It was discovered that the FTP client implementation in the Networking component of OpenJDK failed to correctly handle user inputs (e.g. usernames and passwords) containing newline characters. A remote attacker could possibly use this flaw to manipulate an FTP connection opened by a Java application if it could make it access a specially crafted FTP URL.
Blog posts were published that describe how to use this flaw to open ports on firewalls using active FTP connections:
http://blog.blindspotsecurity.com/2017/02/advisory-javapython-ftp-injections.html
and sending mails during XML parsing when use of XML external entities is allowed:
https://shiftordie.de/blog/2017/02/18/smtp-over-xxe/
It was discovered that the SMTP client implementation in the Networking component of OpenJDK failed to correctly handle sender and recipient addresses containing newline characters. A remote attacker could possibly use this flaw to manipulate an SMTP connection opened by a Java application if it could make it send an email to or from a specially crafted address.
A flaw was found in the way the JSSE component in OpenJDK performed X.509 certificate identify verification when establishing TLS/SSL connection to a host identified using IP address. In certain cases, it would incorrectly use a host name obtained after performing reverse DNS lookup of the specified IP address rather than the original IP address for the identity check, possibly leading to having a certificate issued for different identity to be accepted as valid.
This issue is know to affect cases when SSLSocketFactory.createSocket() is called with certain InetAddress instances. It is not known to affect cases when target host IP is passed to createSocket() as string, or when IP is used in URL used for HttpsURLConnection.
With this patch, reverse DNS lookup is no longer performed. The fix also adds new system property jdk.tls.trustNameService that can be used to allow the DNS lookup to be performed and hence have its result used during identity check.
Last updated 24 July 2024
It was discovered that the fix for CVE-2013-5797 (bug 1018720) did not properly with the issue in the way javadoc (Java API Documentation Generator) created a JavaScript code used to set browser window title when navigating between pages of the generated API documentation. An input from user was not properly escaped before being used as part of the JavaScript string. A specially crafted input could "break out" of the JS string and execute arbitrary JavaScript in the context of the domain that hosts generated API documentation, allowing a Cross-Site Scripting attacks.
The original fix for the issue added escaping of quotes and non-ASCII characters, but it failed to escape HTML special characters < and >.
Acknowledgement:
This issue was discovered by the Red Hat Security Response Team.