CVE-2018-2618: Medium severity Oracle JDK vulnerability
It was discovered that the DHKeyAgreement and P11KeyAgreement implementations in the JCE component of OpenJDK did not guarantee sufficient strength of used keys to adequately protect generated shared secret. This could make it easier to break encryption by attacking key agreement rather than the encryption using the negotiated key.
The patch for this issue causes classes' method generateSecret(String algorithm) to fail unless it's call for "TlsPremasterSecret", or the "jdk.crypto.KeyAgreement.legacyKDF" system property is set to true.
Other sources
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2618?
The severity of CVE-2018-2618 is medium, with a CVSS score of 5.9.
What is the impacted software for CVE-2018-2618?
The impacted software for CVE-2018-2618 includes Java SE 6u171, 7u161, 8u152, and 9.0.1; Java SE Embedded 8u151; and JRockit R28.3.16.
How can I fix CVE-2018-2618?
To fix CVE-2018-2618, upgrade to OpenJDK 8u382-ga-2 (for Debian) or OpenJDK 7 or 8 (for Ubuntu).
Are Oracle JDK and JRE affected by CVE-2018-2618?
Yes, Oracle JDK versions 1.6.0-update171, 1.7.0-update161, 1.8.0-update152, and 1.9.0.1, as well as Oracle JRE versions 1.6.0-update171, 1.7.0-update161, 1.8.0-update152, and 1.9.0.1 are affected by CVE-2018-2618.
Are Redhat Satellite and Redhat Enterprise Linux affected by CVE-2018-2618?
Yes, Redhat Satellite versions 5.6, 5.7, and 5.8, as well as Redhat Enterprise Linux versions 6.0, 7.0, 7.4, 7.5, and 7.6 are affected by CVE-2018-2618.