{"id":1668,"date":"2023-11-07T12:10:55","date_gmt":"2023-11-07T12:10:55","guid":{"rendered":"https:\/\/certera.com\/kb\/?p=1668"},"modified":"2024-10-08T05:18:23","modified_gmt":"2024-10-08T05:18:23","slug":"how-to-fix-cve-2022-21449-psychic-signatures-vulnerability-in-java","status":"publish","type":"post","link":"https:\/\/certera.com\/kb\/how-to-fix-cve-2022-21449-psychic-signatures-vulnerability-in-java\/","title":{"rendered":"How To Fix CVE-2022-21449- Psychic Signatures Vulnerability In Java?"},"content":{"rendered":"\n

The Java CVE-2022-21449 is a high-level vulnerability with a CVSS score of 7.5. Due to this vulnerable loophole, cyber-attackers can exfiltrate the unauthorized content and intercept the confidential data secured using SSL certificates. <\/p>\n\n\n\n

In addition, it also supports hackers in bypassing security tokens, such as OIDC ID, SAML assertions, WebAuthn, and signed JWTs.<\/p>\n\n\n\n

The primary target of this vulnerability was digital signatures based on the ECDASA or Elliptic Curve Digital Signature Algorithm. This algorithm uses a \u201cr\u201d and \u201cs\u201d value for signature validation. <\/p>\n\n\n\n

And it\u2019s the rule that both these values should not be zero. However, with the Psychic Signatures vulnerability, attackers could pass the “0” value, leading Java to accept blank signatures as valid.<\/p>\n\n\n\n

Further, according to the OpenJDK, versions 15, 16, 17, and 18 were impacted by it.<\/strong> So, it was recommended that the JDK be updated to 17.0.3 or 18.0.1 to patch the loophole.<\/p>\n\n\n\n

\"Buy<\/a><\/figure>\n\n\n\n

The Accurate Way To Patch CVE-2022-21449 Vulnerability<\/h2>\n\n\n\n

To patch the CVE-2022-21449 vulnerability, you have to upgrade your JDK (Java Development Kit) to a minimum of version 17.0.3 or 18.0.1. Both these and the later version consist of the patches released by Oracle to mitigate this vulnerable loophole in your Java applications.<\/p>\n\n\n\n

Here, we have demonstrated the update for a Linux-based system (Ubuntu). But you can use the procedure with relevant commands per your operating system.<\/strong><\/p>\n\n\n\n

Step 1: <\/strong>Open the CLI and run the following command to check the version of the currently installed Java development kit.<\/p>\n\n\n\n

$ java -version<\/code><\/pre>\n\n\n\n
Step 2:<\/strong> If the current version is below 17.0.3, then run the following command.<\/p>\n\n\n\n
$ wget -no-check-certificate \u201chttps:\/\/download.oracle.com\/java\/17\/archive\/jdk-17.0.3_linux-x64_bin.deb<\/strong>\u201d<\/code><\/pre>\n\n\n\n
You need to modify the link per your operating system requirements. All the links are available on the Oracle Java download website. You are required to copy and paste the download link in the command.<\/p>\n\n\n\n
Step 3:<\/strong> As the download executes, provide all the necessary permissions. In addition, configure the execution permission by using the below command.<\/p>\n\n\n\n
$ sudo chmod +x jdk-17.0.3_linux-x64_bin.db<\/code><\/pre>\n\n\n\n
Step 4:<\/strong> Now, download the deb package using the \u201capt\u201d command. You can also use the “dpkg\u201d command for this Linux system.<\/p>\n\n\n\n
$ sudo apt install \/home\/arunkl\/jdk-17.0.3_linux-x64_bin.deb<\/code><\/pre>\n\n\n\n
In this command, you need to provide the path to your JDK file. Once the installation completes, the new version of Java will be installed on your system.<\/p>\n\n\n\n
Step 5:<\/strong> Lastly, verify the patched version of Java by running the following command.<\/p>\n\n\n\n
$ java -version<\/code><\/pre>\n\n\n\n
As a result, you will see that Java version 17.0.3 is installed, and the CVE-2022-21449 vulnerability is patched.<\/p>\n\n\n\n
What To Consider With Vulnerable Loophole Patching?<\/h2>\n\n\n\n
Along with updating the Java version of your applications, you should consider using an authentic SSL certificate. Reliable Certificate Authorities constantly work to advance their certificate to provide top-notch security. So, you should prefer purchasing SSL certificates from such CAs.<\/p>\n\n\n\n
Some of the most trusted SSL certificates in the market are:<\/strong><\/p>\n\n\n\n