CVE-2015-2601

Impact:
Moderate
Public Date:
2015-07-14
CWE:
CWE-385
Bugzilla:
1242019: CVE-2015-2601 OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)
It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons.

Find out more about CVE-2015-2601 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 5
Base Metrics AV:N/AC:L/Au:N/C:P/I:N/A:N
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Oracle Java for Red Hat Enterprise Linux 6 (java-1.8.0-oracle) RHSA-2015:1241 2015-07-17
Red Hat Enterprise Linux Supplementary (v. 7) (java-1.7.1-ibm) RHSA-2015:1485 2015-07-22
Oracle Java for Red Hat Enterprise Linux 6 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Oracle Java for Red Hat Enterprise Linux 6 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Red Hat Enterprise Linux Supplementary 5 (java-1.6.0-ibm) RHSA-2015:1486 2015-07-22
Oracle Java for Red Hat Enterprise Linux 7 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Oracle Java for Red Hat Enterprise Linux 7 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Red Hat Enterprise Linux Supplementary 5 (java-1.7.0-ibm) RHSA-2015:1488 2015-07-23
Red Hat Enterprise Linux Supplementary 5 (java-1.5.0-ibm) RHSA-2015:1544 2015-08-04
Red Hat Enterprise Linux 6 (java-1.8.0-openjdk) RHSA-2015:1228 2015-07-15
Red Hat Enterprise Linux 6 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.5.0-ibm) RHSA-2015:1544 2015-08-04
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.6.0-ibm) RHSA-2015:1486 2015-07-22
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.7.1-ibm) RHSA-2015:1485 2015-07-22
Oracle Java for Red Hat Enterprise Linux 7 (java-1.8.0-oracle) RHSA-2015:1241 2015-07-17
Red Hat Enterprise Linux 5 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Enterprise Linux 6 (java-1.7.0-openjdk) RHSA-2015:1229 2015-07-15
Red Hat Satellite 5.6 (RHEL v.6) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Red Hat Enterprise Linux 5 (java-1.7.0-openjdk) RHSA-2015:1230 2015-07-15
Red Hat Enterprise Linux 7 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Satellite 5.7 (RHEL v.6) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Red Hat Satellite 5.6 (RHEL v.5) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Oracle Java for Red Hat Enterprise Linux 5 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Oracle Java for Red Hat Enterprise Linux 5 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Red Hat Enterprise Linux 7 (java-1.8.0-openjdk) RHSA-2015:1228 2015-07-15
Red Hat Enterprise Linux 7 (java-1.7.0-openjdk) RHSA-2015:1229 2015-07-15

External References

Last Modified