Oracle Java SE and clarity

[Anon Anon]

Hello,

 

I have a question please.

We use the tool Nessus which detect the security failure, and it find that "Oracle Java SE" represents à risk for clarity (Oracle Java SE Multiple Vulnerabilities (July 2014 CPU)).

 

Is "Oracle Java SE" necessary for clarity fonctionnality ?

- May i delete it ?

- Or update it and how ?

 

Thanks for your response.

Regards

[Georgy]

Hi Anna,

 

You will need Oracle Java SE JDK in your Clarity server. The version of JDK will vary as per your Clarity version. You need to check the Release Notes of your version of Clarity to know the needed JDK version.

 

So I guess you cannot delete it. Maybe you can upgrade it to the next patch level as we see in most release notes, Clarity either needs the particular version of JDK or a higher patch level. For Clarity v13.3, its Oracle Java SE JDK 1.7 update 25 (64-bit) or higher patch level.

 

Regards,

Georgy

[Deactivated User]

That is correct, no way can you delete java sdk. If you do then you cannot access Clarity any more.

You are limited to the version specified in the release notes.

Typically you cannot change the major version, but may upgrade to the latest minor version.

[Legacy User]

Hi Anna,

 

As mentioned above you need java sdk on your Clarity Server which is requirement while installing Clarity. Different Java versions are compatible with different Clarity Versions, Check Release notes.

 

But you don't need java sdk on user machines to jun Clarity Application, so if needed you can uninstall java on user machine. Only JRE is required to run OWB (desktop application).

 

-Gurjeet

[Deactivated User]

...and if you do not run OWB or XOG you do not need jre on you workstation either.

jre normally installs with update checker wich can be a pain when it tries to update to a jre version not supported by the installed version of of OWB, but with no known security failures.

[Anon Anon]

Hello,

Thanks for all responses.

I just checked, the version of clarity is 13.0.1.0102 and the version of java installed in the server is 1.6 update 20.

Which version of java can we update in this case ? 1.7 update xx ?

Where can i found the release note ?

Regards

[Deactivated User]

I think you are out of luck, the release notes say

Sun J2SDK 1.6.0:

version 1.6.0_20

or higher patch level (64-bit)

 

See

Release Notes v13.0.00

 

P.S. Just Google for CA CLARITY 13.0 BOOKSHELF

[Deactivated User]

See

Java Archive Downloads - Java SE 6

The latest is Java SE Development Kit 6u45

WARNING: These older versions of the JRE and JDK are provided to help developers debug issues in older systems. They are not updated with the latest security patches and are not recommended for use in production.

 

 

On the other hand

Current update releases for JDK 5.0 and 6 are available for support customers.  If you already have a support contract see support note 1412103.2  To learn more about Oracle Java SE Support visit our Java SE Products Page.

[Anon Anon]

Thank you for your response.

If I resume, we can only update to 6u45 ? despite this, the security failure still exist ? because they are not updated with the latest security patches and are not recommanded for use in production.

The solution is to upgrade to version 13.2 of clarity in order to install the version java 7uxx ? right ?

 

Regards

[Deactivated User]

My guess is that Nessus would pick 6u45, while it definitely is better than what you have.

If you are considering upgrade then why not consider v13.3 that has been out for a while and should have worst issues if any solved.

On the other hand that does not support jdk 8 either.