Bug 2558584 (CVE-2026-91403)
| Summary: | CVE-2026-91403 OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | ahughes, fferrari, khosford, mtorre, pjindal, rhel-process-autobot, tfitzsim, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2558794, 2558795 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-21 21:45:20 UTC
OpenJDK upstream advisory provides more details: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 OpenJDK fix: https://github.com/openjdk/jdk/commit/22bc7357ce6bc5f1ed2f1e83e0544b2c25f781d4 Sonatype reported, that the OpenJDK / Oracle JDK fix blacklisting specific intermediate certificates can be bypassed: https://www.sonatype.com/blog/the-limits-of-fingerprint-blocklists-a-reproducible-java-certificate-bypass Mitigation instructions originally included in the OpenJDK upstream advisory: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 involved downloading blocked.certs file with eMudhra intermediate certificates included. After the Sonatype report, those instructions were removed and replaced by instructions to remove root certificates form the cacert store published at: https://openjdk.org/emudhra As the fix to block only affected intermediate certificates was found to be insufficient, a new advisory was released addressing this problem by removing eMudhra related root CA certificates. New CVE CVE-2026-114820 was assigned for the new fix. https://openjdk.org/groups/vulnerability/advisories/2026-10-24 https://www.oracle.com/security-alerts/alert-cve-2026-114820.html This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.20.1 Via RHSA-2026:89916 https://access.redhat.com/errata/RHSA-2026:89916 This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.21 Via RHSA-2026:88353 https://access.redhat.com/errata/RHSA-2026:88353 |