CVE-2017-10118: High severity oracle java se 7 vulnerability

Published Jul 18, 2017

Updated

A covert timing channel flaw was found in the ECDSA implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application generate ECDSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel.

Other sources

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

— MITRE

Affected Software

31 affected components

Oracle JDK=1.7.0-update141

Oracle JDK=1.8.0-update131

Oracle JRE=1.7.0-update141

Oracle JRE=1.8.0-update131

Oracle Jrockit=r28.3.14

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Phoenixcontact Fl Mguard Dm<=1.8.0

NetApp Active Iq Unified Manager Windows>=7.3

NetApp Active Iq Unified Manager Vmware Vsphere>=9.5

NetApp Cloud Backup

NetApp E-Series SANtricity OS Controller>=11.0<=11.70.1

NetApp E-series Santricity Storage Manager

NetApp Element Software

NetApp OnCommand Balance

NetApp OnCommand Insight

NetApp Oncommand Performance Manager Vmware Vsphere

NetApp Oncommand Shift

NetApp Oncommand Unified Manager Vsphere<=7.1

NetApp Oncommand Unified Manager Windows<=7.1

NetApp Oncommand Unified Manager 7-mode

NetApp Plug-in For Symantec Netbackup

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Steelstore Cloud Integrated Storage

NetApp Storage Replication Adapter For Clustered Data Ontap Windows>=7.2

NetApp Storage Replication Adapter For Clustered Data Ontap Vmware Vsphere=9.6

NetApp Vasa Provider For Clustered Data Ontap>=7.2

NetApp Vasa Provider For Clustered Data Ontap=6.0

NetApp Virtual Storage Console Vmware Vsphere>=7.2

NetApp Virtual Storage Console Vmware Vsphere=6.0

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Event History

Jul 18, 2017

Data Sourced

via Red Hat·08:12 PM

DescriptionSeverityAffected Software

Aug 8, 2017

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-10118?

CVE-2017-10118 is classified as easily exploitable, allowing unauthenticated attackers with network access to exploit the vulnerability.

How do I fix CVE-2017-10118?

To fix CVE-2017-10118, update your Oracle Java SE or JRockit installations to the respective patched versions 7u141 or 8u131.

What versions are affected by CVE-2017-10118?

CVE-2017-10118 affects Oracle Java SE versions 7u141 and 8u131, as well as JRockit version R28.3.14.

Can CVE-2017-10118 affect applications using third-party libraries?

Yes, CVE-2017-10118 can affect any application that relies on the vulnerable versions of Oracle Java SE or JRockit.

Is there a workaround for CVE-2017-10118?

There are no specific workarounds for CVE-2017-10118, so upgrading to the latest secure versions is the recommended mitigation.