Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Java version 11.0.10 - Multiple Vulnerabilities

Ken | Last updated: Dec 01, 2021 09:23AM UTC

Hi, Yesterday I installed a fresh copy of Enterprise Edition 2021.11. Overnight it was scanned by Nessus which is reporting... -------------------------------------------------------------------------------- Oracle Java SE 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 Multiple Vulnerabilities (Unix July 2021 CPU) The following vulnerable instance of Java is installed on the remote host : Path : /opt/burpsuite_enterprise Installed version : 1.11.0_10 Fixed version : 1.7.0_311 / 1.8.0_301 / 1.11.0_12 / 1.16.0_2 -------------------------------------------------------------------------------- The version information from the about screen... -------------------------------------------------------------------------------- Version: 2021.11-8333, Java version: 11.0.10 -------------------------------------------------------------------------------- The version for java confirmed.... -------------------------------------------------------------------------------- root@hostname:/opt/burpsuite_enterprise/jre/bin# ./java --version openjdk 11.0.10 2021-01-19 LTS OpenJDK Runtime Environment Corretto-11.0.10.9.1 (build 11.0.10+9-LTS) OpenJDK 64-Bit Server VM Corretto-11.0.10.9.1 (build 11.0.10+9-LTS, mixed mode) -------------------------------------------------------------------------------- Checked to see if there any anything other copies of java on the system, there are not. -------------------------------------------------------------------------------- root@hostname:/opt/burpsuite_enterprise/jre/bin# find / -name java /opt/burpsuite_enterprise/jre/bin/java /etc/apparmor.d/abstractions/ubuntu-browsers.d/java /usr/share/bash-completion/completions/java /usr/share/java (this is a directory!) -------------------------------------------------------------------------------- Is if safe me to try updating the bundled openjdk to 11.0.12? Or should I wait for a Burp update? Also, why wasn't the 2021.11-8333 version which was released on 11 November 2021 bundled with the latest version of openjdk; It's been available since July? v11.0.10 was released Jan 2021 - https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-January/004689.html v11.0.11 was released April 2021 - https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-April/005860.html v11.0.12 was released July 20th 2021 - https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2021-July/006954.html Regards Ken

Alex, PortSwigger Agent | Last updated: Dec 01, 2021 03:42PM UTC

Hi Ken, Thanks for your post. We are currently working on an update to bring the Java version to 11.0.13 for Burp Suite Enterprise - I don’t have an exact ETA on this currently but I can update you via this thread. We do not recommend attempting to update the bundled version manually. Historically, it’s not been a straightforward process for us to keep in step with releases, but the development team is working on a change to make this process quicker. Again, I don’t have an exact ETA for this but I will keep you up-to-date. Thanks

Ken | Last updated: Feb 25, 2022 12:46PM UTC

Alex, I see that a new version of Burp was released recently (https://portswigger.net/burp/releases/enterprise-edition-2022-2). Our Burp Enterprise server automatically updated over night and I can see from the About page that it's now running Java 11.0.13. Unfortunately Nessus is still reporting Java 11.0.10 is present. ------------------------------------------------------------------------------------------ $ sudo find . -name java ./jre/bin/java ./jres/11.0.13.8.1/bin/java ./jres/11.0.10.9.1/bin/java $ ./jre/bin/java -version openjdk version "11.0.10" 2021-01-19 LTS OpenJDK Runtime Environment Corretto-11.0.10.9.1 (build 11.0.10+9-LTS) OpenJDK 64-Bit Server VM Corretto-11.0.10.9.1 (build 11.0.10+9-LTS, mixed mode) $ ./jres/11.0.13.8.1/bin/java -version -bash: ./jres/11.0.13.8.1/bin/java: Permission denied $ sudo ./jres/11.0.13.8.1/bin/java -version openjdk version "11.0.13" 2021-10-19 LTS OpenJDK Runtime Environment Corretto-11.0.13.8.1 (build 11.0.13+8-LTS) OpenJDK 64-Bit Server VM Corretto-11.0.13.8.1 (build 11.0.13+8-LTS, mixed mode) $ ./jres/11.0.10.9.1/bin/java -version -bash: ./jres/11.0.10.9.1/bin/java: Permission denied $ sudo ./jres/11.0.10.9.1/bin/java -version openjdk version "11.0.10" 2021-01-19 LTS OpenJDK Runtime Environment Corretto-11.0.10.9.1 (build 11.0.10+9-LTS) OpenJDK 64-Bit Server VM Corretto-11.0.10.9.1 (build 11.0.10+9-LTS, mixed mode) ------------------------------------------------------------------------------------------ Can you explain to me how do I go about removing the 11.0.10 components because Burp's automatic updating doesn't do it. Thanks

Alex, PortSwigger Agent | Last updated: Mar 02, 2022 09:17AM UTC

Hi Ken, By following the upgrade path for Burp Suite Enterprise (as opposed to a new installation) the base JRE version will remain. The web application will always use any new JRE version installed as part of an update, but the original will remain as it performs a small supervisor roll to stop/start certain services. It’s worth noting that we utilize a custom JDK, and so any dependencies that may be flagged by a security scanner won’t necessarily apply to Burp Suite Enterprise. If you would like us to check any specific flagged vulnerabilities we would be happy to do so. Thanks

Brian | Last updated: Apr 06, 2022 04:49PM UTC

Can we get an update as to when OpenJDK version 11.0.13.8.1 will be patched for open Vulns? CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 CVE-2022-21282 CVE-2022-21296 CVE-2022-21291 CVE-2022-21305

Alex, PortSwigger Agent | Last updated: Apr 07, 2022 09:35AM UTC

Hi Brian, Our Java 11.0.14 upgrade is due in the next Enterprise release. Additionally, I've confirmed with the dev team that Burp Suite Enterprise is not exposed to the issues listed. Thanks

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.