1

My goal is to understand, which security issues will arise, when I use old java 8 versions on my server applications. There are lots of java security issues, but most are only relevant for client applications.

This vulnerability does not apply to Java deployments, typically in servers ...

There is a similar question. But:

  • The question is outdated
  • Of course you should patch all software to get maximum security. But in practise upgrading software is sometimes associated with high costs. Therefore you have to explain your management why there is a security issue and what impacts do arise.

So my questions:

  • Are there any lists with java security issues which are only relevant for server applications?
  • Are there any guides regarding this topic?

EDIT

  • Jdk8 support will end in 2020. Perhaps we can estimate what security issues may arise in the future, when we know what kind of security issues have been in the past. (I know that's not a good question, but I don't live in an ideal world)
  • Jdk8 public support has already ended. If there are servers with an old jdk. Should these updated to the commercial jdk8?
Improve this question
5
  • 1
    Java 8 is still supported and maintained. Why do you expect high costs upgrading to the latest Java 8 version?
    – Robert
    Commented Apr 8, 2020 at 13:55
  • Thanks for your question: I have updated my questions. The support for Jdk8 ends in 2020. So then we have to migrate. The migration from jdk8 to jdk11 could be easy. But when you are using 3rd party software which is bound to specific jdks a migration will be a big task.
    – Matthias M
    Commented Apr 8, 2020 at 14:13
  • 2
    Support ends in 2020 for OracleJDK personal use (but you are clearly a commercial user). If you still use Oracle you already have to pay for a license anyway hence upgrading could save money? Java 8 is a LTS release which means it gets AFAIK support up to May 2026 (depending on the used distribution). You just have to select the correct OpenJDK based distribution.
    – Robert
    Commented Apr 8, 2020 at 15:35
  • Ok, this is good to know. Thanks!
    – Matthias M
    Commented Apr 8, 2020 at 21:48
  • 1
    The wikipedia page you link to says that Oracle is supporting Java 8 until December 2030. That page also says that AdoptOpenJDK is "At least May 2026". A quick goolge shows that RedHat is also claiming to support OpenJDK until May 2026. I think your fear that jdk8 support will end in 2020 is unfounded. Though you may have to either pay Oracle, or switch to one of the many open-source builds.
    – Mike Ounsworth
    Commented Apr 9, 2020 at 0:10

1 Answer 1

Reset to default
2

If you go straight to the source, there is a column for notes. I don't know if there is a collected works.

Notes 1 and 3 in Oracle security advisories for Java SE is for this.

1. [...] This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.

3. This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.

It's quite difficult to explain the difference concisely to the intended audience. Previously advisories used the terms "client" and "server". Note 2 is only for deployments that "load and run untrusted code", which is to say where the SecurityManager is used as intended, such as RMI.

I don't think many people get much out of security advisories. I'm sure it's read mostly to give the impression that they are making an informed decision (they aren't).

Presumably a modularised Java SE 9+ deployment could skip updates in areas that it definite does not use.

Reduce the attack surface. Disable Java Serialization (narrow whitelist if you absolute must). Keep patched.

Improve this answer
1
  • 1
    Oracle security advisories suck these days as they give next to no information. However, you can usually find out what the root issue is by taking the CVE ID and going to Red Hat's page for that CVE. e.g. access.redhat.com/security/cve/cve-2020-2604 On the right you'll usually see a link to a Bugzilla entry and if you click that you can get a pretty good idea of what the issue actually is.
    – Swashbuckler
    Commented Apr 13, 2020 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .