Bug 1502869 (CVE-2017-10355)
| Summary: | CVE-2017-10355 OpenJDK: no default network operations timeouts in FtpClient (Networking, 8181612) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dbhole, jvanek, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It was found that the FtpClient implementation in the Networking component of OpenJDK did not set connect and read timeouts by default. A malicious FTP server or a man-in-the-middle attacker could use this flaw to block execution of a Java application connecting to an FTP server.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-12-06 14:14:40 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1499213, 1499214, 1499215, 1499216, 1499223, 1499224, 1499225, 1499226, 1503325, 1503326, 1503327, 1503328, 1503329, 1503330, 1503331, 1503332, 1503333, 1503334, 1503335, 1503336, 1515469, 1515470, 1515471, 1515472, 1516384, 1516385, 1516386, 1516387 | ||
| Bug Blocks: | 1499210 | ||
|
Description
Tomas Hoger
2017-10-16 21:33:55 UTC
Oracle JDK release notes include the following note regarding this fix:
core-libs/java.net
Default timeouts have changed for FTP URL handler
Timeouts used by the FTP URL protocol handler have been changed from
infinite to 5 minutes. This will result in an IOException from connect and
read operations if the FTP server is unresponsive. For example, new
URL("ftp://example.com").openStream().read(), will fail with
java.net.SocketTimeoutException in case a connection or reading could not
be completed within 5 minutes.
To revert this behaviour to that of previous releases, the following system
properties may be used, sun.net.client.defaultReadTimeout=0,
sun.net.client.defaultConnectTimeout=0
JDK-8181612 (not public)
http://www.oracle.com/technetwork/java/javase/9-0-1-relnotes-3883752.html
http://www.oracle.com/technetwork/java/javase/8u151-relnotes-3850493.html
http://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_161
http://www.oracle.com/technetwork/java/javase/documentation/overview-156328.html#R160_171
Public now via Oracle CPU October 2017: http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixJAVA The issue was fixed in Oracle JDK 9.0.1, 8u151, 7u161, and 6u171. OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/84b0fbbfb8d6 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2017:2998 https://access.redhat.com/errata/RHSA-2017:2998 This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2017:2999 https://access.redhat.com/errata/RHSA-2017:2999 This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 6 Oracle Java for Red Hat Enterprise Linux 7 Via RHSA-2017:3047 https://access.redhat.com/errata/RHSA-2017:3047 This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2017:3046 https://access.redhat.com/errata/RHSA-2017:3046 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2017:3264 https://access.redhat.com/errata/RHSA-2017:3264 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Via RHSA-2017:3267 https://access.redhat.com/errata/RHSA-2017:3267 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Supplementary Red Hat Enterprise Linux 7 Supplementary Via RHSA-2017:3268 https://access.redhat.com/errata/RHSA-2017:3268 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2017:3392 https://access.redhat.com/errata/RHSA-2017:3392 This issue has been addressed in the following products: Red Hat Satellite 5.8 Red Hat Satellite 5.8 ELS Via RHSA-2017:3453 https://access.redhat.com/errata/RHSA-2017:3453 |