REDHAT-BUG-1535036
First published: Tue Jan 16 2018(Updated: )
It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make the LDAPCertStore fetch attacker-controlled certificate data.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2018:0095
- https://access.redhat.com/errata/RHSA-2018:0099
- https://access.redhat.com/errata/RHSA-2018:0100
- https://access.redhat.com/errata/RHSA-2018:0115
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/6c4b009c1573
- https://access.redhat.com/errata/RHSA-2018:0351
- https://access.redhat.com/errata/RHSA-2018:0352
- https://access.redhat.com/errata/RHSA-2018:0349
- https://access.redhat.com/errata/RHSA-2018:0458
- https://access.redhat.com/errata/RHSA-2018:0521
- https://access.redhat.com/errata/RHSA-2018:1463
- https://access.redhat.com/errata/RHSA-2018:1812
- https://bugzilla.redhat.com/show_bug.cgi?id=1535036
Frequently Asked Questions
What is the severity of REDHAT-BUG-1535036?
The vulnerability is considered to have a high severity due to the potential for an attacker to control certificate data.
How do I fix REDHAT-BUG-1535036?
To mitigate the risk of REDHAT-BUG-1535036, upgrade to the latest version of OpenJDK that includes the security patch.
What types of attacks can REDHAT-BUG-1535036 facilitate?
This vulnerability can potentially facilitate man-in-the-middle attacks by allowing an attacker to supply malicious certificates.
What software does REDHAT-BUG-1535036 affect?
REDHAT-BUG-1535036 mainly affects the JNDI component in Oracle OpenJDK.
Is there a CVE associated with REDHAT-BUG-1535036?
Yes, REDHAT-BUG-1535036 may have an associated CVE ID that provides more details about the vulnerability.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-2633
- agent/source
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 17