<html><head>
<style type="text/css"><!----></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: Helvetica; font-size: 9pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
a.em-mention[href] { text-decoration: none; color: inherit; border-radius: 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; }
._em_placeholder {color: gray; border-bottom: 1px dotted lightblue;} ._em_placeholder:before{color:gray; content: '{{ ';} ._em_placeholder:after{color:gray; content: ' }}';}
--></style>
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div>Should this be written up at <a href="https://bugreport.java.com/bugreport/" class="__cef_visited" style="font-size: 9pt;">https://bugreport.java.com/bugreport/</a> , or does it deserve special treatment as a security vulnerability (and if so, what is that protocol)?</div><div><br /></div><div>I was unable to review the document without an ibm account, so I can’t comment further on the problem or any potential resolution(s).</div><div><br /></div><div>Sruthy: if you are an Oracle customer or partner there may be other <a href="https://www.oracle.com/corporate/security-practices/assurance/vulnerability/reporting.html" style="font-size: 9pt;">faster channels</a> to discuss this.</div><div><br /></div><div>Regards,</div><div> - Jeremy</div><div><br /></div>
<div x-em-replyforwardheader=""><br /></div>
<div>
<div>------ Original Message ------</div>
<div>From "Sruthy Jayan" <<a href="mailto:srutjay1@in.ibm.com">srutjay1@in.ibm.com</a>></div>
<div>To "client-libs-dev@openjdk.org" <<a href="mailto:client-libs-dev@openjdk.org">client-libs-dev@openjdk.org</a>></div>
<div>Cc "Swathi Kalahastri" <<a href="mailto:swkalaha@in.ibm.com">swkalaha@in.ibm.com</a>>; "Syed Moinudeen" <<a href="mailto:smoinud1@in.ibm.com">smoinud1@in.ibm.com</a>></div>
<div>Date 6/4/2025 1:42:01 AM</div>
<div>Subject Security Concern: JPasswordField Revealing Passwords in Memory</div></div><div x-em-quote=""><br /></div>
<div id="x891a4e41ba714fd"><blockquote cite="BY3PR15MB5012A9305FEB6BAF247A43B7B96CA@BY3PR15MB5012.namprd15.prod.outlook.com" type="cite" class="cite2">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Team ,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br />
</div>
<div class="elementToProof" style="line-height: 1.38; margin: 1em 0cm; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We are encountering a potential security issue with <code>JPasswordField</code> in the latest version of OpenJDK. While the issue is not present in OpenJ9 version 0.40.0, it becomes reproducible in version 0.41.0. Specifically, after typing or pasting a password
into the field, memory inspection tools can reveal the password in plain text—even
<b>before</b> the password is submitted or any action is triggered.</div>
<div class="elementToProof" style="margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This behaviour is reproducible and raises concerns about sensitive data being exposed unintentionally.</div>
<div class="elementToProof" style="margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We have attached a detailed document ( <span class="_Entity _EType_OWALink _EId_OWALink_1 _EReadonly_1" style="display: inline-block;">
<span><span><a href="https://ibm-my.sharepoint.com/:w:/p/srutjay1_in/ETwf5z9omRlAoetv7snbnFcBrHxJwGXJpeDcvSv7Svp7Rw" id="OLK_Beautified_647b5063-9398-1bb6-a303-f68ad2682279" class="OWAAutoLink eScj0 none __cef_visited" style="padding: 0px 1px; border-radius: 2px; user-select: all; background-color: rgb(243, 242, 241);" data-ogsc="" data-loopstyle="linkonly"><img class="suRDx" alt="" role="presentation" style="width: 16px; height: 16px; vertical-align: middle; padding: 1px 2px 2px 0px;" src="https://res.public.onecdn.static.microsoft/assets/mail/file-icon/png/docx_16x16.png" />ClearPasswordInMemoryIssue
1.docx
</a></span></span></span>) outlining the issue, steps to reproduce, and our observations.</div>
<div class="elementToProof" style="margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Could someone from the community assist us in investigating or addressing this issue? Please let us know if any additional information is needed.</div>
<div class="elementToProof" style="margin-top: 1em; margin-bottom: 1em; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thank you for your time and support.</div>
<div class="elementToProof" style="line-height: 1.38; margin: 0cm 0cm 8pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Best Regards,</div>
<div class="elementToProof" style="line-height: 1.38; margin: 0cm 0cm 8pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Sruthy Jayan</div>
</blockquote></div>
</body></html>