Cybersecurity experts have urged administrators to apply a patch for CVE-2022-21449 – a vulnerability affecting those who use Elliptic Curve Digital Signature Algorithm (ECDSA) signatures in Java 15, Java 16, Java 17 or Java 18.
This new Java vulnerability stems from an incorrect implementation of the ECDSA signature verification algorithm and essentially allows an attacker to potentially intercept communications and messages that would otherwise have to be encrypted, such as SSL communication, authentication, etc. It has a CVSS of 7.5.
Oracle released a patch for the vulnerability on Wednesday after security firm ForgeRock notified the OpenJDK vulnerability team of the issue.
ForgeRock’s Neil Madden published his own detailed blog on the matter, noting that it allows an attacker to “easily forge certain types of SSL certificates and handshakes (allowing interception and modification of communications), JWTs statements, SAML assertions or OIDC ID tokens, and even WebAuthn authentication messages.
“All use the digital equivalent of a blank sheet of paper,” Madden added.
Madden said ECDSA is a widely used standard for signing all kinds of digital documents, but the vulnerability allows attackers to use “the digital equivalent of a blank ID card.”
Madden discovered the bug in November 2021 and notified Oracle the same day. The company acknowledged the disclosure the following day.
ForgeRock did not hear from Oracle until January, when the company announced that a fix for the problem would be included in the April release.
Amazon Corretto, a cross-platform distribution of the Open Java Development Kit (OpenJDK), has updated its own system to reflect the changes. JFrog security researchers have created a tool that helps identify JAR/WAR archives vulnerable to CVE-2022-21449.
“The Java ‘Psychic Signatures’ vulnerability causes the integrity of any content guaranteed by electronic signatures to be voided. This can have serious implications for several financial transactions across industries using SSL handshakes, electronic signatures, SOA, and more. said Brian Moussalli of JFrog Security Research.
“The lack of a secure handshake between systems allows an attacker to access content that should be protected, which could have critical implications for consumers and businesses.”
Mike Parkin of Vulcan Cyber called CVE-2022-21449 a “hot fix” vulnerability and said it was an example of a good cryptosystem rendered useless by a bad implementation error.
Elliptic curve cryptography isn’t the problem, Parkin explained, telling The Record that it’s more how it was implemented in Java.
“A separate issue is Oracle’s practice of making a few large patch clusters on a quarterly basis, rather than releasing patches with higher frequency and urgency,” Parkin said.
Bugcrowd CTO Casey Ellis said he was surprised the bug only got a CVSS of 7.5 given the wide range of potential places where the vulnerability could exist.
“This vulnerability looks pretty nasty,” Ellis said.
Comments are closed.