REDHAT-BUG-2187704: Medium severity Oracle OpenJDK vulnerability

Published Apr 18, 2023

Updated

It was discovered that the TLS implementation in the JSSE component of OpenJDK failed to properly handle certificate chains during TLS session negotiation. A remote attacker attacker could use this flaw to affect the availability of a TLS connection (denial-of-service condition).

Affected Software

1 affected component

Oracle OpenJDK

Event History

Apr 18, 2023

Data Sourced

via Red Hat·01:11 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

The attacker must be able to interact remotely with a TLS connection that uses the affected OpenJDK JSSE implementation during TLS session negotiation.

What is the expected impact of successful exploitation?

Successful exploitation can affect TLS connection availability, resulting in a denial-of-service condition.

Which OpenJDK release lines have referenced fixes?

The provided references include fixes in the OpenJDK 8u, 11u, and 17u source trees. Specific fixed version numbers are not provided.

REDHAT-BUG-2187704: Medium severity Oracle OpenJDK vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

What is the expected impact of successful exploitation?

Which OpenJDK release lines have referenced fixes?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to trigger this issue?

What is the expected impact of successful exploitation?

Which OpenJDK release lines have referenced fixes?