CVE-2017-10116

Public on 2017-07-25

Modified on 2017-08-15

Description

It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers.

Severity

Important

See what this means

CVSS v3 Base Score

8.3

See breakdown

Affected Packages

Platform	Package	Release Date	Advisory
Amazon Linux 1	java-1.7.0-openjdk	2017-08-15 17:30	ALAS-2017-869
Amazon Linux 1	java-1.8.0-openjdk	2017-07-25 17:54	ALAS-2017-860

CVSS Scores

	Score Type	Score	Vector
Amazon Linux	CVSSv3	8.3	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	CVSSv3	8.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	CVSSv2	5.1	AV:N/AC:H/Au:N/C:P/I:P/A:P

References

Red Hat: CVE-2017-10116 Mitre: CVE-2017-10116 FAQs regarding Amazon Linux ALAS/CVE Severity