REDHAT-BUG-2015648: Medium severity OpenJDK JSSE vulnerability
It was discovered that the default TLS cipher suite configuration in the JSSE component of OpenJDK preferred certain weak ciphers over stronger ciphers. This issue was addressed by:
- Preferring ciphers with forward secrecy. - Lowering priority of ciphers using RSA encryption key exchange. - Lowering priority of ciphers using SHA-1 hashing algorithm.
Upstream commit:
https://github.com/openjdk/jdk11u/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch af4b37301d33723806c38cf8ae5d85b7fa7ef39f - Configuration
Update the JSSE default TLS cipher suite configuration so that ciphers offering forward secrecy are preferred, and ciphers using RSA key exchange or the SHA-1 hashing algorithm have lower priority. Deploy the updated configuration to all affected OpenJDK JSSE instances.
Sun JSSE (OpenJDK JSSE default TLS cipher suite configuration) default TLS cipher suite ordering = prefer ciphers with forward secrecy; lower priority for RSA key-exchange ciphers; lower priority for ciphers using SHA-1 - Compensating control
If you cannot apply the JSSE configuration change or upstream commit immediately, enforce cipher-suite ordering at TLS termination (for example on load balancers, reverse proxies, or TLS terminators) to prefer forward-secrecy ciphers and de-prioritize or disable RSA key-exchange and SHA-1-based ciphers.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2015648?
The severity of REDHAT-BUG-2015648 is significant due to the preference for weak TLS ciphers which can lead to potential security vulnerabilities.
How do I fix REDHAT-BUG-2015648?
To fix REDHAT-BUG-2015648, update your OpenJDK JSSE to the latest version where the cipher suite configuration is corrected.
What are the risks associated with REDHAT-BUG-2015648?
The risks associated with REDHAT-BUG-2015648 include data interception and denial of service due to the use of weak TLS ciphers.
Which versions of OpenJDK are affected by REDHAT-BUG-2015648?
OpenJDK JSSE versions prior to the patch addressing REDHAT-BUG-2015648 are affected.
What changes were made to resolve REDHAT-BUG-2015648?
The changes made to resolve REDHAT-BUG-2015648 include preferring ciphers with forward secrecy and lowering the priority of ciphers using RSA encryption.