First published: Sun Jan 14 2018(Updated: )
It was discovered that multiple encryption key classes (DESKey, DESedeKey, PBEKey, PBKDF2KeyImpl) in the crypto provider in the Libraries component of OpenJDK did not properly synchronize access to their internal key data from multiple threads. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of use of key that was zeroed out during object finalization.
Credit: secalert_us@oracle.com secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u442-ga-2 | |
Oracle Java SE 7 | =1.6.0-update171 | |
Oracle Java SE 7 | =1.7.0-update161 | |
Oracle Java SE 7 | =1.8.0-update152 | |
Oracle Java SE 7 | =9.0.1 | |
Oracle JRE | =1.6.0-update171 | |
Oracle JRE | =1.7.0-update161 | |
Oracle JRE | =1.8.0-update152 | |
Oracle JRE | =9.0.1 | |
Oracle Java SE | =r28.3.16 | |
Red Hat Satellite | =5.6 | |
Red Hat Satellite | =5.7 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.5 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =17.10 | |
Schneider Electric EcoStruxure Data Center Expert | <7.6.0 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP P9000 Command View Advanced Edition Software | >=8.6.2-01 | |
Oracle Java SE 7 | =1.9.0.1 | |
Oracle JRE | =1.9.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-2579 is a vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries) that allows unauthenticated attacks.
The affected versions are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16.
The severity of CVE-2018-2579 is medium.
To fix CVE-2018-2579, update to the latest versions of Java SE, Java SE Embedded, or JRockit as recommended by Oracle.
You can find more information about CVE-2018-2579 on the Oracle website and security advisories.