CVE-2016-5542

First published: Mon Oct 17 2016(Updated: )

It was discovered that the Libraries component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm. The fix for this issue adds new security property - jdk.jar.disabledAlgorithms - which defines a set of algorithms not allowed to be used during Jar verification. MD2 hash algorithm and RSA keys with less than 1024 bits are disabled by default. Future updates are also expected to disable MD5 hash algorithm by default.

Credit: secalert_us@oracle.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/first-publish-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2016-5542
• agent/references
• agent/author
• agent/severity
• agent/remedy
• agent/description
• agent/event
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/source
• agent/softwarecombine
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• vendor/oracle
• canonical/oracle jdk 6
• version/oracle jdk 6/1.6.0-update121
• version/oracle jdk 6/1.7.0-update111
• version/oracle jdk 6/1.8.0-update101
• version/oracle jdk 6/1.8.0-update102
• canonical/oracle java runtime environment (jre)
• version/oracle java runtime environment (jre)/1.6.0-update121
• version/oracle java runtime environment (jre)/1.7.0-update111
• version/oracle java runtime environment (jre)/1.8.0-update101
• version/oracle java runtime environment (jre)/1.8.0-update102