|
| [1] | This Technology is currently being evaluated, reviewed, and tested in controlled environments. Use of this technology is strictly controlled and not available for use within the general population. |
|
| [2] | Projects must use Oracle JRE version 7u51 corresponding to Java SE 7u51 or greater or Oracle JRE version 6u51 corresponding to Java SE 6u51, and all patches and updates must be applied in accordance with VA Handbook 6500 policy to mitigate known and future security vulnerabilities. A waiver from the AERB is required for the use of Oracle JRE versions implemented by Java SE 6u45 or earlier and Java SE 7u51 or earlier. |
|
| [3] | A waiver from the Architecture and Engineering Review Board (AERB) is required for the use of Oracle JRE versions implemented earlier than Java 7u51. |
|
| [4] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISO can provide assistance in reviewing the NIST vulnerabilities. |
|
| [5] | A technology waiver is required for the use of Oracle JRE versions including and before 7u51-101. |
|
| [6] | Per Solution Delivery Client Services, version 8u131 is the current baseline. A technology waiver is required for the use of JRE Oracle 8u144 as it is not ready for production environments. |
|
| [7] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. |
|
| [8] | Applications, including VA developed applications, must have a valid signed certificate as required by Java 8 and later to avoid the need for a Java certificate exception to be created by ITOPS. |
|
| [9] | Users should check with their supervisor, Information Security Office (ISO) or local OIT representative for permission to download and use this software. Downloaded software must always be scanned for viruses prior to installation to prevent adware or malware. Freeware may only be downloaded directly from the primary site that the creator of the software has advertised for public download and user or development community engagement. Users should note, any attempt by the installation process to install any additional, unrelated software is not approved and the user should take the proper steps to decline those installations. |
|
| [10] | Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. Also note that as of this writing, Oracle has no plans to release a separate JRE for Java 11 and later and users will be required to install the full Oracle JDK to support Java 11 and beyond. It is the system owner`s responsibility to ensure proper licensing is obtained and in place for Java patches that are installed on machines they own. |
|
| [11] | Applications, including VA developed applications, must have a valid signed certificate as required by Java 8 and later to avoid the need for a Java certificate exception to be created by ITOPS.
Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. Also note that as of this writing, Oracle has no plans to release a separate JRE for Java 11 and later and users will be required to install the full Oracle JDK to support Java 11 and beyond. It is the system owner`s responsibility to ensure proper licensing is obtained and in place for Java patches that are installed on machines they own |
|
| [12] | Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. Also note that as of this writing, Oracle has no plans to release a separate JRE for Java 11 and later and users will be required to install the full Oracle JDK to support Java 11 and beyond.
Please note that SDE is starting to test version 8.0.2020.8 for the new version of Windows baselines with an estimated delivery date of May 8, 2019 and 8.0.2120.10 with an estimated delivery date of May 19, 2019. |
|
| [13] | Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. Also note that as of this writing, Oracle has no plans to release a separate JRE for Java 11 and later and users will be required to install the full Oracle JDK to support Java 11 and beyond. |
|
| [14] | Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. Also note that as of this writing, Oracle has no plans to release a separate JRE for Java 11 and later and users will be required to install the full Oracle JDK to support Java 11 and beyond. |
|
| [15] | This technology has received one or more VA security bulletins that provide specific guidance on vulnerability patching and mitigation. It is the responsibility of VA system owners to ensure that the appropriate mitigations are taken to address all known and future discovered vulnerabilities with this product. See the Reference tab for more information on security bulletins related to this product. |
|
| [16] | Due to major security vulnerabilities associated with JRE, only the current supported patch sets, which are released every 3 months, are approved for use and the prior patch set will be divested for one quarter to allow time for transition. |
|
| [17] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. |
|
| [18] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. |
