CVE-2017-10295: Medium severity oracle java se 7 vulnerability
It was found that the HttpURLConnection and HttpsURLConnection classes implementations in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application to perform an HTTP request to an attacker provided URL could possibly inject additional headers into the request.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.0 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10295?
CVE-2017-10295 is classified as a medium-severity vulnerability due to potential attacker exploitation.
How do I fix CVE-2017-10295?
To mitigate CVE-2017-10295, upgrade to a patched version of OpenJDK or Oracle JDK that addresses this vulnerability.
What types of applications are impacted by CVE-2017-10295?
CVE-2017-10295 can affect any Java application that uses HttpURLConnection or HttpsURLConnection for HTTP requests.
Which versions of Java are affected by CVE-2017-10295?
CVE-2017-10295 affects several versions of Oracle JDK and OpenJDK, including versions 1.6, 1.7, and 1.8 up to specified update numbers.
What is the attack vector for CVE-2017-10295?
An attacker can exploit CVE-2017-10295 by supplying a specially crafted URL that could lead to unauthorized actions within a Java application.