REDHAT-BUG-1567126: High severity openjdk 8 vulnerability
It was discovered that the Security component of OpenJDK did not restrict which classes could be used when deserializing keys form the JCEKS key stores. A specially crafted JCEKS key store could possibly use this flaw to execute arbitrary code with the privileges of an application reading data form the key store.
The fix adds support for a new security property jceks.key.serialFilter which can be used to specify classes that can be used when deserializing data from the JCEKS key stores.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1567126?
The severity of REDHAT-BUG-1567126 is classified as critical due to the potential for executing arbitrary code.
How do I fix REDHAT-BUG-1567126?
To fix REDHAT-BUG-1567126, update to the latest version of Oracle OpenJDK that addresses this vulnerability.
Which versions of OpenJDK are affected by REDHAT-BUG-1567126?
REDHAT-BUG-1567126 affects OpenJDK 17 and potentially earlier versions.
What is the risk of not addressing REDHAT-BUG-1567126?
Not addressing REDHAT-BUG-1567126 poses a risk of arbitrary code execution, which can compromise system security.
Is there a workaround for REDHAT-BUG-1567126?
Currently, there are no defined workarounds for REDHAT-BUG-1567126 other than applying the relevant updates.