PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2015-2601

CVE-2015-2601

OpenJDK: non-constant time comparisons in crypto code (JCE, 8074865)

Loading…

Severity

Moderate

Red Hat Product Security

5

CVSS 2.0

Review impact separately from score.

Published · July 14, 2015

Updated · June 28, 2026

Description

It was discovered that the JCE component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring the time used to perform operations using these non-constant time comparisons.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-385 · Covert Timing Channel