REDHAT-BUG-1502038: High severity openjdk 8 vulnerability

Published Oct 13, 2017

Updated

It was discovered that the Kerberos client implementation in the Libraries component of OpenJDK used the sname field from the plain text part rather than encrypted part of the KDC reply. A man-in-the-middle attacker could possibly use this flaw to impersonate Kerberos services to Java applications acting as Kerberos clients.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Oct 13, 2017

Data Sourced

via Red Hat·07:23 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1502038?

The severity of REDHAT-BUG-1502038 is high due to its potential for man-in-the-middle attacks.

How do I fix REDHAT-BUG-1502038?

To fix REDHAT-BUG-1502038, update your OpenJDK to the latest version that includes the security patch.

What software is affected by REDHAT-BUG-1502038?

REDHAT-BUG-1502038 affects the OpenJDK 17 implementation used by Oracle.

What type of attack does REDHAT-BUG-1502038 allow?

REDHAT-BUG-1502038 allows a man-in-the-middle attacker to impersonate Kerberos services.

Which component is vulnerable in REDHAT-BUG-1502038?

The Libraries component of OpenJDK is vulnerable as identified in REDHAT-BUG-1502038.