CVE-2017-10135: Medium severity oracle java se 7 vulnerability
A covert timing channel flaw was found in the PKCS#8 implementation in the JCE component of OpenJDK. A remote attacker able to make a Java application repeatedly compared PKCS#8 key against an attacker controlled value could possibly use this flaw to determine the key via a timing side channel.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10135?
CVE-2017-10135 has a medium severity rating due to its characteristics and potential impact.
How do I fix CVE-2017-10135?
To fix CVE-2017-10135, you should update to a version of Java SE that is not affected, such as the latest updates for 6u151, 7u141, or 8u131.
Who is affected by CVE-2017-10135?
CVE-2017-10135 affects users of Oracle Java SE versions 6u151, 7u141, 8u131, and specific versions of JRockit.
What kind of attack does CVE-2017-10135 allow?
CVE-2017-10135 allows an unauthenticated attacker to exploit the vulnerability remotely without the need for special privileges.
Is there a workaround for CVE-2017-10135?
There are no recommended workarounds for CVE-2017-10135 other than updating to secure versions of the affected software.