|
<Past |
Future> |
| 4 (aka 1.4) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
| 5 (aka 1.5) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Authorized w/ Constraints (POA&M) |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
Unauthorized, Conditions Required[a] |
| 6 (aka 1.6) |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
| 7 (aka 1.7) |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Authorized w/ Constraints (DIVEST)
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
Unauthorized, Conditions Required[b]
[13, 15, 16, 17, 18] |
| 8 (aka 1.8) |
Authorized w/ Constraints
[13, 15, 16, 17] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
Authorized w/ Constraints
[13, 15, 16, 17, 18] |
| Note: |
At the time of writing, version 8 is the most current version and was released 09/15/2017.
Because the newer versions of Java Development Kit (JDK) and Jave Runtime Environment (JRE) support the Java EE specifications for older versions of Java EE (e.g. JDK 8, supports Java EE 6 standards), older supported versions of Java EE SDK (Software Development Kit) remain in a divest status for use with newer TRM authorized versions for Java software as needed. |
| | | | [13] | This technology must use the latest TRM-authorized version of Java Development Kit (JDK) - Oracle.
Per the Initial Product Review, users must abide by the following constraints:
- Oracle Java will require a 3rd party FIPS 140-2 certified solution for any data containing PHI/PII or VA sensitive information.
- System Owners/Administrators must monitor any new or existing vulnerabilities associated with Oracle Java EE as the vendor no longer releases updates to the product. Jakarta EE offers the same functionality of Oracle Java EE and is the replacement/rename of the product. Per the vendor, Jakarta is continuously receiving updates as it is the replacement/rename of Oracle Java EE. Oracle Java received its last formal release/update September 2017, but paid support is active through 2030.
| | | [15] | Due to National Institute of Standards and Technology (NIST) identified security vulnerabilities, extra vigilance should be applied to ensure the versions remain properly patched to mitigate known and future vulnerabilities. The local ISSO (Information System Security Officer) can provide assistance in reviewing the NIST vulnerabilities. | | | [16] | Veterans Affairs (VA) users must ensure VA sensitive data is properly protected in compliance with all VA regulations. All instances of deployment using this technology should be reviewed by the local ISSO (Information System Security Officer) to ensure compliance with both VA Handbook 6500 and VA Directive 6500. | | | [17] | The Federal Information Processing standards (FIPS) 140-2 certification status of this technology was not able to be verified. This technology will require a 3rd party FIPS 140-2 or 140-3 certified solution for any data containing PHI/PII or VA sensitive information, where applicable. More information regarding the Cryptographic Module Validation Program (CMVP) can be found on the NIST website. | | | [18] | This technology has received one or more VA security bulletins that provide specific guidance on vulnerability patching and mitigation. It is the responsibility of VA system owners to ensure that the appropriate mitigations are taken to address all known and future discovered vulnerabilities with this product. See the Reference tab for more information on security bulletins related to this product. |
|
