It was discovered that the LDAPCertStore class in the JNDI component of OpenJDK failed to securely handle LDAP referrals. An attacker could possibly use this flaw to make it fetch attacker controlled certificate data.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 1 | java-1.7.0-openjdk | 2018-03-21 22:12 | ALAS-2018-974 |
Amazon Linux 1 | java-1.8.0-openjdk | 2018-02-07 17:45 | ALAS-2018-949 |
Amazon Linux 2 - Core | java-1.8.0-openjdk | 2018-02-07 17:47 | ALAS2-2018-949 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 8.3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
NVD | CVSSv2 | 5.1 | AV:N/AC:H/Au:N/C:P/I:P/A:P |
NVD | CVSSv3 | 8.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |