CVE-2014-6593: Medium severity ORACLE Jrockit vulnerability
It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check if the ChangeCipherSpec was received during SSL/TLS connection handshake. A man-in-the-middle attacker could possibly use this flaw to force connection to be established without encryption being enabled.
Other sources
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit 27.8.4 and 28.3.4 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6593?
CVE-2014-6593 is considered a critical vulnerability that can impact both confidentiality and integrity.
How do I fix CVE-2014-6593?
To fix CVE-2014-6593, you should update your Java SE or JRockit installations to the latest version provided by Oracle.
What software is affected by CVE-2014-6593?
CVE-2014-6593 affects Oracle Java SE versions 5.0u75, 6u85, 7u72, 8u25, as well as JRockit versions 27.8.4 and 28.3.4.
Can CVE-2014-6593 be exploited remotely?
Yes, CVE-2014-6593 can be exploited by remote attackers, potentially allowing unauthorized access to sensitive data.
What are the potential impacts of CVE-2014-6593?
The potential impacts of CVE-2014-6593 include unauthorized access, data leaks, and manipulation of sensitive information.