REDHAT-BUG-1889274: Medium severity openjdk vulnerability

Published Oct 19, 2020

Updated

It was discovered that the LDAP client implementation in the JNDI component of OpenJDK did not properly track whether a connection to a server uses TLS encryption, and consequently did not properly restrict the set of authentication mechanisms that were allowed to be used over an unencrypted connection. This could possibly lead to sending of plain text authentication credentials over an unencrypted connection.

Affected Software

1 affected component

OpenJDK JNDI

Event History

Oct 19, 2020

Data Sourced

via Red Hat·08:51 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1889274?

The severity of REDHAT-BUG-1889274 is considered high due to potential security risks in authentication mechanisms.

How do I fix REDHAT-BUG-1889274?

To fix REDHAT-BUG-1889274, update the OpenJDK JNDI component to the latest version provided by your vendor.

What vulnerabilities are associated with REDHAT-BUG-1889274?

REDHAT-BUG-1889274 is associated with vulnerabilities in TLS encryption and unencrypted connection risks.

Which versions of OpenJDK are affected by REDHAT-BUG-1889274?

All versions of OpenJDK JNDI prior to the patch are affected by REDHAT-BUG-1889274.

Is there a workaround for REDHAT-BUG-1889274?

A possible workaround for REDHAT-BUG-1889274 is to enforce TLS on all LDAP connections as a temporary measure.