HttpURLConnection cache issues leading to crashes in JGSS w/ native GSS introduced by 8303809
Nico Williams
Nico.Williams at twosigma.com
Fri Oct 20 02:39:06 UTC 2023
Also, a colleague informs me that 17.0.5 (as packaged by Debian) w/o `-Djdk.spnego.cache=false` doesn't exhibit the double-free/use-after-free crashes (as expected), but:
> I do see some "Authentication failure" / and "java.lang.NullPointerException: Cannot invoke "sun.net.www.protocol.http.Negotiator.nextToken(byte[])" because "this.negotiator" is null".
That seems to support the idea that the `AuthCache` is harmful.
Nico
--
More information about the security-dev
mailing list