CVE-2016-5546: High severity Oracle JDK vulnerability
It was discovered that the ECDSASignature class in the Libraries component of OpenJDK accepted signatures using non-canonical DER encoding. This could cause a Java application to accept signature in an incorrect format not accepted by other cryptographic tools.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, JRockit accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS v3.0 Base Score 7.5 (Integrity impacts).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5546?
CVE-2016-5546 is classified as a medium severity vulnerability.
How do I fix CVE-2016-5546?
To fix CVE-2016-5546, update your OpenJDK or JDK/JRE to the latest version available for your system.
What versions of JDK are affected by CVE-2016-5546?
CVE-2016-5546 affects specific versions of Oracle JDK 6, 7, 8, and certain versions of OpenJDK and JRE.
What potential impact does CVE-2016-5546 have?
CVE-2016-5546 could lead to Java applications accepting malformed signatures that may compromise integrity and security.
Is my application at risk due to CVE-2016-5546?
If your application uses affected versions of Java and relies on the ECDSASignature class, it may be at risk due to CVE-2016-5546.