CVE-2015-4748

Impact:
Moderate
Public Date:
2015-07-14
CWE:
CWE-299
Bugzilla:
1242281: CVE-2015-4748 OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)
A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid.

Find out more about CVE-2015-4748 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 4.3
Base Metrics AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Oracle Java for Red Hat Enterprise Linux 6 (java-1.8.0-oracle) RHSA-2015:1241 2015-07-17
Red Hat Enterprise Linux Supplementary (v. 7) (java-1.7.1-ibm) RHSA-2015:1485 2015-07-22
Oracle Java for Red Hat Enterprise Linux 6 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Oracle Java for Red Hat Enterprise Linux 6 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Red Hat Enterprise Linux Supplementary 5 (java-1.6.0-ibm) RHSA-2015:1486 2015-07-22
Oracle Java for Red Hat Enterprise Linux 7 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Oracle Java for Red Hat Enterprise Linux 7 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Red Hat Enterprise Linux Supplementary 5 (java-1.7.0-ibm) RHSA-2015:1488 2015-07-23
Red Hat Enterprise Linux Supplementary 5 (java-1.5.0-ibm) RHSA-2015:1544 2015-08-04
Red Hat Enterprise Linux 6 (java-1.8.0-openjdk) RHSA-2015:1228 2015-07-15
Red Hat Enterprise Linux 6 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.5.0-ibm) RHSA-2015:1544 2015-08-04
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.6.0-ibm) RHSA-2015:1486 2015-07-22
Red Hat Enterprise Linux Supplementary (v. 6) (java-1.7.1-ibm) RHSA-2015:1485 2015-07-22
Oracle Java for Red Hat Enterprise Linux 7 (java-1.8.0-oracle) RHSA-2015:1241 2015-07-17
Red Hat Enterprise Linux 5 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Enterprise Linux 6 (java-1.7.0-openjdk) RHSA-2015:1229 2015-07-15
Red Hat Satellite 5.6 (RHEL v.6) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Red Hat Enterprise Linux 5 (java-1.7.0-openjdk) RHSA-2015:1230 2015-07-15
Red Hat Enterprise Linux 7 (java-1.6.0-openjdk) RHSA-2015:1526 2015-07-30
Red Hat Satellite 5.7 (RHEL v.6) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Red Hat Satellite 5.6 (RHEL v.5) (java-1.6.0-ibm) RHSA-2015:1604 2015-08-12
Oracle Java for Red Hat Enterprise Linux 5 (java-1.7.0-oracle) RHSA-2015:1242 2015-07-17
Oracle Java for Red Hat Enterprise Linux 5 (java-1.6.0-sun) RHSA-2015:1243 2015-07-17
Red Hat Enterprise Linux 7 (java-1.8.0-openjdk) RHSA-2015:1228 2015-07-15
Red Hat Enterprise Linux 7 (java-1.7.0-openjdk) RHSA-2015:1229 2015-07-15

External References

Last Modified