Bug 2359695 (CVE-2025-21587) - CVE-2025-21587 openjdk: Better TLS connection support (Oracle CPU 2025-04)
Summary: CVE-2025-21587 openjdk: Better TLS connection support (Oracle CPU 2025-04)
Keywords:
Status: NEW
Alias: CVE-2025-21587
Deadline: 2025-04-15
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-15 07:45 UTC by OSIDB Bzimport
Modified: 2025-04-23 05:25 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-15 07:45:25 UTC 
Need to address side-channel handling of RSA PKCS#1 v1.5 padding errors.
Comment 1 Mauro Matteo Cascella 2025-04-16 10:42:14 UTC 
OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/3cdd3081565d890801a27a1f9ac8bc53e5711ce6

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/2adb01e8c5fbcc3dfa9f82df3deccb3a1705bf13

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/73aa304234f2ec17abbb640b7f2d0503cf1bfc91

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/d5c94adf69ba20f5652453729620c4f1c8e4860e
Comment 2 Mauro Matteo Cascella 2025-04-16 12:56:20 UTC 
This CVE was fixed in Oracle Java SE 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1.

Release notes:
https://www.oracle.com/java/technologies/javase/8u451-relnotes.html#R180_451
https://www.oracle.com/java/technologies/javase/8u451-perf-relnotes.html
https://www.oracle.com/java/technologies/javase/11-0-27-relnotes.html#R11_0_27
https://www.oracle.com/java/technologies/javase/17-0-15-relnotes.html#R17_0_15
https://www.oracle.com/java/technologies/javase/21-0-7-relnotes.html
https://www.oracle.com/java/technologies/javase/24-0-1-relnotes.html
Note You need to log in before you can comment on or make changes to this bug.