// For flags

CVE-2014-0411

OpenJDK: TLS/SSL handshake timing issues (JSSE, 8023069)

Severity Score

4.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.

Vulnerabilidad no especificada en Oracle Java SE 5.0u55, 6u65 y 7u45; JRockit R27.7.7 y R28.2.9; y Java SE Embedded 7u45 permite a atacantes remotos afectar la confidencialidad e integridad a través de vectores relacionados con JSSE.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2013-12-12 CVE Reserved
  • 2014-01-15 CVE Published
  • 2023-08-27 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (72)
URL Tag Source
http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc X_refsource_confirm
http://osvdb.org/102028 Vdb Entry
http://secunia.com/advisories/56432 Third Party Advisory
http://secunia.com/advisories/56485 Third Party Advisory
http://secunia.com/advisories/56486 Third Party Advisory
http://secunia.com/advisories/56487 Third Party Advisory
http://secunia.com/advisories/56535 Third Party Advisory
http://secunia.com/advisories/57809 Third Party Advisory
http://secunia.com/advisories/59037 Third Party Advisory
http://secunia.com/advisories/59071 Third Party Advisory
http://secunia.com/advisories/59082 Third Party Advisory
http://secunia.com/advisories/59194 Third Party Advisory
http://secunia.com/advisories/59235 Third Party Advisory
http://secunia.com/advisories/59251 Third Party Advisory
http://secunia.com/advisories/59254 Third Party Advisory
http://secunia.com/advisories/59283 Third Party Advisory
http://secunia.com/advisories/59324 Third Party Advisory
http://secunia.com/advisories/59339 Third Party Advisory
http://secunia.com/advisories/59665 Third Party Advisory
http://secunia.com/advisories/59704 Third Party Advisory
http://secunia.com/advisories/59705 Third Party Advisory
http://secunia.com/advisories/59872 Third Party Advisory
http://secunia.com/advisories/60005 Third Party Advisory
http://secunia.com/advisories/60498 Third Party Advisory
http://secunia.com/advisories/60833 Third Party Advisory
http://secunia.com/advisories/60835 Third Party Advisory
http://secunia.com/advisories/60836 Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21669519 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21675938 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21676190 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21676373 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21676978 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21677388 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21680234 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21680387 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682668 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682669 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682670 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682671 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21682904 X_refsource_confirm
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132 X_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=ssg1S1004745 X_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg21672078 X_refsource_confirm
http://www.securityfocus.com/bid/64758 Vdb Entry
http://www.securityfocus.com/bid/64918 Vdb Entry
http://www.securitytracker.com/id/1029608 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/90357 Vdb Entry
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777 X_refsource_confirm
https://www.ibm.com/support/docview.wss?uid=swg21675223 X_refsource_confirm
https://www.ibm.com/support/docview.wss?uid=swg21677913 X_refsource_confirm
URL Date SRC
URL Date SRC
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html 2022-05-13
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html 2022-05-13
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html 2022-05-13
http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html 2022-05-13
http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html 2022-05-13
http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html 2022-05-13
http://marc.info/?l=bugtraq&m=139402697611681&w=2 2022-05-13
http://marc.info/?l=bugtraq&m=139402749111889&w=2 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0026.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0027.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0030.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0097.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0134.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0135.html 2022-05-13
http://rhn.redhat.com/errata/RHSA-2014-0136.html 2022-05-13
http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html 2022-05-13
http://www.ubuntu.com/usn/USN-2089-1 2022-05-13
http://www.ubuntu.com/usn/USN-2124-1 2022-05-13
https://access.redhat.com/errata/RHSA-2014:0414 2022-05-13
https://bugzilla.redhat.com/show_bug.cgi?id=1053010 2014-07-29
https://access.redhat.com/security/cve/CVE-2014-0411 2014-07-29
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oracle
Search vendor "Oracle"
 Jrockit
Search vendor "Oracle" for product "Jrockit"
 r27.7.7
Search vendor "Oracle" for product "Jrockit" and version "r27.7.7"
-
Affected
Oracle
Search vendor "Oracle"
 Jrockit
Search vendor "Oracle" for product "Jrockit"
 r28.2.9
Search vendor "Oracle" for product "Jrockit" and version "r28.2.9"
-
Affected
Oracle
Search vendor "Oracle"
 Jre
Search vendor "Oracle" for product "Jre"
 1.7.0
Search vendor "Oracle" for product "Jre" and version "1.7.0"
update45
Affected
Oracle
Search vendor "Oracle"
 Jdk
Search vendor "Oracle" for product "Jdk"
 1.5.0
Search vendor "Oracle" for product "Jdk" and version "1.5.0"
update55
Affected
Oracle
Search vendor "Oracle"
 Jre
Search vendor "Oracle" for product "Jre"
 1.5.0
Search vendor "Oracle" for product "Jre" and version "1.5.0"
update55
Affected
Oracle
Search vendor "Oracle"
 Jdk
Search vendor "Oracle" for product "Jdk"
 1.6.0
Search vendor "Oracle" for product "Jdk" and version "1.6.0"
update65
Affected
Oracle
Search vendor "Oracle"
 Jre
Search vendor "Oracle" for product "Jre"
 1.6.0
Search vendor "Oracle" for product "Jre" and version "1.6.0"
update65
Affected