RHSA-2010:0130: Moderate: java-1.5.0-ibm security update
The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment andthe IBM Java 2 Software Development Kit.A flaw was found in the way the TLS/SSL (Transport Layer Security/SecureSockets Layer) protocols handle session renegotiation. A man-in-the-middleattacker could use this flaw to prefix arbitrary plain text to a client'ssession (for example, an HTTPS connection to a website). This could forcethe server to process an attacker's request as if authenticated using thevictim's credentials. (CVE-2009-3555)This update disables renegotiation in the Java Secure Socket Extension(JSSE) component. Unsafe renegotiation can be re-enabled using thecom.ibm.jsse2.renegotiate property. Refer to the following Knowledgebasearticle for details: http://kbase.redhat.com/faq/docs/DOC-20491 All users of java-1.5.0-ibm are advised to upgrade to these updatedpackages, containing the IBM 1.5.0 SR11-FP1 Java release. All runninginstances of IBM Java must be restarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2010:0130?
The severity of RHSA-2010:0130 is considered moderate.
How do I fix RHSA-2010:0130?
To fix RHSA-2010:0130, update the affected Java packages to version 1.5.0-ibm-1.5.0.11.1-1jpp.3.el5 or later.
What products are affected by RHSA-2010:0130?
RHSA-2010:0130 affects various IBM 1.5.0 Java packages including the IBM Java 2 Runtime Environment and Development Kit.
What is the nature of the flaw in RHSA-2010:0130?
The flaw in RHSA-2010:0130 relates to a man-in-the-middle vulnerability during the TLS/SSL session renegotiation process.
When was RHSA-2010:0130 released?
RHSA-2010:0130 was released on March 2, 2010.