Does SAP Have an Extended Support contract with Oracle for JDK6 for SAPJVM 6.1?

[former_member250295]

(repost from BI Platform forum)

I have been asked by our security management team to confirm whether or not SAP has an active Extended Support contract with Oracle to continue to provide vulnerability remediation for newly discovered JDK/JRE6 vulnerabilities.  Since SAPJVM 6.1 is a modified Oracle Java 6 stack, and BI 4.1 currently uses SAPJVM 6.1, one could infer that at least some of the vulnerabilities discovered in Oracle Java 6 apply to SAPJVM 6.1.

Does SAP have an active Extended Support contract with Oracle for Oracle Java 6 updates?

Is Oracle actively passing Oracle JDK6 patches to SAP for inclusion in SAPJVM 6.1?

Is SAP actively using the Oracle JDK source code and correcting vulnerabilities independently of Oracle?

Thank you for your help.

[former_member280851 · Accepted solution]

Hello Garrick,

we are fully supporting all SAP versions: SAP JVM 4 - 8.

That means security patches are provided for all SAP JVM versions on a quarterly basis. Whenever Oracle provides new security patches for their JDK versions, we are providing corresponding patches for all SAP JVM versions including SAP JVM 6.

Best regards,

Michael