CVE-2015-4748

OpenJDK: incorrect OCSP nextUpdate checking (Libraries, 8075374)

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 2.0

Review impact separately from score.

Published · July 14, 2015

Updated · June 28, 2026

Description

A flaw was found in the way the Libraries component of OpenJDK verified Online Certificate Status Protocol (OCSP) responses. An OCSP response with no nextUpdate date specified was incorrectly handled as having unlimited validity, possibly causing a revoked X.509 certificate to be interpreted as valid.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-299 · Improper Check for Certificate Revocation