CVE-2017-10388

Priority
Description
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE
(subcomponent: Libraries). Supported versions that are affected are Java
SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144. Difficult to
exploit vulnerability allows unauthenticated attacker with network access
via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks
require human interaction from a person other than the attacker. Successful
attacks of this vulnerability can result in takeover of Java SE, Java SE
Embedded. Note: Applies to the Java SE Kerberos client. CVSS 3.0 Base Score
7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Ubuntu-Description
Jeffrey Altman discovered that the Kerberos client implementation in
OpenJDK incorrectly trusted unauthenticated portions of Kerberos
tickets. A remote attacker could use this to impersonate trusted
network services or perform other attacks.
Notes
sbeattieanother instance of the Orpheus-Lyre vulnerability
Package
Upstream:not-affected
Ubuntu 18.04 LTS:not-affected
Ubuntu 20.04 LTS:not-affected
Ubuntu 21.10:not-affected
Ubuntu 22.04 LTS:not-affected
Ubuntu 14.04 ESM:DNE (trusty was not-affected)
Patches:
Package
Upstream:released
Ubuntu 18.04 LTS:DNE
Ubuntu 20.04 LTS:DNE
Ubuntu 21.10:DNE
Ubuntu 22.04 LTS:DNE
Ubuntu 14.04 ESM:DNE (trusty was needed)
Patches:
Package
Upstream:released
Ubuntu 18.04 LTS:DNE
Ubuntu 20.04 LTS:DNE
Ubuntu 21.10:DNE
Ubuntu 22.04 LTS:DNE
Ubuntu 14.04 ESM:DNE (trusty was released [7u151-2.6.11-2ubuntu0.14.04.1])
Patches:
Package
Upstream:released (8u151)
Ubuntu 18.04 LTS:not-affected (8u151-b12-1)
Ubuntu 20.04 LTS:not-affected (8u151-b12-1)
Ubuntu 21.10:not-affected (8u151-b12-1)
Ubuntu 16.04 ESM:released (8u151-b12-0ubuntu0.16.04.2)
Ubuntu 22.04 LTS:not-affected (8u151-b12-1)
Ubuntu 14.04 ESM:DNE
Patches:
Upstream:http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/6805783b9875
Package
Upstream:released (9.0.1)
Ubuntu 18.04 LTS:DNE
Ubuntu 20.04 LTS:DNE
Ubuntu 21.10:DNE
Ubuntu 22.04 LTS:DNE
Ubuntu 14.04 ESM:DNE
Patches:
More Information

Updated: 2022-04-25 00:18:47 UTC (commit ecc1009cb19540b950de59270950018900f37f15)