REDHAT-BUG-1534298: Weak Encryption
First published: Sun Jan 14 2018(Updated: )
It was discovered that multiple encryption key classes (DESKey, DESedeKey, PBEKey, PBKDF2KeyImpl) in the crypto provider in the Libraries component of OpenJDK did not properly synchronize access to their internal key data from multiple threads. This could possibly cause a multi-threaded Java application to apply weak encryption to data because of use of key that was zeroed out during object finalization.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2018:0095
- https://access.redhat.com/errata/RHSA-2018:0099
- https://access.redhat.com/errata/RHSA-2018:0100
- https://access.redhat.com/errata/RHSA-2018:0115
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/521f330bda2f
- https://access.redhat.com/errata/RHSA-2018:0351
- https://access.redhat.com/errata/RHSA-2018:0352
- https://access.redhat.com/errata/RHSA-2018:0349
- https://access.redhat.com/errata/RHSA-2018:0458
- https://access.redhat.com/errata/RHSA-2018:0521
- https://access.redhat.com/errata/RHSA-2018:1463
- https://access.redhat.com/errata/RHSA-2018:1812
- https://bugzilla.redhat.com/show_bug.cgi?id=1534298
Frequently Asked Questions
What is the severity of REDHAT-BUG-1534298?
The severity of REDHAT-BUG-1534298 is classified as moderate, indicating a potential risk in multi-threaded Java applications using affected encryption key classes.
How do I fix REDHAT-BUG-1534298?
To fix REDHAT-BUG-1534298, you should update to the latest version of OpenJDK that includes the patch for this vulnerability.
Which versions of OpenJDK are affected by REDHAT-BUG-1534298?
REDHAT-BUG-1534298 affects multiple versions of OpenJDK, particularly those that include the DESKey, DESedeKey, PBEKey, and PBKDF2KeyImpl classes.
What are the implications of not addressing REDHAT-BUG-1534298?
Failing to address REDHAT-BUG-1534298 may lead to vulnerabilities in multi-threaded applications, potentially exposing key data.
Is there any workaround for REDHAT-BUG-1534298?
Currently, there are no recommended workarounds for REDHAT-BUG-1534298, and up-to-date patches are the best solution.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-2579
- agent/source
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 8