REDHAT-BUG-2015311: Low severity ORACLE OpenJDK vulnerability

Published Oct 18, 2021

Updated

It was discovered that the TLS implementation in the JSSE component of OpenJDK used non-constant comparisons when checking various data (such as session identifiers or verification data blocks) during TLS handshakes. A malicious TLS client could possibly use this flaw to recover that data by observing timing differences in processing of various inputs.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Oct 18, 2021

Data Sourced

via Red Hat·09:04 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2015311?

The severity of REDHAT-BUG-2015311 is rated as high due to potential data recovery by malicious TLS clients.

How do I fix REDHAT-BUG-2015311?

To fix REDHAT-BUG-2015311, update to the latest version of OpenJDK where this vulnerability has been patched.

What are the potential impacts of REDHAT-BUG-2015311?

The potential impacts of REDHAT-BUG-2015311 include exposure of sensitive data during TLS handshakes.

Which versions of OpenJDK are affected by REDHAT-BUG-2015311?

REDHAT-BUG-2015311 affects Oracle OpenJDK 17 and possibly other versions prior to the remediation.

Is there a workaround for REDHAT-BUG-2015311?

There is no known effective workaround for REDHAT-BUG-2015311 other than applying the recommended updates.