CVE-2015-4872: Medium severity oracle java se vulnerability
It was discovered that the AlgorithmChecker class in the Security component of OpenJDK failed to properly check if a certificate satisfies all defined constraints in certain cases. This could cause a Java application to accept an X.509 certificate which does not meet requirements of the policy defined in the java.security file.
Other sources
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4872?
CVE-2015-4872 is classified as a high severity vulnerability due to its potential impact on certificate validation.
How do I fix CVE-2015-4872?
To fix CVE-2015-4872, update to the latest version of Oracle JDK or JRE that resolves the vulnerability.
What types of applications are affected by CVE-2015-4872?
CVE-2015-4872 affects Java applications that rely on the Security components of OpenJDK for certificate validation.
What is the impact of CVE-2015-4872?
The impact of CVE-2015-4872 is that it may allow Java applications to incorrectly accept invalid X.509 certificates.
Which versions of Oracle JDK are vulnerable to CVE-2015-4872?
CVE-2015-4872 affects specific versions of Oracle JDK including those in the 1.6.0, 1.7.0, and 1.8.0 series prior to updates that address the issue.