What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely?
For context, we have the Oracle Java 8 runtime widely deployed, but after January, updates will only be available to home users or via a commercial contract, at prices we can't afford. This is in an academic setting, and due to the sheer number of Windows applications (ten thousand plus) any of which might have a known or unknown dependency on Java, moving to an alternative distribution like the AdoptOpenJDK runtime is going to be challenging and seems unlikely to be completed any time soon.
In order to help us prioritize, I'd like to get some idea of what sort of risks we're actually facing here, and of what steps we might take to mitigate them.
My research so far suggests:
Java Applets are now disabled on Firefox and Chrome, and we should be able to use group policy or other tools to disable them on Internet Explorer as well. (Are applet-based attacks at all common to begin with? Or are they likely to become more common next year?)
Browsers won't launch Java Web Start applications without the user's explicit permission, so even if the sandbox is broken by a newly discovered vulnerability, this is no more dangerous than a user downloading and running a conventional application.
Desktop Java applications, e.g.,
.jar
files, aren't sandboxed anyway, so security vulnerabilities in the runtime shouldn't matter unless they result in vulnerabilities in the application. That means we'll have to do something about the (relatively small) number of machines we have running Tomcat, but that should run perfectly well on any Java distribution, and most other Java applications shouldn't be directly exposed to attack.
So on the whole the situation doesn't actually seem quite as bad as it first sounded. But perhaps I'm overlooking something? What other risks are we facing?