REDHAT-BUG-1823853
First published: Tue Apr 14 2020(Updated: )
It was discovered that the TLS/SSL implementation in the JSEE component of OpenJDK did not properly handle application data packets received prior to the handshake completion. This could allow unauthorized injection of data at the beginning a TLS session.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2020:1509
- https://access.redhat.com/errata/RHSA-2020:1514
- https://access.redhat.com/security/cve/cve-2020-2816
- https://access.redhat.com/errata/RHSA-2020:1517
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/517f0515f160
- https://bugzilla.redhat.com/show_bug.cgi?id=1823853
Frequently Asked Questions
What is the severity of REDHAT-BUG-1823853?
The severity of REDHAT-BUG-1823853 is classified as critical due to the potential for unauthorized data injection in TLS sessions.
How do I fix REDHAT-BUG-1823853?
To fix REDHAT-BUG-1823853, update your OpenJDK to the latest patched version that addresses this vulnerability.
What software is affected by REDHAT-BUG-1823853?
The affected software for REDHAT-BUG-1823853 is specifically Oracle OpenJDK, especially version 17.
What type of attack does REDHAT-BUG-1823853 facilitate?
REDHAT-BUG-1823853 facilitates unauthorized injection of data prior to the completion of the TLS handshake.
Is there a workaround for REDHAT-BUG-1823853?
There are no recommended workarounds for REDHAT-BUG-1823853; updating OpenJDK is the best course of action.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-2816
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 17