CVE-2022-21449

[boaks]

CVE-2022-21449

WikiPedia -Elliptic Curve Digital Signature Algorithm

Oracle Critical Patch Update Advisory - April 2022

openjdk - 15, 17, 18

CVE-2022-21449: Psychic Signatures in Java

Edited:

ECDSA is reported to be broken for java 15, 16, 17 and 18, if malicious values in the signature is used.
The signature consists of two INTEGER. Both must be with a valid range [1 ... N-1].
If not, e.g. the INTEGER are 0, then the signature always passes the verification.

That enables an attacker to present a signature, the other can't really verify.
A server will not be able to check the client's signature (and so it's authentication).
A client will not be able to check the server's signature (and so it's authentication).
That enables MiM attacks.
It is also not possible, to verify ECDSA signatures in a x509 certificate chain.

Please update the JVM accordingly.

To check the ECDSA vulnerability of your jvm and the Californium DTLS work-around, please update to the current master.

> mvn test -Dtest="Asn1DerDecoderTest#testBrokenEcdsa" -DfailIfNoTests=false -pl element-connector
...
Java 17.0.2, SunEC version 17 is vulnerable for ECDSA R := 0, CVE-2022-21449!
Java 17.0.2, SunEC version 17 is vulnerable for ECDSA R := N, CVE-2022-21449!
...

Or

...
Java 17.0.3, SunEC version 17 is not vulnerable for ECDSA R := 0, CVE-2022-21449!
Java 17.0.3, SunEC version 17 is not vulnerable for ECDSA R := N, CVE-2022-21449!
...

(With a fixed jvm/jce.)

24. April 2022:

Currently fixed versions:
17.0.3
18.0.1

Still not fixed
15.0.2
16.0.2

Not affected:
java 11, java 8, java 7.

Also not affected:
Bouncy Castle (checked with 1.70).

> mvn test -Dtest="Asn1DerDecoderTest#testBrokenEcdsa" -DfailIfNoTests=false -pl element-connector -Pbc-tests
...
Java 17.0.2, BC version 1.7 is not vulnerable for ECDSA R := 0, CVE-2022-21449!
Java 17.0.2, BC version 1.7, possible: error decoding signature bytes.
Java 17.0.2, BC version 1.7 is not vulnerable for ECDSA R := N, CVE-2022-21449!
...

[boaks]

See PR #1996

[boaks]

Some distribution have already a release of java 17.0.3, others are pending.
Maybe PR #1996 helps in the meantime for DTLS.

[boaks]

See #2001. The minor version 3.5.0 should get available during today.

[boaks]

In the meantime, the most JCE of the jvm have been fixed, at least those with LTS.
For java 15 and 16 please update to 17.0.3.