Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: P3
Fix Version/s: 23
Affects Version/s: 21, 22, 23
Component/s: security-libs
Labels:

Subcomponent:
javax.crypto
Resolved In Build:
b06
Verification:
Not verified

Issue	Fix Version	Assignee	Priority	Status	Resolution	Resolved In Build
JDK-8324353	22.0.1	Weijun Wang	P3	Resolved	Fixed	b02
JDK-8323618	22	Weijun Wang	P3	Resolved	Fixed	b32
JDK-8335970	21.0.5-oracle	Prajwal Kumaraswamy	P3	Resolved	Fixed	b03
JDK-8338074	21.0.5	Andrew Hughes	P3	Resolved	Fixed	b03
JDK-8335178	17.0.13-oracle	Weijun Wang	P3	Resolved	Fixed	b01
JDK-8336894	17.0.13	Weijun Wang	P3	Resolved	Fixed	b01
JDK-8330601	17.0.0.1	Weijun Wang	P3	Resolved	Fixed	b01

Similar to other JCE crypto services like Cipher, Mac, and KeyAgreement, when a KEM object is instantiated from a 3rd party security provider, it should make sure the provider is loaded from a signed JAR.

backported by

JDK-8323618 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8324353 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8330601 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8335178 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8335970 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8336894 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

JDK-8338074 KEM.getInstance() should check if a 3rd-party security provider is signed

Resolved

csr for

JDK-8322974 KEM.getInstance() should check if a 3rd-party security provider is signed

Closed

relates to

JDK-8301034 JEP 452: Key Encapsulation Mechanism API

Closed

JDK-8297878 KEM: Implementation

Resolved

links to

Commit openjdk/jdk17u-ri/e9d2641a

Commit openjdk/jdk22/4ea14b27

Commit openjdk/jdk/9fd855ed

Commit(master) openjdk/jdk17u-dev/e49367bb

Commit(master) openjdk/jdk21u-dev/fd4ce63c

Review openjdk/jdk17u-ri/1

Review openjdk/jdk22/61

Review openjdk/jdk/17253

Review(master) openjdk/jdk17u-dev/2518

Review(master) openjdk/jdk21u-dev/893

(2 backported by, 1 csr for, 2 relates to, 10 links to)

1.	Release Note: KEM.getInstance() Should Check If a Third-Party Security Provider Is Signed		Resolved	Weijun Wang
2.	Update the Security Guide for this change		Resolved	Raymond Gallardo

Assignee:: Weijun Wang
Reporter:: Weijun Wang
Votes:: 0 Vote for this issue
Watchers:: 5 Start watching this issue

Created:: 2024-01-03 11:52
Updated:: 2025-06-02 14:56
Resolved:: 2024-01-11 05:46

Details

Backports

Description

Attachments

Issue Links

Sub-Tasks

Activity

People

Dates