Insufficient Verification of Data Authenticity Affecting java-1.7.0-openjdk-accessibility package, versions <1:1.7.0.161-2.6.12.0.el7_4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL7-JAVA170OPENJDKACCESSIBILITY-4755359
- published 26 Jul 2021
- disclosed 17 Oct 2017
Introduced: 17 Oct 2017
CVE-2017-10388 Open this link in a new tabHow to fix?
Upgrade RHEL:7 java-1.7.0-openjdk-accessibility to version 1:1.7.0.161-2.6.12.0.el7_4 or higher.
This issue was patched in RHSA-2017:3392.
NVD Description
Note: Versions mentioned in the description apply only to the upstream java-1.7.0-openjdk-accessibility package and not the java-1.7.0-openjdk-accessibility package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
- http://www.securityfocus.com/bid/101321
- https://security.netapp.com/advisory/ntap-20171019-0001/
- https://www.synology.com/support/security/Synology_SA_17_66_OpenJDK
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- https://access.redhat.com/security/cve/CVE-2017-10388
- https://www.debian.org/security/2017/dsa-4015
- https://www.debian.org/security/2017/dsa-4048
- https://security.gentoo.org/glsa/201710-31
- https://security.gentoo.org/glsa/201711-14
- https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html
- https://access.redhat.com/errata/RHSA-2017:3392
- http://www.securitytracker.com/id/1039596