First published: Tue Oct 17 2017(Updated: )
It was discovered that key store implementations in the Security component of OpenJDK did not use sufficient number of iterations when generating password-based encryption keys used to protect private keys in key stores. This made it easier to perform password guessing attacks to decrypt stored keys if an attacker could gain access to a key store.
Credit: secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u382-ga-2 | |
Oracle Java SE 7 | =1.6.0-update161 | |
Oracle Java SE 7 | =1.7.0-update151 | |
Oracle Java SE 7 | =1.8.0-update144 | |
Oracle Java SE 7 | =1.9.0 | |
Oracle JRE | =1.6.0-update161 | |
Oracle JRE | =1.7.0-update151 | |
Oracle JRE | =1.8.0-update144 | |
Oracle JRE | =1.9.0 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server EUS | =7.4 | |
Red Hat Enterprise Linux Server EUS | =7.5 | |
Red Hat Enterprise Linux Server EUS | =7.6 | |
Red Hat Enterprise Linux Server EUS | =7.7 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
NetApp Active IQ Unified Manager | >=7.3 | |
NetApp Active IQ Unified Manager for VMware vSphere | >=9.5 | |
NetApp Cloud Backup | ||
NetApp E-Series SANtricity Management Plug-ins for VMware vCenter | ||
NetApp E-Series SANtricity OS Controller | >=11.0<=11.70.1 | |
NetApp SANtricity Storage Manager | ||
NetApp E-Series SANtricity Web Services | ||
NetApp Management Services for Element Software | ||
NetApp OnCommand Balance | ||
NetApp OnCommand Insight | ||
NetApp OnCommand Performance Manager | ||
NetApp OnCommand Shift | ||
NetApp OnCommand Unified Manager for vSphere | <=7.1 | |
NetApp OnCommand Unified Manager for Windows | <=7.1 | |
NetApp OnCommand Unified Manager for 7-Mode | ||
NetApp OnCommand Workflow Automation | ||
NetApp Plug-in for Symantec NetBackup | ||
NetApp SnapManager for Oracle | ||
NetApp SnapManager for SAP | ||
NetApp SteelStore Cloud Integrated Storage | ||
NetApp Storage Replication Adapter for Clustered Data ONTAP for VMware vSphere | >=7.2 | |
NetApp Storage Replication Adapter for Clustered Data ONTAP | >=7.2 | |
NetApp VASA Provider | >=7.2 | |
NetApp VASA Provider | =6.0 | |
NetApp Virtual Storage Console for VMware vSphere | >=7.2 | |
NetApp Virtual Storage Console for VMware vSphere | =6.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2017-10356 has a critical severity rating due to the potential for password guessing attacks against encrypted keys.
To fix CVE-2017-10356, upgrade to the latest version of the affected OpenJDK or Oracle JDK that addresses the vulnerability.
CVE-2017-10356 affects specific versions of OpenJDK and Oracle JDK, including OpenJDK 8u382, Oracle JDK 6, 7, 8, and 9.
CVE-2017-10356 can lead to password guessing attacks, allowing unauthorized access to sensitive private keys.
While there are no specific reports of active exploits for CVE-2017-10356, it is advisable to patch systems to mitigate potential risks.