PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2014-6457

CVE-2014-6457

OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066)

Loading…

Severity

Moderate

Red Hat Product Security

4

CVSS 2.0

Review impact separately from score.

Published · October 14, 2014

Updated · June 28, 2026

Description

It was discovered that the TLS/SSL implementation in the JSSE component in OpenJDK failed to properly verify the server identity during the renegotiation following session resumption, making it possible for malicious TLS/SSL servers to perform a Triple Handshake attack against clients using JSSE and client certificate authentication.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 4
AV:N/AC:H/Au:N/C:P/I:P/A:N

CWE not specified