OpenJDK Vulnerability Advisory: 2019/10/15
The following vulnerabilities in OpenJDK source code were fixed in this release. The affected versions are 13, 11.0.4, 8u222, 7u231, and earlier. We recommend that you upgrade as soon as possible.
The current and previous advisories are available for reference.
Risk matrix
| Affects ... | ||||||
|---|---|---|---|---|---|---|
| CVE ID | Component | CVSSv3 Vector |
7 | 8 | 11 | 13 |
| CVE-2019-2949 | security-libs/ javax.net.ssl |
6.8 NHNNCHNN |
• | • | • | |
| CVE-2019-2989 | core-libs/ java.net |
6.8 NHNNCNHN |
• | • | • | • |
| CVE-2019-2958 | core-libs/ java.lang |
5.9 NHNNUNHN |
• | • | • | • |
| CVE-2019-2975 | core-libs/ javax.script |
4.8 NHNNUNLL |
• | • | • | |
| CVE-2019-2977 | hotspot/ compiler |
4.8 NHNNULNL |
• | • | ||
| CVE-2019-2999 | tools/ javadoc(tool) |
4.7 NHNRCLLN |
• | • | • | • |
| CVE-2019-2981 | xml/ jaxp |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2973 | xml/ jaxp |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2983 | client-libs/ 2d |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2988 | client-libs/ 2d |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2978 | core-libs/ java.net |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2964 | core-libs/ java.util.regex |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2992 | client-libs/ 2d |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2962 | client-libs/ 2d |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2987 | client-libs/ 2d |
3.7 NHNNUNNL |
• | • | • | • |
| CVE-2019-2894 | security-libs/ javax.net.ssl |
3.7 NHNNULNN |
• | • | • | • |
| CVE-2019-2933 | core-libs |
3.1 NHNRULNN |
• | • | • | • |
| CVE-2019-2945 | core-libs/ java.net |
3.1 NHNRUNNL |
• | • | • | • |
Acknowledgements
We acknowledge the following parties for their reports and contributions: Rob Hamm (SAS), Roy Haroush, Imre, Mitah J, Jan Jancar (Masaryk University, Brno, Czech Republic), Mark Thomas (Apache Tomcat), Duong Quoc Tin, Yaqi Guo (Huawei Technologies Co. Ltd.), and Zihang Wang.
We also thank the Leads of the JDK 7 Updates, JDK 8 Updates, and JDK 11 Updates Projects for providing the risk-matrix information for their releases.
How to report a vulnerability
Please see the reporting instructions for information about how to report a vulnerability.
