| Title | Oracle Java SE および Java SE Embedded における JSSE に関する脆弱性 |
|---|---|
| Summary | Oracle Java SE および Java SE Embedded には、JSSE に関する処理に不備があるため、完全性に影響のある脆弱性が存在します。 |
| Possible impacts | リモートの攻撃者により、情報を改ざんされる可能性があります。 |
| Solution | ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date | July 17, 2018, midnight |
| Registration Date | July 25, 2018, 5:25 p.m. |
| Last Update | July 25, 2018, 5:25 p.m. |
| CVSS3.0 : 警告 | |
| Score | 5.9 |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| CVSS2.0 : 警告 | |
| Score | 4.3 |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| オラクル |
| JDK 10.0.1 |
| JDK 6 Update 191 |
| JDK 7 Update 181 |
| JDK 8 Update 172 |
| JRE 10.0.1 |
| JRE 6 Update 191 |
| JRE 7 Update 181 |
| JRE 8 Update 172 |
| Oracle Java SE Embedded 8 Update 171 |
| 日立 |
| Hitachi Application Server |
| Hitachi Application Server for Developers |
| Hitachi Automation Director |
| Hitachi Compute Systems Manager |
| Hitachi Configuration Manager |
| Hitachi Device Manager |
| Hitachi Dynamic Link Manager |
| Hitachi Global Link Manager |
| Hitachi Infrastructure Analytics Advisor |
| Hitachi Replication Manager |
| Hitachi Tiered Storage Manager |
| Hitachi Tuning Manager |
| uCosminexus Application Server |
| uCosminexus Application Server (64) |
| uCosminexus Application Server Enterprise |
| uCosminexus Application Server Standard |
| uCosminexus Application Server Standard -R |
| uCosminexus Client |
| uCosminexus Developer |
| uCosminexus Developer Professional |
| uCosminexus Developer Standard |
| uCosminexus Service Architect |
| uCosminexus Service Platform |
| uCosminexus Service Platform (64) |
| No | Changed Details | Date of change |
|---|---|---|
| 1 | [2018年07月25日] 掲載 |
July 25, 2018, 5:25 p.m. |
| 2 | [2018年07月30日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新 ベンダ情報：日立 (hitachi-sec-2018-121 および hitachi-sec-2018-122) を追加 |
July 30, 2018, 3:37 p.m. |
| Summary | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 6u191, 7u181, 8u172 and 10.0.1; Java SE Embedded: 8u171. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSL/TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). |
|---|---|
| Publication Date | July 18, 2018, 10:29 p.m. |
| Registration Date | March 1, 2021, 7:23 p.m. |
| Last Update | Nov. 21, 2024, 1:04 p.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:oracle:jre:10.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jdk:10.0.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jdk:1.8.0:update172:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jdk:1.7.0:update181:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jdk:1.6.0:update191:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jre:1.6.0:update191:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jre:1.7.0:update181:*:*:*:*:*:* | |||||
| cpe:2.3:a:oracle:jre:1.8.0:update172:*:*:*:*:*:* | |||||
| Configuration2 | or higher | or less | more than | less than | |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* | |||||
| Configuration3 | or higher | or less | more than | less than | |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | |||||
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | |||||
| cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | |||||
| cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | |||||
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 | 11.70.1 | |||
| cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:* | 9.7 | ||||
| cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* | 9.7 | ||||
| cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:vmware_vsphere:*:* | |||||
| cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* | 9.7 | ||||
| Configuration4 | or higher | or less | more than | less than | |
| cpe:2.3:a:hp:xp7_command_view:*:*:*:*:advanced:*:*:* | |||||