CVE-2016-5597: Infoleak

First published: Tue Oct 18 2016(Updated: )

A flaw was found in the way the Networking component of OpenJDK handled HTTP proxy authentication. A Java application could possibly expose HTTPS server authentication credentials via a plain text network connection to an HTTP proxy if proxy asked for authentication. Two new network system properties are introduced as part of the fix which restrict HTTP authentication schemes that can be used for authentication to proxy depending on whether proxied request is HTTP or HTTPS: - jdk.http.auth.proxying.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTP request. No schemes are disabled by default. - jdk.http.auth.tunneling.disabledSchemes lists authentication schemes that can not be used for proxy authentication when proxying HTTPS request (using HTTP CONNECT method). The 'Basic' HTTP authentication scheme is disabled by default.

Credit: secalert_us@oracle.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/weakness
• agent/author
• agent/type
• agent/remedy
• agent/last-modified-date
• agent/first-publish-date
• agent/softwarecombine
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2016-5597
• agent/severity
• agent/references
• agent/tags
• agent/description
• agent/event
• collector/mitre-cve
• source/MITRE
• vendor/oracle
• canonical/oracle jdk
• version/oracle jdk/1.6.0-update121
• version/oracle jdk/1.7.0-update111
• version/oracle jdk/1.8.0-update101
• version/oracle jdk/1.8.0-update102
• canonical/oracle jre
• version/oracle jre/1.6.0-update121
• version/oracle jre/1.7.0-update111
• version/oracle jre/1.8.0-update101
• version/oracle jre/1.8.0-update102