REDHAT-BUG-1790570: High severity openjdk 8 vulnerability

Published Jan 13, 2020

Updated

It was discovered that the Kerberos implementation in the Security component of OpenJDK used RSA-MD5 checksum in Ticket Granting Service (TGS) requests even though MD5 algorithm is no longer considered safe for such use case. A remote attacker could possibly use this flaw to manipulate TGS requests.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jan 13, 2020

Data Sourced

via Red Hat·04:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1790570?

The severity of REDHAT-BUG-1790570 is rated as critical due to the potential for remote attackers to manipulate Ticket Granting Service requests.

How do I fix REDHAT-BUG-1790570?

To mitigate REDHAT-BUG-1790570, update to a version of OpenJDK that has eliminated the use of the deprecated RSA-MD5 checksum in TGS requests.

Which versions of OpenJDK are affected by REDHAT-BUG-1790570?

REDHAT-BUG-1790570 affects specific versions of Oracle OpenJDK, particularly those using the vulnerable Kerberos implementation.

What type of attack does REDHAT-BUG-1790570 enable?

REDHAT-BUG-1790570 enables remote attackers to possibly manipulate Ticket Granting Service requests due to the insecure MD5 checksum.

How can I check if I am using an affected version related to REDHAT-BUG-1790570?

To check if you are using an affected version related to REDHAT-BUG-1790570, confirm your OpenJDK version against known vulnerabilities in security advisories.