REDHAT-BUG-2257874: Medium severity openjdk 8 vulnerability

Published Jan 11, 2024

Updated

It was discovered that the DOMRSAPSSSignatureMethod and DOMSignatureMethod classes in the Security component of OpenJDK could log private keys used for digital signature in debug logs, possibly leading the exposure of sensitive information to unstrusted parties.

Affected Software

1 affected component

ORACLE OpenJDK

Event History

Jan 11, 2024

Data Sourced

via Red Hat·11:48 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2257874?

The severity of REDHAT-BUG-2257874 is high due to the potential exposure of private keys in debug logs.

How do I fix REDHAT-BUG-2257874?

To fix REDHAT-BUG-2257874, ensure you update to the latest patched version of OpenJDK as recommended by your vendor.

What are the risks associated with REDHAT-BUG-2257874?

The risks associated with REDHAT-BUG-2257874 include unauthorized access to private keys, leading to compromised digital signatures and sensitive data exposure.

Which OpenJDK versions are affected by REDHAT-BUG-2257874?

REDHAT-BUG-2257874 affects Oracle OpenJDK, particularly version 17.

Is there a way to mitigate the impact of REDHAT-BUG-2257874 if I cannot update immediately?

You can mitigate the impact of REDHAT-BUG-2257874 by disabling debug logging in your OpenJDK configuration until you are able to apply the necessary updates.