CVE-2014-0416

OpenJDK: insecure subject principals set handling (JAAS, 8024306)

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 2.0

Review impact separately from score.

Published · January 14, 2014

Updated · June 28, 2026

Description

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect integrity via vectors related to JAAS. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to how principals are set for the Subject class, which allows attackers to escape the sandbox using deserialization of a crafted Subject instance.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE not specified