Red Hat Bugzilla – Bug 1233687
CVE-2015-4806 OpenJDK: HttpURLConnection header restriction bypass (Libraries, 8130193)
Last modified: 2016-11-08 11:25:10 EST
Andrea Palazzo reported the following problem affecting IcedTea-Web: """ Using HTTPUrlConnection it is possible to set custom values for blacklisted headers, even if allowRestrictedHeaders is false, by supplying "Name:value" as name. Also, if needed, trailing ":" could be stripped off using an array as header value. """ Acknowledgement: Red Hat would like to thank Andrea Palazzo of Truel IT for reporting this issue.
I'm litle bit hesitating what fix can be. To disable exactly header param? To verify it do not contain ":" or to pass only known params to url connection (or filter some known params out of it...) Thoughts?
Hello! I'm unable to reproduce. Nowhere in ITW is called addRequestProperty with different then Accept-Encoding param.
HttpURLConnection already defines a set of "restricted headers", which can not be set for HTTP connection. This header restriction is enforced for sandboxed code. The feature was added via: http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/e0806d924a42 which is a fix for CVE-2010-3541 and CVE-2010-3573 (bug 642202). Reported attack vector is blocked in JDK8 in URLPermission, where header name containing colon triggers error. Related changes in JDK8: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/93a268759ec3 https://bugs.openjdk.java.net/browse/JDK-8010464 https://bugs.openjdk.java.net/browse/JDK-8046174 http://openjdk.java.net/jeps/184 http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/dd0deeb04933 https://bugs.openjdk.java.net/browse/JDK-8014719 Backporting whole JEP 184 to JDK7 and earlier is probably not an option. Alternative to that may be performing following checks when header restrictions are enforced: - ensure header name does not contain colon - ensure header value is not null
This issue was reported upstream (Oracle) and got tracking id S0586943. Issue is expected to be corrected in future updates.
The issue is being fixed in Oct 2015 CPU.
Public now via Oracle Critical Patch Update - October 2015. Fixed in Oracle Java SE 6u105, 7u91, and 8u65. External References: http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixJAVA
OpenJDK 8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/c00bcb8d4596
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2015:1921 https://rhn.redhat.com/errata/RHSA-2015-1921.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:1920 https://rhn.redhat.com/errata/RHSA-2015-1920.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:1919 https://rhn.redhat.com/errata/RHSA-2015-1919.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:1928 https://rhn.redhat.com/errata/RHSA-2015-1928.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:1926 https://rhn.redhat.com/errata/RHSA-2015-1926.html
This issue has been addressed in the following products: Oracle Java for Red Hat Enterprise Linux 7 Oracle Java for Red Hat Enterprise Linux 5 Oracle Java for Red Hat Enterprise Linux 6 Via RHSA-2015:1927 https://rhn.redhat.com/errata/RHSA-2015-1927.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:2086 https://rhn.redhat.com/errata/RHSA-2015-2086.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:2508 https://rhn.redhat.com/errata/RHSA-2015-2508.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Via RHSA-2015:2507 https://rhn.redhat.com/errata/RHSA-2015-2507.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2015:2509 https://rhn.redhat.com/errata/RHSA-2015-2509.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 6 Supplementary for Red Hat Enterprise Linux 7 Via RHSA-2015:2506 https://rhn.redhat.com/errata/RHSA-2015-2506.html
This issue has been addressed in the following products: Supplementary for Red Hat Enterprise Linux 5 Supplementary for Red Hat Enterprise Linux 6 Via RHSA-2015:2518 https://rhn.redhat.com/errata/RHSA-2015-2518.html
This issue has been addressed in the following products: Red Hat Satellite 5.6 Red Hat Satellite 5.7 Via RHSA-2016:1430 https://access.redhat.com/errata/RHSA-2016:1430