REDHAT-BUG-1385714: Medium severity OpenJDK JMX component vulnerability

Published Oct 17, 2016

Updated

It was discovered that the ClassLoaderWithRepository class in the JMX component of OpenJDK did not sufficiently perform classloader consistency checks, allowing classloader to return class with different name than requested. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Affected Software

1 affected component

OpenJDK JMX component

Event History

Oct 17, 2016

Data Sourced

via Red Hat·02:49 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1385714?

The severity of REDHAT-BUG-1385714 is critical due to the potential for untrusted Java applications to bypass security checks.

How do I fix REDHAT-BUG-1385714?

To fix REDHAT-BUG-1385714, you should update the OpenJDK JMX component to the latest version that addresses this vulnerability.

What versions of OpenJDK are affected by REDHAT-BUG-1385714?

REDHAT-BUG-1385714 affects certain versions of the OpenJDK JMX component, but specific impacted versions should be verified in security advisories.

What impact does REDHAT-BUG-1385714 have on Java applications?

REDHAT-BUG-1385714 allows untrusted Java applications to potentially load classes with different names, leading to security vulnerabilities.

Is there a workaround for REDHAT-BUG-1385714?

Currently, the recommended approach for REDHAT-BUG-1385714 is to apply the available patches rather than relying on workarounds.