Bug 829372 – CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872)

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 829372 - (CVE-2012-1718) CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (Security, 7143872)

Summary:	CVE-2012-1718 OpenJDK: CRL and certificate extensions handling improvements (...

Status:	CLOSED ERRATA

Aliases:	CVE-2012-1718

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20120612,repor...
Keywords:	Security

Depends On:	828749 828750 828751 828752 828753 828754 828755 828756 828757 828758 828759 828760 854269 854270 854274 854276 854279 854280 854284 854285 854290 854291 854297 854299 854300 854301 856471 856472 856473
Blocks:	824458
	Show dependency tree / graph

Reported:	2012-06-06 10:47 EDT by Stefan Cornelius
Modified:	2015-11-25 04:58 EST (History)
CC List:	4 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-03-12 06:12:58 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2012:0729	normal	SHIPPED_LIVE	Critical: java-1.6.0-openjdk security update	2012-06-13 13:09:52 EDT
Red Hat Product Errata	RHSA-2012:0730	normal	SHIPPED_LIVE	Important: java-1.6.0-openjdk security update	2012-06-13 13:09:38 EDT
Red Hat Product Errata	RHSA-2012:0734	normal	SHIPPED_LIVE	Critical: java-1.6.0-sun security update	2013-11-14 19:08:50 EST
Red Hat Product Errata	RHSA-2012:1009	normal	SHIPPED_LIVE	Important: java-1.7.0-openjdk security and bug fix update	2012-06-20 11:39:14 EDT
Red Hat Product Errata	RHSA-2012:1019	normal	SHIPPED_LIVE	Critical: java-1.7.0-oracle security update	2012-06-20 11:39:05 EDT
Red Hat Product Errata	RHSA-2012:1238	normal	SHIPPED_LIVE	Critical: java-1.6.0-ibm security update	2012-09-06 16:13:35 EDT
Red Hat Product Errata	RHSA-2012:1243	normal	SHIPPED_LIVE	Critical: java-1.4.2-ibm security update	2012-09-07 12:48:49 EDT
Red Hat Product Errata	RHSA-2012:1245	normal	SHIPPED_LIVE	Critical: java-1.5.0-ibm security update	2012-09-07 12:59:08 EDT
Red Hat Product Errata	RHSA-2012:1332	normal	SHIPPED_LIVE	Moderate: java-1.4.2-ibm-sap security update	2012-10-03 15:19:10 EDT
Red Hat Product Errata	RHSA-2012:1467	normal	SHIPPED_LIVE	Critical: java-1.7.0-ibm security update	2012-11-15 21:06:24 EST
Red Hat Product Errata	RHSA-2013:1455	normal	SHIPPED_LIVE	Low: Red Hat Network Satellite server IBM Java Runtime security update	2013-10-23 16:30:21 EDT
Red Hat Product Errata	RHSA-2013:1456	normal	SHIPPED_LIVE	Low: Red Hat Network Satellite server IBM Java Runtime security update	2013-10-23 16:29:56 EDT

Groups: None (edit)

Description Stefan Cornelius 2012-06-06 10:47:18 EDT

It was discovered that the Java security classes did not properly handle Certificate Revocation Lists (CRL). CRL containing entries with duplicate certificate serial numbers could have been ignored.

Comment 1 Tomas Hoger 2012-06-12 16:28:48 EDT

Public now via:
http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html

Fixed in Oracle Java 7 Update 5 and 6 Update 33.

Comment 2 Tomas Hoger 2012-06-13 05:26:04 EDT

The fix for this issue is or will be included in the following IcedTea versions:

* IcedTea6 1.10.8 
* IcedTea6 1.11.3
* IcedTea7 2.1.1
* IcedTea7 2.2.1

IcedTea6 releases announcement:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019076.html
http://blog.fuseyism.com/index.php/2012/06/12/security-icedtea6-1-10-8-1-11-3-released/

Patch:
http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/6e6d7783aabb/patches/security/20120612/7143872.patch
http://icedtea.classpath.org/hg/release/icedtea7-forest-2.1/jdk/rev/ca9c7add5936

Comment 3 errata-xmlrpc 2012-06-13 09:10:17 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:0730 https://rhn.redhat.com/errata/RHSA-2012-0730.html

Comment 4 errata-xmlrpc 2012-06-13 09:10:34 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0729 https://rhn.redhat.com/errata/RHSA-2012-0729.html

Comment 5 errata-xmlrpc 2012-06-13 16:02:39 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:0734 https://rhn.redhat.com/errata/RHSA-2012-0734.html

Comment 6 Tomas Hoger 2012-06-15 08:01:55 EDT

IcedTea7 releases announcement:

http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2012-June/019094.html
http://blog.fuseyism.com/index.php/2012/06/13/security-icedtea-2-1-1-2-2-1-released/

Comment 7 errata-xmlrpc 2012-06-20 11:15:18 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1019 https://rhn.redhat.com/errata/RHSA-2012-1019.html

Comment 8 errata-xmlrpc 2012-06-20 11:15:58 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1009 https://rhn.redhat.com/errata/RHSA-2012-1009.html

Comment 15 errata-xmlrpc 2012-09-06 12:15:18 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1238 https://rhn.redhat.com/errata/RHSA-2012-1238.html

Comment 16 errata-xmlrpc 2012-09-07 08:50:26 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1243 https://rhn.redhat.com/errata/RHSA-2012-1243.html

Comment 17 errata-xmlrpc 2012-09-07 09:00:50 EDT

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2012:1245 https://rhn.redhat.com/errata/RHSA-2012-1245.html

Comment 18 errata-xmlrpc 2012-10-03 11:20:41 EDT

This issue has been addressed in following products:

  RHEL 5 for SAP
  RHEL 6 for SAP

Via RHSA-2012:1332 https://rhn.redhat.com/errata/RHSA-2012-1332.html

Comment 19 errata-xmlrpc 2012-11-15 16:08:01 EST

This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2012:1467 https://rhn.redhat.com/errata/RHSA-2012-1467.html

Comment 20 errata-xmlrpc 2013-10-23 12:31:23 EDT

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.5

Via RHSA-2013:1456 https://rhn.redhat.com/errata/RHSA-2013-1456.html

Comment 21 errata-xmlrpc 2013-10-23 13:05:24 EDT

This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4

Via RHSA-2013:1455 https://rhn.redhat.com/errata/RHSA-2013-1455.html

Note You need to log in before you can comment on or make changes to this bug.