REDHAT-BUG-1534943: High severity OpenJDK JGSS vulnerability

Published Jan 16, 2018

Updated

The JGSS component of OpenJDK ignores the value of javax.security.auth.useSubjectCredsOnly when using HTTP/SPNEGO authentication and always uses global credentials, see:

https://bugs.openjdk.java.net/browse/JDK-6560359

This could cause global credentials to be unexpectedly used by an untrusted Java application. The fix adds new system property http.use.global.creds which, when set to false, prevents the use of global credentials.

Affected Software

1 affected component

OpenJDK JGSS

Event History

Jan 16, 2018

Data Sourced

via Red Hat·10:27 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1534943?

The severity of REDHAT-BUG-1534943 is high due to its potential impact on credential handling in HTTP/SPNEGO authentication.

How do I fix REDHAT-BUG-1534943?

To fix REDHAT-BUG-1534943, update to the latest version of OpenJDK that addresses the JGSS credential handling issue.

What systems are affected by REDHAT-BUG-1534943?

Systems using OpenJDK JGSS and HTTP/SPNEGO authentication are affected by REDHAT-BUG-1534943.

What are the potential risks of REDHAT-BUG-1534943?

The potential risks of REDHAT-BUG-1534943 include unauthorized access due to improper handling of credentials.

Is there a workaround for REDHAT-BUG-1534943?

There is currently no official workaround for REDHAT-BUG-1534943, and upgrading is the recommended mitigation.