Re: Java 8u40 released: why?

[Gsunde Orangen <gsunde.orangen () gmail com>]

I'd be interested in that, too.
In case this out-of-band release is about an important security fix,
then either this is something new (details still to be disclosed).
Or it is associated with CVE-2014-6593 (e.g. incomplete or buggy fix in
the January release)? The detais (named as "SKIP-TLS") had been
disclosed just this week along with the "FREAK" attack (see
https://www.smacktls.com/#skip). Former descriptions of CVE-2014-6593
only indicated a failure to properly check the ChangeCipherSpec in the
TLS connection handshake; but apparently - esp. on client side - much
more could go wrong in former JSSE implemenations.

Maybe someone involved in openJDK could tell more...

Gsunde


On 04.03.2015, 02:23 paul.szabo () sydney edu au wrote:
> I notice that Java (JDK, JRE) update 8u40 has been released.
> Though
>   http://www.oracle.com/technetwork/java/javase/downloads/index.html
> says "this release includes important security fixes", the release notes
>   http://www.oracle.com/technetwork/java/javase/8u40-relnotes-2389089.html
> says the "security baseline" is 1.8.0_31 (unchanged).
> I do not notice any major "useability" issues fixed.
> So: why this out-of-band release?
>
> Thanks, Paul
>
> Paul Szabo   psz () maths usyd edu au   http://www.maths.usyd.edu.au/u/psz/
> School of Mathematics and Statistics   University of Sydney    Australia
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/