REDHAT-BUG-1502053
First published: Fri Oct 13 2017(Updated: )
It was discovered that the CardImpl class in the Smart Card IO component of OpenJDK failed to properly update its state in the finalize() method. An untrusted Java application or applet could possibly use this flaw to gain unexpected access to a smart card, bypassing certain Java sandbox restrictions.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/8913fd33ceee
- https://access.redhat.com/errata/RHSA-2017:2998
- https://access.redhat.com/errata/RHSA-2017:2999
- https://access.redhat.com/errata/RHSA-2017:3047
- https://access.redhat.com/errata/RHSA-2017:3046
- https://access.redhat.com/errata/RHSA-2017:3392
- https://bugzilla.redhat.com/show_bug.cgi?id=1502053
Frequently Asked Questions
What is the severity of REDHAT-BUG-1502053?
The vulnerability REDHAT-BUG-1502053 is rated as high severity due to its potential to allow unauthorized access to smart cards.
How do I fix REDHAT-BUG-1502053?
To fix REDHAT-BUG-1502053, you should update to the latest version of the OpenJDK that addresses this vulnerability.
Who is affected by REDHAT-BUG-1502053?
The REDHAT-BUG-1502053 vulnerability affects users running the OpenJDK 17 on systems using the Smart Card IO component.
Can an untrusted application exploit REDHAT-BUG-1502053?
Yes, an untrusted Java application can exploit REDHAT-BUG-1502053 to gain unexpected access to smart cards.
Does REDHAT-BUG-1502053 bypass Java sandbox restrictions?
Yes, REDHAT-BUG-1502053 has the potential to bypass certain Java sandbox restrictions.
- agent/references
- agent/type
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-10274
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 17