Sync fixed version for openjdk-8 with unstable upload

One seem additionally reference which was not tracked and needs double
check which side was wrong: CVE-2019-2987

One is Oracle specific and not further tracked.