Red Hat Bugzilla – Bug 1210355
CVE-2015-0478 OpenJDK: insufficient hardening of RSA-CRT implementation (JCE, 8071726)
Last modified: 2015-09-22 09:13:46 EDT
It was found that the RSA implementation in Java Cryptography Extension (JCE) component in OpenJDK did not follow recommended practices for implementing RSA signatures. Acknowledgement: This issue was discovered by Florian Weimer of Red Hat Product Security.
Public now via Oracle Critical Patch Update - April 2015. Fixed in Oracle Java SE 6u95, 7u79, and 8u45. External References: http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html#AppendixJAVA https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/ https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2015:0807 https://rhn.redhat.com/errata/RHSA-2015-0807.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2015:0809 https://rhn.redhat.com/errata/RHSA-2015-0809.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2015:0808 https://rhn.redhat.com/errata/RHSA-2015-0808.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Via RHSA-2015:0806 https://rhn.redhat.com/errata/RHSA-2015-0806.html
This issue was fixed in IcedTea6 1.13.7 and IcedTea7 2.5.5: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-April/031449.html http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2015-April/031450.html Upstream OpenJDK commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/1083da8a8ec1
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:0854 https://rhn.redhat.com/errata/RHSA-2015-0854.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:0857 https://rhn.redhat.com/errata/RHSA-2015-0857.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:0858 https://rhn.redhat.com/errata/RHSA-2015-0858.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:1007 https://rhn.redhat.com/errata/RHSA-2015-1007.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:1006 https://rhn.redhat.com/errata/RHSA-2015-1006.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2015:1021 https://rhn.redhat.com/errata/RHSA-2015-1021.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2015:1020 https://rhn.redhat.com/errata/RHSA-2015-1020.html
This issue has been addressed in the following products: Red Hat Satellite Server v 5.6 Red Hat Satellite Server v 5.7 Via RHSA-2015:1091 https://rhn.redhat.com/errata/RHSA-2015-1091.html
Further details of this issue are now available via Florian Weimer's blog post and paper: https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/ https://people.redhat.com/~fweimer/rsa-crt-leaks.pdf Brief description of this issue in the OpenJDK context: It was discovered that RSA implementation in OpenJDK did not perform verification of signatures computed using the RSA-CRT (Chinese Remainder Theorem) optimization. Faults that occur during signature computation may lead to a leak of the used RSA private key, known as Arjen Lenstra's CRT attack: https://infoscience.epfl.ch/record/164524/files/nscan20.PDF This problem may be exposed in TLS, for example when using Perfect Forward Secrecy cipher suites.