CVE-2016-5597: Infoleak
A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication.
Two new network system properties are introduced as part of the fix which restrict HTTP authentication schemes that can be used for authentication to proxy depending on whether proxied request is HTTP or HTTPS:
- jdk.http.auth.proxying.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTP request. No schemes are disabled by default.
- jdk.http.auth.tunneling.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTPS request (using HTTP CONNECT method). The 'Basic' HTTP authentication scheme is disabled by default.
Other sources
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-5597?
CVE-2016-5597 is classified as a medium severity vulnerability.
How do I fix CVE-2016-5597?
To mitigate CVE-2016-5597, update to a patched version of Oracle JDK or JRE that addresses this vulnerability.
Which versions are affected by CVE-2016-5597?
CVE-2016-5597 affects Oracle JDK versions 1.6.0-update121, 1.7.0-update111, and 1.8.0-update101 and 1.8.0-update102, as well as the corresponding JRE versions.
What types of applications are impacted by CVE-2016-5597?
Java applications utilizing HTTP proxy authentication may expose HTTPS server authentication credentials due to CVE-2016-5597.
Can CVE-2016-5597 be exploited remotely?
Yes, CVE-2016-5597 could potentially be exploited remotely if a Java application is misconfigured to use an insecure HTTP proxy.