REDHAT-BUG-1639484: Medium severity ORACLE OpenJDK vulnerability
A certificate verification flaw was found in the JSSE component of OpenJDK. No check was preformed during the TLS session resumption to ensure that the same endpoint identification algorithm had been used when originally opening the session as was required when resuming the session. In certain cases, this could lead to having TLS connection established without required server identity verification.
Affected Software
Event History
Frequently Asked Questions
What condition is required for exploitation?
The issue requires TLS session resumption in a case where endpoint identification requirements differ from those used when the original TLS session was opened. The resumed connection may then be established without the required server identity verification.
How can I determine whether a connection may have been affected?
Review TLS usage for resumed sessions and determine whether the endpoint identification algorithm required for a resumed connection differed from the algorithm used to create the original session. Connections meeting that condition may have bypassed required server identity verification.