageio PNGImageReader failed to honor ignoreMetadata for iTXt and zTXt chunks (2D, 8166988) CVE-2017-3259 — JDK: unspecified vulnerability fixed in 6u141, 7u131, and 8u121 (Deployment) CVE-2017-3261 — OpenJDK: integer overflow in SocketOutputStream boundary check (Networking, 8164147) CVE-2017-3272 — OpenJDK: insufficient protected field access checks in atomic field updaters (Libraries, 8165344)

🎯 Affected products121

  • Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • Red Hat Enterprise Linux Desktop Supplementary (v. 6)
  • Red Hat Enterprise Linux HPC Node Supplementary (v. 6)
  • Red Hat Enterprise Linux Server Supplementary (v. 5)
  • Red Hat Enterprise Linux Server Supplementary (v. 6)
  • Red Hat Enterprise Linux Workstation Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.ppc as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.s390 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.ppc64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)
  • java-1.6.0-ibm-1:1.6.0.16.41-1jpp.1.el6_8.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.i386 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.ppc as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.s390x as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • java-1.6.0-ibm-accessibility-1:1.6.0.16.41-1jpp.1.el5_11.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 5)
  • java-1.6.0-ibm-demo-1:1.6.0.16.41-1jpp.1.el5_11.i386 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 5)
  • +91 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of IBM Java must be restarted for this update to take effect. Workaround: 1.SSL/TLS configurations should prefer AES over DES. Versions of OpenSSL shipped with Red Hat Enterprise Linux 6 and 7 already do so. In the version of OpenSSL shipped with Red Hat Enterprise Linux 5, 3DES is listed below the AES-256 cipher and above the AES-128 cipher, therefore AES-256 based ciphersuite should not be disabled on the server. 2. Servers using OpenSSL, should not disable AES-128 and AES-256 ciphersuites. Versions of Apache shipped with Red Hat Enterprise Linux use the default cipher string, in which AES is preferred over DES/3DES based ciphersuites. For JBoss Middleware, and Java mitigations, please review this knowledge base article: https://access.redhat.com/articles/2598471 This can be mitigated on OpenShift Container Platform (OCP) by disabling the vulnerable TLS cipher suite in the applicable component. TLS configuration options for OCP are described here: https://access.redhat.com/articles/5348961

🔗 References (16)