#944666 jconsole does not validate the hostname against the CN/Altname of the certificate

Package:
openjdk-11-jdk
Source:
openjdk-11
Description:
OpenJDK Development Kit (JDK)
Submitter:
Laurent Bigonville
Date:
2019-11-13 15:39:09 UTC
Severity:
important
#944666#5
Date:
2019-11-13 14:55:18 UTC
From:
To:
Hi,

Except if I'm severly mistaken, it seems that jconsole does not verify the
domain name nor check whether the CA is trusted when connecting to a JVM
that has SSL enabled for JMX.

This can lead to MITM and stealing of the credentials used to connect to
JMX.

Kind regards,

Laurent Bigonville
#944666#10
Date:
2019-11-13 15:36:29 UTC
From:
To:
On Wed, 13 Nov 2019 15:55:18 +0100 Laurent Bigonville <bigon@debian.org>  wrote:
 > Hi,
 >
 > Except if I'm severly mistaken, it seems that jconsole does not
verify the
 > domain name nor check whether the CA is trusted when connecting to a JVM
 > that has SSL enabled for JMX.
 >
 > This can lead to MITM and stealing of the credentials used to connect to
 > JMX.

Little correction here.

jconsole does verify that the CA is trusted. My confusion comes from
#767272 and the fact that ca-certificates-java is not cleaning the
removed certificates from the java trusted store.

But I can confirm that jconsole is not checking the CN/AltNames of the
certificate (if I'm using the IP instead of the DNS name the connection
is still happening without warnings)