REDHAT-BUG-1471535
First published: Sun Jul 16 2017(Updated: )
It was discovered that the JAR (Java ARchive) verifier in the Security component of OpenJDK did not correctly handle files inside archives with missing digest. An attacker could possibly use this flaw to manipulate content of a singed JAR, bypassing intended verification.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/c729ab3b13ae
- https://access.redhat.com/errata/RHSA-2017:1792
- https://access.redhat.com/errata/RHSA-2017:1791
- https://access.redhat.com/errata/RHSA-2017:1790
- https://access.redhat.com/errata/RHSA-2017:1789
- https://access.redhat.com/errata/RHSA-2017:2424
- https://access.redhat.com/errata/RHSA-2017:2469
- https://access.redhat.com/errata/RHSA-2017:2481
- https://access.redhat.com/errata/RHSA-2017:2530
- https://access.redhat.com/errata/RHSA-2017:3453
- https://bugzilla.redhat.com/show_bug.cgi?id=1471535
Frequently Asked Questions
What is the severity of REDHAT-BUG-1471535?
The severity of REDHAT-BUG-1471535 is classified as high due to its potential to allow content manipulation of signed JAR files.
How do I fix REDHAT-BUG-1471535?
To fix REDHAT-BUG-1471535, update to the latest version of OpenJDK that contains the security patch addressing this vulnerability.
What is the impact of REDHAT-BUG-1471535?
The impact of REDHAT-BUG-1471535 allows attackers to bypass intended verification of signed JAR files, potentially leading to malicious code execution.
Which software is affected by REDHAT-BUG-1471535?
REDHAT-BUG-1471535 affects the OpenJDK security component, specifically during the verification of JAR files.
Can I mitigate REDHAT-BUG-1471535 without updating OpenJDK?
Mitigating REDHAT-BUG-1471535 without updating OpenJDK is challenging; the best practice is to apply the necessary updates as they are released.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10067
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openjdk
- canonical/openjdk