REDHAT-BUG-2015648: Medium severity OpenJDK JSSE vulnerability
It was discovered that the default TLS cipher suite configuration in the JSSE component of OpenJDK preferred certain weak ciphers over stronger ciphers. This issue was addressed by:
- Preferring ciphers with forward secrecy. - Lowering priority of ciphers using RSA encryption key exchange. - Lowering priority of ciphers using SHA-1 hashing algorithm.
Upstream commit:
https://github.com/openjdk/jdk11u/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the OpenJDK JSSE default TLS cipher suite configuration so that RSA key-exchange ciphers and SHA-1-based ciphers are given lower priority, and ciphers with forward secrecy are preferred.
OpenJDK JSSE (TLS cipher suites) Default TLS cipher suite configuration = Lower priority of ciphers using RSA encryption key exchange; Lower priority of ciphers using SHA-1 hashing algorithm; Prefer ciphers with forward secrecy
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2015648?
The severity of REDHAT-BUG-2015648 is significant due to the preference for weak TLS ciphers which can lead to potential security vulnerabilities.
How do I fix REDHAT-BUG-2015648?
To fix REDHAT-BUG-2015648, update your OpenJDK JSSE to the latest version where the cipher suite configuration is corrected.
What are the risks associated with REDHAT-BUG-2015648?
The risks associated with REDHAT-BUG-2015648 include data interception and denial of service due to the use of weak TLS ciphers.
Which versions of OpenJDK are affected by REDHAT-BUG-2015648?
OpenJDK JSSE versions prior to the patch addressing REDHAT-BUG-2015648 are affected.
What changes were made to resolve REDHAT-BUG-2015648?
The changes made to resolve REDHAT-BUG-2015648 include preferring ciphers with forward secrecy and lowering the priority of ciphers using RSA encryption.