CVE-2016-3426: Medium severity oracle java se 7 vulnerability
It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component of OpenJDK used non-constant time comparison when comparing GCM authentication tag. A remote attacker could possibly use this flaw to determine correct value of the authentication tag and bypass authentication protections of GCM.
Other sources
Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3426?
CVE-2016-3426 is classified as a high severity vulnerability due to the potential for remote attackers to bypass authentication.
How do I fix CVE-2016-3426?
To fix CVE-2016-3426, update your OpenJDK to a version that includes the security patches addressing this vulnerability.
What software is affected by CVE-2016-3426?
CVE-2016-3426 affects Oracle JDK and JRE version 1.8.0-update77.
What type of attack is possible with CVE-2016-3426?
An attacker can exploit CVE-2016-3426 to perform a remote attack that may allow them to determine the correct value of the GCM authentication tag.
Why is CVE-2016-3426 considered a security risk?
CVE-2016-3426 is a security risk because it uses non-constant time comparison, making it vulnerable to timing attacks that could lead to authentication bypass.