What is the list of the CVE resolved in OpenJDK build that published in https://github.com/ojdkbuild/ojdkbuild/releases?

For example in this build: https://github.com/ojdkbuild/ojdkbuild/releases/tag/

Alternatively, can I assume that OpenJDK build always includes the same CVE list as the RedHat OpenJDK build https://www.redhat.com/archives/rhsa-announce/2017-October/msg00031.html?


ojdkbuild maintainer here, to get the list of CVEs from downloads page you need to follow announcement link that contains some details on release and usually links to Oracle Java SE Risk Matrix.

Yes, you can assume, that ojdkbuild OpenJDK builds includes the same CVE list as RHEL OpenJDK builds.

Generally Oracle CPU list linked above is exactly the same as the one in RHSA link you posted. There may be nuances, for example if RHEL (and as a consequence - ojdkbuild) do not use the version of third-party library (like libjpeg) that is vulnerable.

Please note, that this covers only OpenJDK itself, WebStart and OpenJFX (that are not parts of OpenJDK) are handled separately.

You can also use issues lists from aarch64-port maillist (aarch64-jdk8u is a base for RHEL builds for all arches) and from corresponding IcedTea 8 release notes for cross-checking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.