Bug 1151046 (CVE-2014-6457)

Summary:	CVE-2014-6457 OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dbhole, jvanek, omajid, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-24 17:15:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1148726

Description Tomas Hoger 2014-10-09 13:28:32 UTC

It was discovered that the TLS/SSL implementation in the JSSE component of OpenJDK was vulnerable to the Triple Handshake attack.  An insufficient check of server's identity during the renegotiation following session resumption could allow a malicious server to manipulate clients authenticated session with a different server if client certificate authentication was used.

Further details of the attacks are described on:

https://secure-resumption.com/

Comment 1 Tomas Hoger 2014-10-14 20:12:04 UTC

Public now via Oracle Critical Patch Update - October 2014.  Fixed in Oracle Java SE 5.0u75, 6u85, 7u71, and 8u25.

External References:

http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixJAVA

Comment 2 errata-xmlrpc 2014-10-14 20:48:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1633 https://rhn.redhat.com/errata/RHSA-2014-1633.html

Comment 3 errata-xmlrpc 2014-10-15 01:27:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2014:1620 https://rhn.redhat.com/errata/RHSA-2014-1620.html

Comment 4 errata-xmlrpc 2014-10-15 02:09:44 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 5

Via RHSA-2014:1634 https://rhn.redhat.com/errata/RHSA-2014-1634.html

Comment 5 errata-xmlrpc 2014-10-15 03:04:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1636 https://rhn.redhat.com/errata/RHSA-2014-1636.html

Comment 6 Martin Prpič 2014-10-15 09:37:39 UTC

IssueDescription:

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication.

Comment 7 Tomas Hoger 2014-10-16 13:29:35 UTC

This issue was fixed in IcedTea6 1.13.5 and IcedTea7 2.5.3:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029884.html
http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2014-October/029889.html

Upstream OpenJDK commit:

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/8b0fbfddc048

Comment 8 errata-xmlrpc 2014-10-16 23:02:32 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:1658 https://rhn.redhat.com/errata/RHSA-2014-1658.html

Comment 9 errata-xmlrpc 2014-10-16 23:12:48 UTC

This issue has been addressed in the following products:

  Oracle Java for Red Hat Enterprise Linux 7
  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:1657 https://rhn.redhat.com/errata/RHSA-2014-1657.html

Comment 10 errata-xmlrpc 2014-11-19 18:32:37 UTC

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1877 https://rhn.redhat.com/errata/RHSA-2014-1877.html

Comment 11 errata-xmlrpc 2014-11-19 18:33:26 UTC

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2014:1876 https://rhn.redhat.com/errata/RHSA-2014-1876.html

Comment 12 errata-xmlrpc 2014-11-20 16:18:53 UTC

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1882 https://rhn.redhat.com/errata/RHSA-2014-1882.html

Comment 13 errata-xmlrpc 2014-11-20 16:33:14 UTC

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2014:1880 https://rhn.redhat.com/errata/RHSA-2014-1880.html

Comment 14 errata-xmlrpc 2014-11-20 16:52:54 UTC

This issue has been addressed in the following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:1881 https://rhn.redhat.com/errata/RHSA-2014-1881.html

Comment 15 errata-xmlrpc 2015-02-24 13:45:08 UTC

This issue has been addressed in the following products:

  Red Hat Satellite Server v 5.6

Via RHSA-2015:0264 https://rhn.redhat.com/errata/RHSA-2015-0264.html