Red Hat Bugzilla – Bug 1219223
CVE-2015-0138 IBM JDK: ephemeral RSA keys accepted for non-export SSL/TLS cipher suites (FREAK)
Last modified: 2015-06-11 09:22:17 EDT
IBM JDK versions 5.0 SR16-FP10, 6 SR16-FP4, 6R1 SR8-FP4, 7 SR9, 7R1 SR3 and 8 SR1 correct an issue known as "FREAK" (Factoring RSA Export Keys). An SSL/TLS client using IBM JDK's JSSE can accept ephemeral RSA keys even when using non-export cipher suites. A MITM attacker could possibly use this flaw to impersonate server which enables export cipher suites. This issue is similar to CVE-2015-0204 (bug 1180184) which affected OpenSSL. Description of the flaw in the IBM security bulletin: A vulnerability in various IBM SSL/TLS implementations could allow a remote attacker to downgrade the security of certain SSL/TLS connections. An IBM SSL/TLS client implementation could accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. This could allow a remote attacker using man-in-the-middle techniques to facilitate brute-force decryption of TLS/SSL traffic between vulnerable clients and servers. This vulnerability is also known as the FREAK attack. References: http://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_May_2015 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 https://www.smacktls.com/#freak
In addition to fixing the bug that causes client to accept ephemeral RSA keys for non-export cipher suites, these updates also disable export cipher suites by default in IBM JDK 5.0 and 6. They were previously disabled in IBM JDK 7.
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:1007 https://rhn.redhat.com/errata/RHSA-2015-1007.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:1006 https://rhn.redhat.com/errata/RHSA-2015-1006.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2015:1021 https://rhn.redhat.com/errata/RHSA-2015-1021.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2015:1020 https://rhn.redhat.com/errata/RHSA-2015-1020.html
This issue has been addressed in the following products: Red Hat Satellite Server v 5.6 Red Hat Satellite Server v 5.7 Via RHSA-2015:1091 https://rhn.redhat.com/errata/RHSA-2015-1091.html