Описание
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.
Отчет
The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates). The OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.
Меры по смягчению последствий
Users of OpenJDK RPM packages in Red Hat Enterprise Linux can resolve this issue by installing updated ca-certificates packages fixing CVE-2026-114406. Also refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of OpenJDK 11 ELS | java-11-openjdk | Not affected | ||
| Red Hat build of OpenJDK 1.8 | java-openjdk-portable.portable.jdk.el.x86_64.tar.xz | Affected | ||
| Red Hat build of OpenJDK 1.8 | java-openjdk.win.jdk.x86_64.zip | Affected | ||
| Red Hat Enterprise Linux 10 | java-21-openjdk | Not affected | ||
| Red Hat Enterprise Linux 10 | java-25-openjdk | Not affected | ||
| Red Hat Enterprise Linux 6 | java-1.8.0-openjdk | Not affected | ||
| Red Hat Enterprise Linux 7 | java-1.8.0-openjdk | Not affected | ||
| Red Hat Enterprise Linux 8 | java-17-openjdk | Not affected | ||
| Red Hat Enterprise Linux 8 | java-1.8.0-openjdk | Not affected | ||
| Red Hat Enterprise Linux 8 | java-21-openjdk | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerabil
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnera...
ELSA-2026-500451: ca-certificates security update (IMPORTANT)
ELSA-2026-500450: ca-certificates security update (IMPORTANT)
EPSS
8.1 High
CVSS3