CVE-2016-5542: Medium severity oracle java se 7 vulnerability
It was discovered that the Libraries component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm.
The fix for this issue adds new security property - jdk.jar.disabledAlgorithms - which defines a set of algorithms not allowed to be used during Jar verification. MD2 hash algorithm and RSA keys with less than 1024 bits are disabled by default. Future updates are also expected to disable MD5 hash algorithm by default.
Other sources
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5542?
CVE-2016-5542 is considered a medium severity vulnerability due to its potential to allow unauthorized modification of Jar file content.
How do I fix CVE-2016-5542?
To fix CVE-2016-5542, update to the latest versions of Oracle JDK and JRE where the vulnerability has been addressed.
What versions are affected by CVE-2016-5542?
CVE-2016-5542 affects Oracle JDK and JRE versions 1.6.0-update121, 1.7.0-update111, 1.8.0-update101, and 1.8.0-update102.
What impact does CVE-2016-5542 have on security?
CVE-2016-5542 allows attackers to potentially exploit weak signing keys or hash algorithms, compromising Jar file integrity.
How can I determine if my system is vulnerable to CVE-2016-5542?
You can determine if your system is vulnerable to CVE-2016-5542 by checking the version of Oracle JDK or JRE installed and comparing it to the affected versions.