Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8327538

The SSLExtension class specifies incorrect values for heartbeat per RFC 6520 and post_handshake_auth per RFC 8446

XMLWordPrintable

    • b08
    • generic
    • generic

      ADDITIONAL SYSTEM INFORMATION :
      All JDK's and OS types

      A DESCRIPTION OF THE PROBLEM :
      The SSLExtension class, which is part of the security libs contains the wrong value for heartbeat per RFC 6520. Its specifies 14 when it should be 15; while its set to 14, this value conflicts with use_srtp which is correctly set as 14.
      References:
      * https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
      * https://www.rfc-editor.org/rfc/rfc6520.html


      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      Check the class SSLExtension, notice the value of heartbeat duplicates use_srtp as 14 vs 15 as it should be.

      EXPECTED VERSUS ACTUAL BEHAVIOR :
      EXPECTED -
      heartbeat == 15
      ACTUAL -
      heartbeat == 14

      CUSTOMER SUBMITTED WORKAROUND :
      No workaround

      FREQUENCY : always


            hchao Haimay Chao
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: