3 ms·
You may not have encountered any bugs but what about the vulnerabilities they’re fixing - do you not care to have those fixes?
by jarym 9y ago
You may not have encountered any bugs but what about the vulnerabilities they’re fixing - do you not care to have those fixes?
- vbezhenar 9y agoCan you provide examples of those vulnerabilities? All vulnerabilities I'm aware of are from Java applet technology and not applicable to server applications. The only vulnerability that I can remember is something about parsing float, but even that was very low risk.
- slrz 9y agoAll those TLS/SSL implementation vulnerabilities with fancy names like POODLE, for example. https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html https://www.oracle.com/technetwork/topics/security/poodlecve... There's a lot more but it of course depends on the subset of the JDK that you're using. Look over the release notes for historical JDK updates.
- vbezhenar 9y agoI don't use TLS and even if I would use it, I would use nginx frontend. My subset is fairy common, Spring+JDBC, sometimes Hibernate, sometimes pure servlets, but basically all interaction between outer world is via HTTP interface implemented in Tomcat.
- toyg 9y agoA targeted attack would probably hole you fairly easily then. Cleartext means you’re likely open to all sorts of replay attacks and data leaks, which can then be escalated to exploit vulnerable libs and jvm.