REDHAT-BUG-1413920: High severity openjdk vulnerability

Published Jan 17, 2017

Updated

A covert timing channel flaw was found in the DSA implementation in the Libraries component of OpenJDK. A remote attacker able to make a Java application generate DSA signatures on demand could possibly use this flaw to extract certain information about the used key via a timing side channel.

Affected Software

1 affected component

OpenJDK OpenJDK

Event History

Jan 17, 2017

Data Sourced

via Red Hat·10:25 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1413920?

The severity of REDHAT-BUG-1413920 is considered critical due to the potential for information leakage via a covert timing channel.

How can I mitigate REDHAT-BUG-1413920?

To mitigate REDHAT-BUG-1413920, you should apply the latest security patches for OpenJDK provided by your vendor.

What systems are affected by REDHAT-BUG-1413920?

REDHAT-BUG-1413920 affects systems running vulnerable versions of OpenJDK that utilize the DSA signature generation.

What is the potential impact of exploiting REDHAT-BUG-1413920?

Exploiting REDHAT-BUG-1413920 could allow an attacker to infer sensitive information about cryptographic keys using timing attacks.

How was REDHAT-BUG-1413920 discovered?

REDHAT-BUG-1413920 was discovered through analysis of the DSA implementation in OpenJDK, highlighting its vulnerability to covert timing channels.