CVE-2017-10116

Public on 2017-07-25
Modified on 2017-08-15
Description
It was discovered that the LDAPCertStore class in the Security component of OpenJDK followed LDAP referrals to arbitrary URLs. A specially crafted LDAP referral URL could cause LDAPCertStore to communicate with non-LDAP servers.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 java-1.7.0-openjdk 2017-08-15 ALAS-2017-869 Fixed
Amazon Linux 1 java-1.8.0-openjdk 2017-07-25 ALAS-2017-860 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2017-10116 Mitre: CVE-2017-10116