REDHAT-BUG-1730110: Medium severity OpenJDK JCE vulnerability
Published Jul 15, 2019
·Updated
It was discovered that crypto provider implementations in the JCE component of OpenJDK for crypto algorithms such as AES or SHA did not perform array bounds checks. This could lead to out-of-bounds access if compiler intrinsics were used instead of the Java runtime implementations of the specific operations.
Affected Software
1 affected component
OpenJDK JCE
Event History
Jul 15, 2019
Data Sourced
via Red Hat·09:11 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What runtime condition is required for the issue to occur?
The affected JCE crypto provider operation must use compiler intrinsics rather than the Java runtime implementation of that operation. The issue is described for algorithms such as AES and SHA.
2
Does the available information identify affected OpenJDK versions, default configuration status, or a workaround?
No. The provided information does not list affected versions, state whether compiler intrinsics are enabled by default, or provide a mitigation other than the referenced vendor errata.