REDHAT-BUG-1241965: Low severity sun jsse vulnerability
A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid.
This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection.
With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1241965?
The severity of REDHAT-BUG-1241965 is categorized as high due to potential exposure to man-in-the-middle attacks.
How do I fix REDHAT-BUG-1241965?
To fix REDHAT-BUG-1241965, update your OpenJDK to the latest patched version that addresses the flaw.
What software is affected by REDHAT-BUG-1241965?
REDHAT-BUG-1241965 affects the JSSE component of OpenJDK.
What vulnerability type is described in REDHAT-BUG-1241965?
REDHAT-BUG-1241965 describes a vulnerability related to improper certificate verification in TLS/SSL connections.
Is there any workaround for REDHAT-BUG-1241965 until it is fixed?
There is no recommended workaround for REDHAT-BUG-1241965; updating to a secure version is the best course of action.