Java APIs in certain cases may return Distinguished Name strings that are incorrect representations of the encoded form of BMPString, PrintableString, and IA5String.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/d5ac2ad89a369697a48e7f3e6b889e22afa50a2f OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/d3b1c2be9e87aad07cac29d94679130fe5807c17 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/cbba8b9dc39c7e484549fd765c9eb8feb7e122e0 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/643330569baa7c835c2970f0272e9c83883d2a31
This CVE was fixed in Oracle Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1. https://www.oracle.com/java/technologies/javase/8u471-relnotes.html#R180_471 https://www.oracle.com/java/technologies/javase/11-0-29-relnotes.html#R11_0_29 https://www.oracle.com/java/technologies/javase/17-0-17-relnotes.html#R17_0_17 https://www.oracle.com/java/technologies/javase/21-0-9-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-1-relnotes.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 10 Via RHSA-2025:22672 https://access.redhat.com/errata/RHSA-2025:22672
Some Java APIs (for example X500Principal.getName()) may return Distinguished Name strings that do not correctly represent the original ASN.1 encoding when DN attributes are encoded as BMPString, PrintableString, or IA5String. In such cases, Java normalizes the values to UTF-8, which can cause the returned DN string to differ from the actual encoded form in the certificate. https://geometrydash-lite.co