First published: Tue Jan 16 2018(Updated: )
It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make the LDAPCertStore fetch attacker-controlled certificate data.
Credit: secalert_us@oracle.com secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
debian/openjdk-8 | 8u442-ga-2 | |
Oracle Java SE 7 | =1.6.0-update171 | |
Oracle Java SE 7 | =1.7.0-update161 | |
Oracle Java SE 7 | =1.8.0-update152 | |
Oracle Java SE 7 | =9.0.1 | |
Oracle JRE | =1.6.0-update171 | |
Oracle JRE | =1.7.0-update161 | |
Oracle JRE | =1.8.0-update152 | |
Oracle JRE | =9.0.1 | |
Oracle Java SE | =r28.3.16 | |
Red Hat Satellite | =5.6 | |
Red Hat Satellite | =5.7 | |
Red Hat Satellite | =5.8 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.5 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Debian Linux | =7.0 | |
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Ubuntu | =14.04 | |
Ubuntu | =16.04 | |
Ubuntu | =17.10 | |
Schneider Electric EcoStruxure Data Center Expert | <7.6.0 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP StorageWorks Command View | >=8.6.2-01 | |
HP P9000 Command View Advanced Edition Software | >=8.6.2-01 | |
Oracle Java SE 7 | =1.9.0.1 | |
Oracle JRE | =1.9.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2018-2633 is high with a CVSS score of 8.3.
The affected versions of Java SE are 6u171, 7u161, 8u152, and 9.0.1.
CVE-2018-2633 can be exploited by an unauthenticated attacker, but it is difficult to exploit.
To fix CVE-2018-2633, update to OpenJDK version 8u382-ga-2 for Debian, or follow the remediation steps provided by your Linux distribution or Oracle.
You can find more information about CVE-2018-2633 on the Oracle website, as well as security advisories and trackers.