It was discovered that the default TLS cipher suite configuration in the JSSE component of OpenJDK preferred certain weak ciphers over stronger ciphers. This issue was addressed by:
- Preferring ciphers with forward secrecy. - Lowering priority of ciphers using RSA encryption key exchange. - Lowering priority of ciphers using SHA-1 hashing algorithm.
Upstream commit:
https://github.com/openjdk/jdk11u/commit/af4b37301d33723806c38cf8ae5d85b7fa7ef39f