How To Fix CVE-2022-21449 Psychic Signatures Vulnerability in Java?

How To Fix CVE-2022-21449- Psychic Signatures Vulnerability In Java?

(1 votes, average: 5.00 out of 5)

The Java CVE-2022-21449 is a high-level vulnerability with a CVSS score of 7.5. Due to this vulnerable loophole, cyber-attackers are capable of exfiltrating the unauthorized content and intercepting the confidential data secured using SSL certificates. In addition, it also supports hackers in bypassing security tokens, such as OIDC ID, SAML assertions, WebAuthn, and signed JWTs.

The primary target of this vulnerability was digital signatures based on the ECDASA or Elliptic Curve Digital Signature Algorithm. This algorithm uses a “r” and “s” value for signature validation purposes. And it’s the rule that both these values should not be zero. However, with the Psychic Signatures vulnerability, attackers were able to pass the “0” value, leading Java to accept blank signatures as valid.

Further, according to the OpenJDK, versions 15, 16, 17, and 18 were impacted by it. So, it was recommended to update the JDK to 17.0.3 or 18.0.1 to patch the loophole.

The Accurate Way To Patch CVE-2022-21449 Vulnerability

To patch the CVE-2022-21449 vulnerability, you have to upgrade your JDK (Java Development Kit) to a minimum of version 17.0.3 or 18.0.1. Both these and the later version consist of the patches released by Oracle to mitigate this vulnerable loophole in your Java applications.

Here, we have demonstrated the update for a Linux-based system (Ubuntu). But you can use the procedure with relevant commands per your operating system.

Step 1: Open the CLI and run the following command to check the version of the currently installed Java development kit.

$ java -version

Step 2: If the current version is below 17.0.3, then run the following command.

$ wget -no-check-certificate “https://download.oracle.com/java/17/archive/jdk-17.0.3_linux-x64_bin.deb”

You need to modify the link per your operating system requirements. All the links are available on the Oracle Java download website. You are required to copy and paste the download link in the command.

Step 3: As the download executes, provide all the necessary permissions. In addition, configure the execution permission by using the below command.

$ sudo chmod +x jdk-17.0.3_linux-x64_bin.db

Step 4: Now, download the deb package using the “apt” command. You can also use the “dpkg” command for this Linux system.

$ sudo apt install /home/arunkl/jdk-17.0.3_linux-x64_bin.deb

In this command, you need to provide the path to your JDK file. Once the installation completes, the new version of Java will be installed on your system.

Step 5: Lastly, verify the patched version of Java by running the following command.

$ java -version

As a result, you will see that Java version 17.0.3 is installed, and the CVE-2022-21449 vulnerability is patched.

What To Consider With Vulnerable Loophole Patching?

Along with updating the Java version of your applications, you should consider using an authentic SSL certificate. Reliable Certificate Authorities constantly work to advance their certificate to provide top-notch security. So, you should prefer purchasing SSL certificates from such CAs.

Some of the most trusted SSL certificates in the market are:

Once you combine the Java upgrade with the SSL mentioned above certificate, your application will work in accordance with maintaining data integrity and confidentiality.

Conclusion

The CVE-2022-21449 vulnerability is for Psychic Signatures in Java applications. This vulnerability impacts the signature validation algorithm, the Elliptic Curve Digital Signature Algorithm. Due to this, attackers bypassed authentication and accessed confidential data. To mitigate this issue, you should upgrade the Java version to 17.0.3 or 18.0.1.

The mentioned process is for the Ubuntu operating system. But you can update the Java on any OS by using the relevant version update commands.