CVE-2017-10198: Medium severity oracle java se 7 vulnerability
It was discovered that the Security component of OpenJDK could fail to properly enforce restrictions (specified using the jdk.certpath.disabledAlgorithms security property) defined for processing of X.509 certificate chains. A remote attacker could possibly use this flaw to make Java accept certificate using one of the disabled algorithms.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10198?
CVE-2017-10198 is rated as a low-severity vulnerability that is difficult to exploit.
How do I fix CVE-2017-10198?
To fix CVE-2017-10198, update your Oracle Java SE to a supported version beyond the affected updates.
Which versions are affected by CVE-2017-10198?
The affected versions include Java SE 6u151, 7u141, and 8u131, along with Java SE Embedded 8u131 and JRockit R28.3.14.
What type of vulnerability is CVE-2017-10198?
CVE-2017-10198 is a security vulnerability in Oracle Java SE that allows unauthorized access.
Who is impacted by CVE-2017-10198?
Users of Oracle Java SE and JRockit in the specified versions are impacted by CVE-2017-10198.