Bug 718720 – <dev-java/openjdk{-bin,-jre-bin}-{8.252_p09,11.0.7_p10},: Multiple vulnerabilities (CVE-2020-{2585,2755,2756,2757,2773,2781,2800,2803,2805,2830})

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-04-21 09:49:35 UTC]

See tracker.

Seems to be fixed in 8p252: https://hg.openjdk.java.net/jdk8u/jdk8u/rev/ecde297a64f2

[Comment 1 Larry the Git Cow 2020-04-21 20:27:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=681cb8b798ca725925a5e79a6d1d1b2e0fceaf9f

commit 681cb8b798ca725925a5e79a6d1d1b2e0fceaf9f
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:42:02 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:25 +0000

    dev-java/openjdk-jre-bin: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk-jre-bin/Manifest                  |  1 +
 .../openjdk-jre-bin-11.0.7_p10.ebuild              | 97 ++++++++++++++++++++++
 2 files changed, 98 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b23377ca0e6a41a5e553dd5c872379e122080645

commit b23377ca0e6a41a5e553dd5c872379e122080645
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:40:26 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:25 +0000

    dev-java/openjdk-jre-bin: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk-jre-bin/Manifest                  |  1 +
 .../openjdk-jre-bin-8.252_p09.ebuild               | 84 ++++++++++++++++++++++
 2 files changed, 85 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9dd93fdb5aa9afb4dfabe91229e5742cf3e7b418

commit 9dd93fdb5aa9afb4dfabe91229e5742cf3e7b418
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:34:20 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:24 +0000

    dev-java/openjdk-bin: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk-bin/Manifest                      |   4 +
 dev-java/openjdk-bin/openjdk-bin-11.0.7_p10.ebuild | 116 +++++++++++++++++++++
 2 files changed, 120 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9e727e4b360c88c6d9042e3eedbc1dd8687c6824

commit 9e727e4b360c88c6d9042e3eedbc1dd8687c6824
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:27:10 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:23 +0000

    dev-java/openjdk-bin: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk-bin/Manifest                     |  4 +
 dev-java/openjdk-bin/openjdk-bin-8.252_p09.ebuild | 93 +++++++++++++++++++++++
 2 files changed, 97 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=08f405dabb2d12a38d3589823a1e2f03fa8af6c7

commit 08f405dabb2d12a38d3589823a1e2f03fa8af6c7
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:42:54 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:23 +0000

    dev-java/openjdk: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/713180
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk/Manifest                  |   1 +
 dev-java/openjdk/openjdk-11.0.7_p10.ebuild | 274 +++++++++++++++++++++++++++++
 2 files changed, 275 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=81a673431eedb9993ec488f765f9cd433269f0f4

commit 81a673431eedb9993ec488f765f9cd433269f0f4
Author:     Georgy Yakovlev <[e-mail]>
AuthorDate: 2020-04-21 17:30:22 +0000
Commit:     Georgy Yakovlev <[e-mail]>
CommitDate: 2020-04-21 20:26:17 +0000

    dev-java/openjdk: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/706638
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <[e-mail]>

 dev-java/openjdk/Manifest                 |   8 ++
 dev-java/openjdk/openjdk-8.252_p09.ebuild | 224 ++++++++++++++++++++++++++++++
 2 files changed, 232 insertions(+)

[Comment 2 Georgy Yakovlev 2020-04-21 20:34:33 UTC]

bump done, let it bake couple days in the tree

icedtea also needs those patches, but not released yet.

[Comment 3 Herbert Wantesh 2020-04-21 22:12:12 UTC]

merging openjdk-bin-11.0.7_p10 with USE="-examples" leads to

removed 'lib/libfreetype.so'
rm: cannot remove 'demo/': No such file or directory
 * ERROR: dev-java/openjdk-bin-11.0.7_p10::gentoo failed (install phase):
 *   (no error message)
 * 
 * Call stack:
 *     ebuild.sh, line 125:  Called src_install
 *   environment, line 1371:  Called die
 * The specific snippet of code:
 *           rm -vr demo/ || die;

just removing the "example" use flag from the ebuild fixes the bug for me, seems the demo folder got removed

[Comment 4 Sam James 2020-05-02 18:11:32 UTC]

(In reply to Georgy Yakovlev from comment #2)
> bump done, let it bake couple days in the tree
> 
> icedtea also needs those patches, but not released yet.

[Comment 5 NATTkA bot 2020-05-02 18:33:19 UTC]

Unable to check for sanity:

> no match for package: =dev-java/openjdk-re-bin-8.242_p08-r1

[Comment 6 Sam James 2020-05-04 06:24:32 UTC]

arm64 stable

[Comment 7 Agostino Sarubbo 2020-05-08 06:39:23 UTC]

amd64 stable

[Comment 8 Georgy Yakovlev 2020-05-10 07:58:51 UTC]

ppc64 stable

old versions dropped, done. security please proceed.

[Comment 9 GLSAMaker/CVETool Bot 2020-06-15 15:57:32 UTC]

This issue was resolved and addressed in
 GLSA 202006-22 at https://security.gentoo.org/glsa/202006-22
by GLSA coordinator Aaron Bauman (b-man).