CVE-2015-2625: Low severity oracle java se 7 vulnerability
A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid.
This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection.
With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check.
Other sources
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2625?
The severity of CVE-2015-2625 is low, with a severity score of 2.6.
Which versions of Oracle Java SE are affected by CVE-2015-2625?
Oracle Java SE versions 6u95, 7u80, and 8u45 are affected by CVE-2015-2625.
How can a remote attacker exploit CVE-2015-2625?
A remote attacker can exploit CVE-2015-2625 to affect confidentiality via vectors related to JSSE.
What is the official reference for CVE-2015-2625?
The official references for CVE-2015-2625 can be found at the following links: [1](http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html#AppendixJAVA), [2](http://www.oracle.com/technetwork/java/javase/8u51-relnotes-2587590.html), [3](http://www.oracle.com/technetwork/java/javase/7u85-relnotes-2587591.html).
How do I fix the vulnerability identified in CVE-2015-2625?
To fix the vulnerability in CVE-2015-2625, it is recommended to update to the latest patched version of Oracle Java SE.