Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bugzilla DB migration completed. Please report issues to Infra team via email via infra@gentoo.org or IRC
Bug 718720 - <dev-java/openjdk{-bin,-jre-bin}-{8.252_p09,11.0.7_p10},: Multiple vulnerabilities (CVE-2020-{2585,2755,2756,2757,2773,2781,2800,2803,2805,2830})
Summary: <dev-java/openjdk{-bin,-jre-bin}-{8.252_p09,11.0.7_p10},: Multiple vulnerabil...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa+ cve]
Keywords: CC-ARCHES
Depends on:
Blocks: CVE-2020-2585, CVE-2020-2755, CVE-2020-2756, CVE-2020-2757, CVE-2020-2773, CVE-2020-2781, CVE-2020-2800, CVE-2020-2803, CVE-2020-2805
  Show dependency tree
 
Reported: 2020-04-21 09:49 UTC by Sam James
Modified: 2020-06-15 15:57 UTC (History)
2 users (show)

See Also:
Package list:
=dev-java/openjdk-8.252_p09 amd64 ppc64 =dev-java/openjdk-bin-8.252_p09 =dev-java/openjdk-jre-bin-8.252_p09 amd64
Runtime testing required: ---
nattka: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James gentoo-dev Security 2020-04-21 09:49:35 UTC
See tracker.

Seems to be fixed in 8p252: https://hg.openjdk.java.net/jdk8u/jdk8u/rev/ecde297a64f2
Comment 1 Larry the Git Cow gentoo-dev 2020-04-21 20:27:48 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=681cb8b798ca725925a5e79a6d1d1b2e0fceaf9f

commit 681cb8b798ca725925a5e79a6d1d1b2e0fceaf9f
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:42:02 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:25 +0000

    dev-java/openjdk-jre-bin: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk-jre-bin/Manifest                  |  1 +
 .../openjdk-jre-bin-11.0.7_p10.ebuild              | 97 ++++++++++++++++++++++
 2 files changed, 98 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b23377ca0e6a41a5e553dd5c872379e122080645

commit b23377ca0e6a41a5e553dd5c872379e122080645
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:40:26 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:25 +0000

    dev-java/openjdk-jre-bin: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk-jre-bin/Manifest                  |  1 +
 .../openjdk-jre-bin-8.252_p09.ebuild               | 84 ++++++++++++++++++++++
 2 files changed, 85 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9dd93fdb5aa9afb4dfabe91229e5742cf3e7b418

commit 9dd93fdb5aa9afb4dfabe91229e5742cf3e7b418
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:34:20 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:24 +0000

    dev-java/openjdk-bin: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk-bin/Manifest                      |   4 +
 dev-java/openjdk-bin/openjdk-bin-11.0.7_p10.ebuild | 116 +++++++++++++++++++++
 2 files changed, 120 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9e727e4b360c88c6d9042e3eedbc1dd8687c6824

commit 9e727e4b360c88c6d9042e3eedbc1dd8687c6824
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:27:10 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:23 +0000

    dev-java/openjdk-bin: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk-bin/Manifest                     |  4 +
 dev-java/openjdk-bin/openjdk-bin-8.252_p09.ebuild | 93 +++++++++++++++++++++++
 2 files changed, 97 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=08f405dabb2d12a38d3589823a1e2f03fa8af6c7

commit 08f405dabb2d12a38d3589823a1e2f03fa8af6c7
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:42:54 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:23 +0000

    dev-java/openjdk: bump to 11.0.7_p10
    
    Bug: https://bugs.gentoo.org/713180
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk/Manifest                  |   1 +
 dev-java/openjdk/openjdk-11.0.7_p10.ebuild | 274 +++++++++++++++++++++++++++++
 2 files changed, 275 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=81a673431eedb9993ec488f765f9cd433269f0f4

commit 81a673431eedb9993ec488f765f9cd433269f0f4
Author:     Georgy Yakovlev <gyakovlev@gentoo.org>
AuthorDate: 2020-04-21 17:30:22 +0000
Commit:     Georgy Yakovlev <gyakovlev@gentoo.org>
CommitDate: 2020-04-21 20:26:17 +0000

    dev-java/openjdk: bump to 8.252_p09
    
    Bug: https://bugs.gentoo.org/706638
    Bug: https://bugs.gentoo.org/718720
    Package-Manager: Portage-2.3.99, Repoman-2.3.22
    Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org>

 dev-java/openjdk/Manifest                 |   8 ++
 dev-java/openjdk/openjdk-8.252_p09.ebuild | 224 ++++++++++++++++++++++++++++++
 2 files changed, 232 insertions(+)
Comment 2 Georgy Yakovlev gentoo-dev 2020-04-21 20:34:33 UTC
bump done, let it bake couple days in the tree

icedtea also needs those patches, but not released yet.
Comment 3 Herbert Wantesh 2020-04-21 22:12:12 UTC
merging openjdk-bin-11.0.7_p10 with USE="-examples" leads to

removed 'lib/libfreetype.so'
rm: cannot remove 'demo/': No such file or directory
 * ERROR: dev-java/openjdk-bin-11.0.7_p10::gentoo failed (install phase):
 *   (no error message)
 * 
 * Call stack:
 *     ebuild.sh, line 125:  Called src_install
 *   environment, line 1371:  Called die
 * The specific snippet of code:
 *           rm -vr demo/ || die;

just removing the "example" use flag from the ebuild fixes the bug for me, seems the demo folder got removed
Comment 4 Sam James gentoo-dev Security 2020-05-02 18:11:32 UTC
(In reply to Georgy Yakovlev from comment #2)
> bump done, let it bake couple days in the tree
> 
> icedtea also needs those patches, but not released yet.
Comment 5 NATTkA bot gentoo-dev 2020-05-02 18:33:19 UTC
Unable to check for sanity:

> no match for package: =dev-java/openjdk-re-bin-8.242_p08-r1
Comment 6 Sam James gentoo-dev Security 2020-05-04 06:24:32 UTC
arm64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2020-05-08 06:39:23 UTC
amd64 stable
Comment 8 Georgy Yakovlev gentoo-dev 2020-05-10 07:58:51 UTC
ppc64 stable

old versions dropped, done. security please proceed.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2020-06-15 15:57:32 UTC
This issue was resolved and addressed in
 GLSA 202006-22 at https://security.gentoo.org/glsa/202006-22
by GLSA coordinator Aaron Bauman (b-man).