Enquiry on SQL Anywhere 17.0.10.6089: "SAP JRE" JRE180 Security Vulnerability

[yy25]

Hi, I'm currently using SAP Anywhere 17.0.10.6089 as the database for our application. SAP JRE located at `C:\Program Files\SQL Anywhere 17\bin64\jre180`. The installed JRE version is 8.0.31.

Did this version of SAP JRE (8.0.31) have any known security vulnerabilities? If so, I would appreciate guidance on how to obtain and apply the necessary updates or patches to mitigate the risks.

Thank you.

[chris_keating · Accepted solution]

There are no known security vulnerabilities in the JRE that impact SQL Anywhere use. Ee do document some CVEs that scanners may report and identify the SQL Anywhere update which contains a JRE version that has the mitigation of the CVE. Scanners report vulnerabilities in JRE shipped with SQL Anywhere.

We have updated the JRE, as other 3rd party components including SAP components, a number of times in the past years. SQL Anywhere is now shipping with Java version 1.8.0 381.

There are also multiple security notes related to SQL Anywhere (Component BC-SYB-SQA) which do impact the version your are running.  I would encourage you to update to a recent release to mitigate those issues. 

[yy25 · Accepted solution]

Hi Chris,

[yy25 · Accepted solution]

Hi Chris, I click on the link for 'Scanners report vulnerabilities in JRE shipped with SQL Anywhere' but cannot see anything. Is it ok to share the details with me? Thank you

[chris_keating · Accepted solution]

The link was posted incorrectly. Here is the correct link: https://me.sap.com/notes/3218861

[yy25 · Accepted solution]

Hi Chris, my account doesn't seem have access to this KB. Is it possible to save as pdf and share?

[chris_keating · Accepted solution]

I am can only direct you to the KBA - I guess it requires a s-account to access. In summary, the KBA is listing CVEs that scanners will report as issues with the SQL Anywhere shipped JRE. SQL Anywhere use of the JRE are not at risk to those CVEs. But we did update the JRE as part of a periodic refresh of their party components.