Description
The Java Secure Socket Extension (JSSE) in Sun JDK and JRE 6 Update 1 and earlier, JDK and JRE 5.0 Updates 7 through 11, and SDK and JRE 1.4.2_11 through 1.4.2_14, when using JSSE for SSL/TLS support, allows remote attackers to cause a denial of service (CPU consumption) via certain SSL/TLS handshake requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | java-1.4.2-bea +5 | 1.4.2.16-1jpp.1.el5 | RHSA-2008:0100 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el5 | RHSA-2008:0132 |
| RHEL 5 | java-1.5.0-bea +5 | 1.5.0.11-1jpp.1.el5 | RHSA-2007:0956 |
| RHEL 4 | java-1.4.2-bea +2 | 1.4.2.15-1jpp.2.el4 | RHSA-2007:1086 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.10-1jpp.2.el4 | RHSA-2008:0132 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.12-1jpp.2.el4 | RHSA-2007:0818 |
| RHEL 3 | java-1.4.2-bea +2 | 1.4.2.16-1jpp.1.el3 | RHSA-2008:0100 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.10-1jpp.2.el3 | RHSA-2008:0132 |
Advisories 5
- RHSA-2008:0132 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2008:0100 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:1086 Red Hat Security Advisory: java-1.4.2-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0956 Red Hat Security Advisory: java-1.5.0-bea security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0818 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2008:0132 vendor-advisory
- RHSA-2007:0818 vendor-advisory
- ADV-2007-2660 vdb-entry
- 26933 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=307177
- 24846 vdb-entry
- 26314 third-party-advisory
- oval:org.mitre.oval:def:10634 vdb-entry signature
- http://support.novell.com/techcenter/psdb/0c36b6416afc3868b8b1b9012955e323.html
- 20070725 Vulnerability in Java Secure Socket Extension vendor-advisory
- sun-jsse-ssltls-dos(35333) vdb-entry
- 29897 third-party-advisory
- 26015 third-party-advisory
- 28056 third-party-advisory
- APPLE-SA-2007-12-14 vendor-advisory
- RHSA-2008:0100 vendor-advisory
- 26221 third-party-advisory
- SUSE-SA:2008:025 vendor-advisory
- RHSA-2007:0956 vendor-advisory
- 26645 third-party-advisory
- SSRT071465 vendor-advisory
- 28777 third-party-advisory
- 1018357 vdb-entry
- ADV-2007-4224 vdb-entry
- ADV-2007-3861 vdb-entry
- ADV-2007-3009 vdb-entry
- 102997 vendor-advisory
- 28880 third-party-advisory
- 27716 third-party-advisory
- 36663 vdb-entry
- GLSA-200709-15 vendor-advisory
- 28115 third-party-advisory
- 29340 third-party-advisory
- ADV-2007-2495 vdb-entry
- RHSA-2007:1086 vendor-advisory
- 27203 third-party-advisory
- 26631 third-party-advisory
- BEA07-178.00 vendor-advisory
- 27635 third-party-advisory
- http://www.cisco.com/warp/public/707/cisco-sr-20070725-jsse.shtml