PT-2015-1093 · Oracle+5 · Jrockit+7
Florian Weimer
·
Publicado
2015-04-14
·
Atualizado
2024-06-15
·
CVE-2015-0478
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40
JRockit version R28.3.5
Description
The issue allows a remote attacker to affect confidentiality via vectors related to the JCE component. It could also allow a remote attacker to downgrade the security of certain SSL/TLS connections, facilitating brute-force decryption of TLS/SSL traffic between vulnerable clients and servers using man-in-the-middle techniques.
Recommendations
For Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40, update to a version that fixes the issue.
For JRockit version R28.3.5, update to a version that fixes the issue.
As a temporary workaround, consider restricting the use of the JCE component until a patch is available.
Avoid using RSA temporary keys in non-export RSA key exchange ciphersuites to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Ibm Aix
Jrockit
Java Platform
Java Se
Red Hat
Suse
Ubuntu