PT-2015-1090 · Oracle+5 · Jrockit+7
Published
2015-04-14
·
Updated
2024-06-15
·
CVE-2015-0488
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40
JRockit version R28.3.5
Description
The issue allows remote attackers to affect availability via vectors related to JSSE, potentially disrupting data access. It is also related to a vulnerability that could allow a remote attacker to downgrade the security of certain SSL/TLS connections, facilitating brute-force decryption of TLS/SSL traffic between vulnerable clients and servers.
Recommendations
For Oracle Java SE versions 5.0u81, 6u91, 7u76, and 8u40, consider disabling the JSSE component until a patch is available.
For JRockit version R28.3.5, restrict access to the JSSE component to minimize the risk of exploitation.
As a temporary workaround, consider configuring SSL/TLS connections to reject the use of RSA temporary keys in non-export RSA key exchange ciphersuites.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Ibm Aix
Jrockit
Java Platform
Java Se
Red Hat
Suse
Ubuntu