CVE-2017-10345: Low severity Oracle JDK vulnerability
It was discovered that the implementation of the JceKeyStore class in the Serialization component of OpenJDK did not limit the amount of resources allocated when reading serialized objects from a jceks key store. A specially-crafted key store file could cause a Java application to use an excessive amount of resources when used.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10345?
CVE-2017-10345 has a moderate severity rating due to the potential for resource exhaustion when processing crafted key store files.
How do I fix CVE-2017-10345?
To mitigate CVE-2017-10345, update to the latest version of OpenJDK or apply the patch provided by your operating system vendor.
Which software versions are affected by CVE-2017-10345?
CVE-2017-10345 affects specific versions of OpenJDK and JRE, including versions 1.6.0-update161, 1.7.0-update151, and 1.8.0-update144.
What can happen if CVE-2017-10345 is exploited?
If exploited, CVE-2017-10345 can lead to excessive resource usage, potentially crashing Java applications.
Is CVE-2017-10345 considered a remote code execution vulnerability?
No, CVE-2017-10345 is not a remote code execution vulnerability; it primarily leads to resource exhaustion.