Bug 1889274 (CVE-2020-14781)
| Summary: | CVE-2020-14781 OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Tomas Hoger <thoger> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ahughes, ecki, java-qa, jvanek, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-10-22 14:21:17 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1879737, 1879738, 1879845, 1879846, 1879847, 1879997, 1879998, 1879999, 1880001, 1881127, 1881128, 1881129, 1881130, 1899871, 1928557, 1928558, 1928559 | ||
| Bug Blocks: | 1876666 | ||
|
Description
Tomas Hoger
2020-10-19 08:51:14 UTC
Public now via Oracle CPU October 2020: https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixJAVA Fixed in Oracle Java SE 15.0.1, 11.0.9, 8u271, and 7u281. Related note in the Oracle Java SE release notes:
core-libs/javax.naming
➜ Added Property to Control LDAP Authentication Mechanisms Allowed to Authenticate Over Clear Connections
A new environment property, jdk.jndi.ldap.mechsAllowedToSendCredentials, has been added to control which LDAP authentication mechanisms are allowed to send credentials over clear LDAP connections - a connection not secured with TLS. An encrypted LDAP connection is a connection opened by using ldaps scheme, or a connection opened by using ldap scheme and then upgraded to TLS with a STARTTLS extended operation.
The value of the property, which is by default not set, is a comma separated list of the mechanism names that are permitted to authenticate over a clear connection. If a value is not specified for the property, then all mechanisms are allowed. If the specified value is an empty list, then no mechanisms are allowed (except for none and anonymous). The default value for this property is 'null' ( i.e. System.getProperty("jdk.jndi.ldap.mechsAllowedToSendCredentials") returns 'null'). To explicitly permit all mechanisms to authenticate over a clear connection, the property value can be set to "all". If a connection is downgraded from encrypted to clear, then only the mechanisms that are explicitly permitted are allowed.
The property can be supplied to the LDAP context environment map, or set globally as a system property. When both are supplied, the environment map takes precedence.
Note: none and anonymous authentication mechanisms are exempted from these rules and are always allowed regardless of the property value.
JDK-8237990 (not public)
https://www.oracle.com/java/technologies/javase/15-0-1-relnotes.html
https://www.oracle.com/java/technologies/javase/11-0-9-relnotes.html
https://www.oracle.com/java/technologies/javase/8u271-relnotes.html
https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#R170_281
The Release Notes should probably mention that this does not apply to Simple-bind (or GSSAPI and if SASL wrapped encryption is accepted. I asume that only SASL/LOGIN and SASL/PLAIN in the default JNDI implementation would be affected, but this is not confirmed yet: https://mail.openjdk.java.net/pipermail/security-dev/2020-October/022920.html ) This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:4306 https://access.redhat.com/errata/RHSA-2020:4306 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4305 https://access.redhat.com/errata/RHSA-2020:4305 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14781 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4307 https://access.redhat.com/errata/RHSA-2020:4307 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:4316 https://access.redhat.com/errata/RHSA-2020:4316 OpenJDK-11 upstream commit: http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/e8b4096c7091 OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/ccf97104b8ea This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:4349 https://access.redhat.com/errata/RHSA-2020:4349 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4347 https://access.redhat.com/errata/RHSA-2020:4347 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:4352 https://access.redhat.com/errata/RHSA-2020:4352 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:4348 https://access.redhat.com/errata/RHSA-2020:4348 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4350 https://access.redhat.com/errata/RHSA-2020:4350 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2020:5586 https://access.redhat.com/errata/RHSA-2020:5586 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2021:0717 https://access.redhat.com/errata/RHSA-2021:0717 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:0736 https://access.redhat.com/errata/RHSA-2021:0736 |