1

When looking at the Oracle Java JRE vulnerability list on cvedetails, they list the affected versions in the text, and usually also in a table below the description. However, I'm not confident that the vulnerability is only confined to the listed versions. The following is stated for CVE-2019-2816 (https://www.cvedetails.com/cve/CVE-2019-2816/):

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.

Underneath is a table listing the affected versions, including JRE version 1.8 (Java 8) update 211 and 212. But also Java 7 update 221. So my guess would be that it's included in previous Java 8 updates as well. We're currently using Java 8 update 162. On the other hand, it could've been in a fix that was included in Java 8 and Java 7, in later versions.

While the table with all the affected versions is very detailed for some libraries on that website, I know that they're not always filled properly. A counter example is a vulnerability saying "anything up to this version is affected", but only listing the previous version as the sole content of the table with affected versions.

Is there a better site, which I just haven't discovered, that is more clear about this? Or can I trust, that the latest Java vulnerabilities won't affect us, due to using the older version? My current guess would that only the latest versions have been tested by the security researchers.

Improve this question

2 Answers 2

Reset to default
3

In the quote you added:

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.

Added emphasis is mine. You can be pretty safe in assuming that previous updates in there are affected by the vulnerability in some form. If a version of Java is not supported, then Oracle is not going to dedicate resources to test exploits on them.

Improve this answer
3
  • There's plenty of other vulnerabilities even within the same update. There isn't enough detail to know whether you are affected. (Though if you are loading code you don't entirely trust, through old school unwhitelisted Java Serialization or applets for example, you definitely do have serious problems.) Therefore, if security matters here then you should upgrade posthaste.
    – Tom Hawtin - tackline
    Oct 13, 2019 at 13:37
  • Am I right in my assumption that when they say "Supported versions that are affected are Java SE: 11.0.3 and 12.0.1", Java 8 is not affected, as they at least test the latest updates for each version? Or can I not even take that as guaranteed?
    – LML
    Oct 14, 2019 at 8:30
  • @LML Yes, that means that the supported versions of Java 8 should not be affected.
    – user
    Oct 14, 2019 at 12:15
1

Annoying isn't it? Yes, for safety's sake, with Java you need to assume that a vulnerability not only affects the stated version, but all earlier versions.

Oracle used to determine all affected versions, but I think they stopped that practice about the time Java 8 was introduced. It's a lot of work to determine all affected versions so I can understand why they don't do it, but I wish they'd at least have the CPEs in the CVEs say all earlier versions - but they don't.

Improve this answer
1
  • That would make it a lot easier for people without any experience in that field, indeed.
    – LML
    Oct 14, 2019 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .