CVE-2016-0448: Medium severity Oracle JDK vulnerability
It was discovered that the RMIConnector and RMIConnectionImpl classes in the JMX component of OpenJDK could log sensitive information such as user passwords in its debug log, possibly leading the exposure of the information.
Other sources
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0448?
CVE-2016-0448 is considered a medium severity vulnerability due to the potential exposure of sensitive information such as user passwords.
How do I fix CVE-2016-0448?
To address CVE-2016-0448, update your Java SE or JDK to a version that has mitigated this logging issue.
Which versions are affected by CVE-2016-0448?
CVE-2016-0448 affects Oracle JDK versions 1.6.0-update105, 1.7.0-update91, 1.8.0-update66, and specific versions of Oracle JRE and Ubuntu Linux.
What components are impacted by CVE-2016-0448?
CVE-2016-0448 impacts the RMIConnector and RMIConnectionImpl classes within the JMX component of OpenJDK.
What information is exposed due to CVE-2016-0448?
CVE-2016-0448 can expose sensitive information such as user passwords via its debug logging feature.