CVE-2014-4244: Medium severity Oracle JDK vulnerability
It was discovered that the RSA algorithm in the OpenJDK Security component did not sufficiently preform "blinding" while performing operations using private keys. An attacker able to measure timing differences of those operations could possibly leak information about the keys used.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u65, 6u75, 7u60, and 8u5, and JRockit R27.8.2 and JRockit R28.3.2, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4244?
CVE-2014-4244 is considered a high severity vulnerability due to its potential to expose sensitive private key information.
How do I fix CVE-2014-4244?
To fix CVE-2014-4244, update your version of the Oracle JDK or JRE to the latest patched release.
Which versions of software are affected by CVE-2014-4244?
CVE-2014-4244 affects Oracle JDK 1.5.0-update65, 1.6.0-update75, 1.7.0-update60, and 1.8.0-update5, as well as corresponding JRE and BEA JRockit versions.
What type of attack does CVE-2014-4244 enable?
CVE-2014-4244 potentially allows an attacker to exploit timing differences in RSA private key operations to leak key information.
Is there a known exploit for CVE-2014-4244?
As of now, there are no publicly known exploits specifically targeting CVE-2014-4244, but the vulnerability itself poses a risk.