CVE-2014-0411: Software Security Vulnerability Vulnerability

MODERATE

Advisory Identifier: GHSA-mqjj-vv82-vh6r

Published 2022-05-13

Advisory Summary

CVE-2014-0411 is a MODERATE security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2014-0411 at a Glance

CVE Identifier CVE-2014-0411

GHSA Identifier GHSA-mqjj-vv82-vh6r

Severity MODERATE

CVSS v3.1 Base Score N/A

CWE Classification General Security Weakness

Affected Product Software

Package Ecosystem Maven

Published Date 2022-05-13

Last Updated 2022-05-13

How to Fix CVE-2014-0411

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2014-0411, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.

References

NVD — CVE-2014-0411 NVD

https://nvd.nist.gov/vuln/detail/CVE-2014-0411

access.redhat.com/errata/rhsa-2014:04... WEB

https://access.redhat.com/errata/RHSA-2014:0414

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=1053010

exchange.xforce.ibmcloud.com/vulnerabilities/903... WEB

https://exchange.xforce.ibmcloud.com/vulnerabilities/90357

h20566.www2.hpe.com/portal/site/hpsc/pu... WEB

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777

www.ibm.com/support/docview.wss WEB

https://www.ibm.com/support/docview.wss?uid=swg21675223

www.ibm.com/support/docview.wss WEB

https://www.ibm.com/support/docview.wss?uid=swg21677913

hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev... WEB

http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc

Software Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html

Software Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html

Software Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html

lists.opensuse.org/opensuse-updates/20... WEB

http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html

lists.opensuse.org/opensuse-updates/20... WEB

http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html

lists.opensuse.org/opensuse-updates/20... WEB

http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html

marc.info/ WEB

http://marc.info/?l=bugtraq&m=139402697611681&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=139402749111889&w=2

osvdb.org/102028 WEB

http://osvdb.org/102028

rhn.redhat.com/errata/rhsa-2014-00... WEB

http://rhn.redhat.com/errata/RHSA-2014-0026.html

rhn.redhat.com/errata/rhsa-2014-00... WEB

http://rhn.redhat.com/errata/RHSA-2014-0027.html

rhn.redhat.com/errata/rhsa-2014-00... WEB

http://rhn.redhat.com/errata/RHSA-2014-0030.html

rhn.redhat.com/errata/rhsa-2014-00... WEB

http://rhn.redhat.com/errata/RHSA-2014-0097.html

rhn.redhat.com/errata/rhsa-2014-01... WEB

http://rhn.redhat.com/errata/RHSA-2014-0134.html

rhn.redhat.com/errata/rhsa-2014-01... WEB

http://rhn.redhat.com/errata/RHSA-2014-0135.html

rhn.redhat.com/errata/rhsa-2014-01... WEB

http://rhn.redhat.com/errata/RHSA-2014-0136.html

secunia.com/advisories/56432 WEB

http://secunia.com/advisories/56432

secunia.com/advisories/56485 WEB

http://secunia.com/advisories/56485

secunia.com/advisories/56486 WEB

http://secunia.com/advisories/56486

secunia.com/advisories/56487 WEB

http://secunia.com/advisories/56487

secunia.com/advisories/56535 WEB

http://secunia.com/advisories/56535

secunia.com/advisories/57809 WEB

http://secunia.com/advisories/57809

secunia.com/advisories/59037 WEB

http://secunia.com/advisories/59037

secunia.com/advisories/59071 WEB

http://secunia.com/advisories/59071

secunia.com/advisories/59082 WEB

http://secunia.com/advisories/59082

secunia.com/advisories/59194 WEB

http://secunia.com/advisories/59194

secunia.com/advisories/59235 WEB

http://secunia.com/advisories/59235

secunia.com/advisories/59251 WEB

http://secunia.com/advisories/59251

secunia.com/advisories/59254 WEB

http://secunia.com/advisories/59254

secunia.com/advisories/59283 WEB

http://secunia.com/advisories/59283

secunia.com/advisories/59324 WEB

http://secunia.com/advisories/59324

secunia.com/advisories/59339 WEB

http://secunia.com/advisories/59339

secunia.com/advisories/59665 WEB

http://secunia.com/advisories/59665

secunia.com/advisories/59704 WEB

http://secunia.com/advisories/59704

secunia.com/advisories/59705 WEB

http://secunia.com/advisories/59705

secunia.com/advisories/59872 WEB

http://secunia.com/advisories/59872

secunia.com/advisories/60005 WEB

http://secunia.com/advisories/60005

secunia.com/advisories/60498 WEB

http://secunia.com/advisories/60498

secunia.com/advisories/60833 WEB

http://secunia.com/advisories/60833

secunia.com/advisories/60835 WEB

http://secunia.com/advisories/60835

secunia.com/advisories/60836 WEB

http://secunia.com/advisories/60836

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21669519

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21675938

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676190

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676373

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21676978

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21677388

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21680234

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21680387

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21682668

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21682669

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21682670

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21682671

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21682904

www-947.ibm.com/support/entry/porta... WEB

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132

www.ibm.com/support/docview.wss WEB

http://www.ibm.com/support/docview.wss?uid=ssg1S1004745

www.ibm.com/support/docview.wss WEB

http://www.ibm.com/support/docview.wss?uid=swg21672078

Software Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html

Software Security Information SECURITY

http://www.securityfocus.com/bid/64758

Software Security Information SECURITY

http://www.securityfocus.com/bid/64918

Software Security Information SECURITY

http://www.securitytracker.com/id/1029608

www.ubuntu.com/usn/usn-2089-1 WEB

http://www.ubuntu.com/usn/USN-2089-1

www.ubuntu.com/usn/usn-2124-1 WEB

http://www.ubuntu.com/usn/USN-2124-1

Frequently Asked Questions

What is CVE-2014-0411?

CVE-2014-0411 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.

Which Software versions are affected?

Affected versions include releases prior to current release patches.

What version fixes CVE-2014-0411?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

What CWE is associated with CVE-2014-0411?

CVE-2014-0411 is classified under General Security Weakness.

How can I check Maven dependencies for CVE-2014-0411?

Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mqjj-vv82-vh6r",
  "modified" : "2022-05-13T01:16:46Z",
  "published" : "2022-05-13T01:16:46Z",
  "aliases" : [ "CVE-2014-0411" ],
  "details" : "Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; JRockit R27.7.7 and R28.2.9; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality and integrity via vectors related to JSSE.  NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to obtain sensitive information about encryption keys via a timing discrepancy during the TLS/SSL handshake.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2014-0411"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2014:0414"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1053010"
  }, {
    "type" : "WEB",
    "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/90357"
  }, {
    "type" : "WEB",
    "url" : "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04166777"
  }, {
    "type" : "WEB",
    "url" : "https://www.ibm.com/support/docview.wss?uid=swg21675223"
  }, {
    "type" : "WEB",
    "url" : "https://www.ibm.com/support/docview.wss?uid=swg21677913"
  }, {
    "type" : "WEB",
    "url" : "http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/d533e96c7acc"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00009.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00012.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00024.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-updates/2014-01/msg00105.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-updates/2014-01/msg00107.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-updates/2014-02/msg00000.html"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=139402697611681&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=139402749111889&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://osvdb.org/102028"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0026.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0027.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0030.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0097.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0134.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0135.html"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0136.html"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/56432"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/56485"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/56486"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/56487"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/56535"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/57809"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59037"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59071"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59082"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59194"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59235"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59251"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59254"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59283"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59324"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59339"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59665"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59704"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59705"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/59872"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60005"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60498"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60833"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60835"
  }, {
    "type" : "WEB",
    "url" : "http://secunia.com/advisories/60836"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004656"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21669519"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21675938"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676190"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676373"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21676978"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21677388"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21680234"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21680387"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21682668"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21682669"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21682670"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21682671"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21682904"
  }, {
    "type" : "WEB",
    "url" : "http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096132"
  }, {
    "type" : "WEB",
    "url" : "http://www.ibm.com/support/docview.wss?uid=ssg1S1004745"
  }, {
    "type" : "WEB",
    "url" : "http://www.ibm.com/support/docview.wss?uid=swg21672078"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/64758"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/64918"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id/1029608"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-2089-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-2124-1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2014-01-15T16:08:00Z"
  }
}

Advisory Metadata

Source ID: GHSA-mqjj-vv82-vh6r
Schema Version: 1.4.0
Published: 2022-05-13 01:16
Last Modified: 2022-05-13 01:16
Database Record File: advisories/unreviewed/2022/05/GHSA-mqjj-vv82-vh6r/GHSA-mqjj-vv82-vh6r.json