REDHAT-BUG-1823947
First published: Tue Apr 14 2020(Updated: )
A flaw was found in the way the TLS implementation in the JSSE component of OpenJDK handled unexpected Certificate messages during the TLS handshake. This could possibly allow an attacker to tamper with certificate verification performed during the handshake.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sun JSSE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2020:1509
- https://access.redhat.com/errata/RHSA-2020:1514
- https://access.redhat.com/security/cve/cve-2020-2767
- https://access.redhat.com/errata/RHSA-2020:1517
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/2b3ca2fc18a4
- https://bugzilla.redhat.com/show_bug.cgi?id=1823947
Frequently Asked Questions
What is the severity of REDHAT-BUG-1823947?
The severity of REDHAT-BUG-1823947 is classified as significant due to the potential for an attacker to tamper with certificate verification during the TLS handshake.
How do I fix REDHAT-BUG-1823947?
To fix REDHAT-BUG-1823947, you should update your OpenJDK JSSE to a version that includes the latest security patches addressing this vulnerability.
What systems are affected by REDHAT-BUG-1823947?
REDHAT-BUG-1823947 affects systems running the JSSE component of OpenJDK implementations.
What could happen if REDHAT-BUG-1823947 is exploited?
If REDHAT-BUG-1823947 is exploited, attackers may be able to tamper with the TLS handshake, compromising the integrity of secure communications.
Is there a workaround for REDHAT-BUG-1823947?
Currently, there are no known effective workarounds for REDHAT-BUG-1823947, so applying the security update is the recommended action.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-2767
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/openjdk
- canonical/sun jsse