Skip to main content
49 votes

Poor error handling source code review

I think you are correct that those issues are more related to code quality rather than security, and none of them are exploitable in any obvious way. I would not call them "vulnerabilities". But ...
Anders's user avatar
  • 65.7k
47 votes
Accepted

Am I protected from Log4j vulnerability if I run Java 8u121 or newer?

No, you really need to update log4j. Here is an excerpt from LunaSec's announcement: According to this blog post (see translation), JDK versions greater than 6u211, 7u201, 8u191, and 11.0.1 are not ...
Fire Quacker's user avatar
  • 2,432
34 votes

Sending password from client app to server with Java

Use TLS for the connection to the server. The purpose of securely hashing a password is to make it more difficult to attack if the database is ever stolen. It is not designed to prevent sniffing the ...
forest's user avatar
  • 67k
25 votes
Accepted

What are the differences of checking a self-signed certificate vs ignore it?

If it's an official service you are integrating with the provider should really have a valid, publicly signed certificate installed for the sake of security. Assuming that you need to continue on ...
Tim Brigham's user avatar
  • 3,792
24 votes
Accepted

How are code-branch side channel attacks mitigated on Java?

While you can make some attempt towards constant-time code in general purpose JITed languages like Java, you generally run into some problems: The runtime implementation is, generally, intended to be ...
Polynomial's user avatar
  • 135k
21 votes
Accepted

What is the purpose/role of the "alias" attribute in Java keystore files?

ALIAS To answer your immediate question, the alias field should be a unique string to identify the key entry. This applies to all types such a trusted and intermediate. Documentation Keytool ...
Shane Andrie's user avatar
  • 3,840
21 votes

Timing attacks in password hash comparisons

The first algorithm is sensitive to timing attacks, while the second looks better (but I don't know for sure if it's vulnerable or not). However, there is a bug with potential security implications in ...
Anders's user avatar
  • 65.7k
16 votes

What are the differences of checking a self-signed certificate vs ignore it?

By importing a known good self-signed certificate where the private key is unique and not compromised, the connection is just as safe as a full global CA PKI signed certificate. Those are after all ...
John Keates's user avatar
16 votes

Am I protected from Log4j vulnerability if I run Java 8u121 or newer?

https://research.kudelskisecurity.com/2021/12/10/log4shell-critical-severity-apache-log4j-remote-code-execution-being-actively-exploited-cve-2021-44228/ No, you're not safe. Currently we have to ...
jwenting's user avatar
  • 337
14 votes
Accepted

ECDSA: Why do ssh-keygen and Java generated public keys have different sizes?

Sizes are different because the formats are different. The strings you show are both binary values encoded in Base64. In all this message I talk about the binary values, i.e. I suppose that you first ...
Thomas Pornin's user avatar
14 votes
Accepted

Why do I need to add intermediate CA certificates to JVM's cacerts file?

The problem you describe happens usually if the server only sends its leaf certificate and does not add all the chain certificates needed to build the trust chain to the root CA. Unfortunately this is ...
Steffen Ullrich's user avatar
12 votes

Preventing Server-Side Request Forgeries in Java

This is the code I'm currently using: if(!url.getProtocol().startsWith("http")) throw new Exception(); InetAddress inetAddress = InetAddress.getByName(url.getHost()); if(inetAddress....
paj28's user avatar
  • 33.8k
11 votes

Why do I need to add intermediate CA certificates to JVM's cacerts file?

The Oracle JRE can automatically download the intermediate certificate: Support for the Authority Information Access (AIA) Extension Support for the caIssuers access method of the Authority ...
MarnixKlooster ReinstateMonica's user avatar
11 votes

Poor error handling source code review

How are these related to security? According to my understanding it seems like the above issues are code quality issues. These are code quality issues. From the name, it looks like they are ...
hax's user avatar
  • 3,941
11 votes

Timing attacks in password hash comparisons

You're both right, but you've both missed the point :) You are correct: this is a classic example of a timing weakness and creates a possible side channel attack. Your coder is correct: given network ...
Conor Mancone's user avatar
10 votes
Accepted

Does Oracle's GuardedString protect sensitive data against heap or memory dumps?

Some deeper look into the actual implementation will help an attacker understand the data structure of a memory dump, and from what I found in EncryptorImpl there has been put no effort into ...
Anton Kaiser's user avatar
10 votes

What is the best practice to store private key, salt and initialization vector in database?

I will answer your question in two parts since you asked it in two parts: Question 1: Is it secure to store salt and vector in database same table with private key? Currently I encode public and ...
dFrancisco's user avatar
  • 2,761
9 votes

Java UUID.randomUUID() or SecureRandom for id segment on URL?

In terms of the raw amount of random bits, yes. Looking at the source for Java's random UUID generation, you can see they actually utilize the SecureRandom class to generate the raw bytes. So, the '...
childofsoong's user avatar
9 votes

Java UUID.randomUUID() or SecureRandom for id segment on URL?

Well, in principle, UUIDs and cryptographic RNGs promise two different things: UUIDs promise low probability of duplicates; Cryptographic RNGs promise unpredictability to a malicious adversary. If #...
Luis Casillas's user avatar
8 votes
Accepted

Is it possible to exploit this Zookeeper instance?

First of all, I'm also not familiar with Zookeeper at all but I could give you some general advice from a security perspective. The Zookeeper commands you listed sounds like administrative functions, ...
Bob Ortiz's user avatar
  • 6,705
8 votes
Accepted

How can I safely store a password in a .class file?

You cannot. If the application has to know the password, there is no way to store it safely, unless you ask a user at run time for a master password. Because if the app can get it, an attacker could ...
Serge Ballesta's user avatar
8 votes
Accepted

Vulnerable CRLF environment

PHP - 4.2.1 - CVE - Or see the Anders answer. TOMCAT - Before 6.0.37 / 7.0.30 - CVE Since CRLF Injection is directly related to HTTP response splitting attacks, I recommend you to read the question I ...
Baptiste's user avatar
  • 1,703
8 votes
Accepted

Does Java anti-decompiler software really work as claimed?

No, these do not work in the way claimed. They do not and cannot prevent reverse engineering and decompiling. The most they can possibly do is obfuscate Java to make it more difficult to understand, ...
forest's user avatar
  • 67k
8 votes

Generating and securing gift card codes

To prevent fraud, you need a sufficiently low probability of the attacker guessing any valid code. For 1 million cards, a 10^16 code will be guessed on the average each 10^10 attempts. If your site is ...
Therac's user avatar
  • 2,680
8 votes

Timing attacks in password hash comparisons

The second piece of code you showed is still susceptible to timing attacks. This is because how many times the if-branch is taken, and in what sequence it is taken, are dependent on the input data. ...
Nayuki's user avatar
  • 263
7 votes

SSL Newbie : Does HTTPS client also need a certificate?

No. I've tried it and the client definitely does not need a certificate or predefined key. Rather, after receiving a public key (which is part of the certificate) from the server, the client makes up ...
Matt's user avatar
  • 71
7 votes

Generating a secure AES key?

No What you're doing, is asking the user to enter a 16-character string or, in other words, a password. It's true that 16 bytes can fit 128 bits, but that only holds for data where all possible byte ...
ilkkachu's user avatar
  • 2,185
7 votes
Accepted

Attackers using Minecraft's Java?

The bad press Java got in the past years which might lead you to the preconception that the whole technology is a "horrendous piece of malware-magnet" applied mostly to the Java browser plugin. This ...
Philipp's user avatar
  • 49.4k
7 votes
Accepted

What is the process of finding deep links from an Android application?

A deep link is similar to opening a URL with an application in other operating systems. You can run firefox https://example.com to open that URL in your browser, and applications can tell the ...
Luc's user avatar
  • 33k
6 votes
Accepted

Question about AES-CBC IVs

The IV is a random non-secret value. Its sole purpose is to prevent two similar blocks from yielding the same ciphertext as it could give information away about the structure of the plain text. In ...
Lucas Kauffman's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible