REDHAT-BUG-1535036: High severity openjdk 8 vulnerability

Published Jan 16, 2018

Updated

It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make the LDAPCertStore fetch attacker-controlled certificate data.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jan 16, 2018

Data Sourced

via Red Hat·02:23 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1535036?

The vulnerability is considered to have a high severity due to the potential for an attacker to control certificate data.

How do I fix REDHAT-BUG-1535036?

To mitigate the risk of REDHAT-BUG-1535036, upgrade to the latest version of OpenJDK that includes the security patch.

What types of attacks can REDHAT-BUG-1535036 facilitate?

This vulnerability can potentially facilitate man-in-the-middle attacks by allowing an attacker to supply malicious certificates.

What software does REDHAT-BUG-1535036 affect?

REDHAT-BUG-1535036 mainly affects the JNDI component in Oracle OpenJDK.

Is there a CVE associated with REDHAT-BUG-1535036?

Yes, REDHAT-BUG-1535036 may have an associated CVE ID that provides more details about the vulnerability.