<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Hi Michael,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Please share a working copy of the code to duplicate the failure scenario of NPE related to Connection.java. BTW, I checked the stack trace posted on April 28 it did not clearly show Connection::cleanup got
called. Was there something missed?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank you,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Weibing<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">security-dev <security-dev-retn@openjdk.org> on behalf of security-dev-request@openjdk.org <security-dev-request@openjdk.org><br>
<b>Date: </b>Tuesday, April 29, 2025 at 4:54</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black">AM<br>
<b>To: </b>security-dev@openjdk.org <security-dev@openjdk.org><br>
<b>Subject: </b>security-dev Digest, Vol 214, Issue 151<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">Send security-dev mailing list submissions to<br>
security-dev@openjdk.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
</span><a href="https://mail.openjdk.org/mailman/listinfo/security-dev"><span style="font-size:11.0pt">https://mail.openjdk.org/mailman/listinfo/security-dev</span></a><span style="font-size:11.0pt"><br>
or, via email, send a message with subject or body 'help' to<br>
security-dev-request@openjdk.org<br>
<br>
You can reach the person managing the list at<br>
security-dev-owner@openjdk.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of security-dev digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: RFR: 8350498: Remove two Camerfirma root CA certificates<br>
(Mark Powers)<br>
2. Re: RFR: 8354305: SHAKE128 and SHAKE256 MessageDigest<br>
algorithms [v3] (Valerie Peng)<br>
3. Re: [Bug] NPE thrown from SASL GSSAPI impl on Java 11+ when<br>
TLS is used with QOP auth-int against Active Directory<br>
(Osipov, Michael (IN IT IN))<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 29 Apr 2025 01:21:44 GMT<br>
From: Mark Powers <mpowers@openjdk.org><br>
To: <security-dev@openjdk.org><br>
Subject: Re: RFR: 8350498: Remove two Camerfirma root CA certificates<br>
Message-ID:<br>
<A9eAJBJDaHecIKxXaVFN1OYPI3klaPxL5AkWVbC39Eg=.23a9c6ce-9cf2-4d30-94e2-5bc9f9a2f688@github.com><br>
<br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On Tue, 22 Apr 2025 20:27:04 GMT, Rajan Halade <rhalade@openjdk.org> wrote:<br>
<br>
> The change is to remove two Camerfirma root certificates which are terminated and no longer in use. These two roots are removed from `cacerts` truststore. Distrust of these roots is also removed as these roots will no longer be trusted by JDK by default.<br>
> <br>
> The release-note is at [JDK-8355325](https://bugs.openjdk.org/browse/JDK-8355325)<br>
<br>
This looks good to me.<br>
<br>
-------------<br>
<br>
PR Comment: </span><a href="https://git.openjdk.org/jdk/pull/24800#issuecomment-2837171301"><span style="font-size:11.0pt">https://git.openjdk.org/jdk/pull/24800#issuecomment-2837171301</span></a><span style="font-size:11.0pt"><br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Tue, 29 Apr 2025 01:41:44 GMT<br>
From: Valerie Peng <valeriep@openjdk.org><br>
To: <security-dev@openjdk.org><br>
Subject: Re: RFR: 8354305: SHAKE128 and SHAKE256 MessageDigest<br>
algorithms [v3]<br>
Message-ID:<br>
<7tQk66i69YQpgGj4_thPeRH0Dvx3Z5ohyzefcsLL7wA=.b11500ea-08b1-4961-b65d-e68082b56d92@github.com><br>
<br>
Content-Type: text/plain; charset=utf-8<br>
<br>
On Mon, 28 Apr 2025 14:48:34 GMT, Weijun Wang <weijun@openjdk.org> wrote:<br>
<br>
>> Add 2 `MessageDigest` algorithms.<br>
><br>
> Weijun Wang has updated the pull request incrementally with one additional commit since the last revision:<br>
> <br>
> test alias usage<br>
<br>
Changes look fine. However, we should probably caution about these being different from the regular message digest algorithms, i.e. regarding their related output property.<br>
<br>
-------------<br>
<br>
Marked as reviewed by valeriep (Reviewer).<br>
<br>
PR Review: </span><a href="https://git.openjdk.org/jdk/pull/24576#pullrequestreview-2801570550"><span style="font-size:11.0pt">https://git.openjdk.org/jdk/pull/24576#pullrequestreview-2801570550</span></a><span style="font-size:11.0pt"><br>
<br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Tue, 29 Apr 2025 10:54:31 +0200<br>
From: "Osipov, Michael (IN IT IN)" <michael.osipov@innomotics.com><br>
To: security-dev@openjdk.org<br>
Cc: andrewlu@openjdk.org<br>
Subject: Re: [Bug] NPE thrown from SASL GSSAPI impl on Java 11+ when<br>
TLS is used with QOP auth-int against Active Directory<br>
Message-ID: <9baba8d6-066a-42cd-9649-e16033108ee7@siemens.com><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
On 2025-04-28 10:22, Osipov, Michael (IN IT IN) wrote:<br>
> Hi folks,<br>
> Hi Max,<br>
><br>
> please assess the following bug I have found in Java 11+, it does not <br>
exist<br>
> in Java 8. I have tried the following most versions on Azul Zulu/<br>
> OpenJDK: 8, 11, 17, 21, 24 on multiple platforms. Searched JBS as well,<br>
> nothing found.<br>
<br>
I was able to debug this and find the cause.<br>
It is a regression from <br>
</span><a href="https://github.com/openjdk/jdk11u/commit/bcac47f00ac6cf511ad7709fb9d39276ac27b049"><span style="font-size:11.0pt">https://github.com/openjdk/jdk11u/commit/bcac47f00ac6cf511ad7709fb9d39276ac27b049</span></a><span style="font-size:11.0pt">,
<br>
introduced with </span><a href="https://bugs.openjdk.org/browse/JDK-8313657"><span style="font-size:11.0pt">https://bugs.openjdk.org/browse/JDK-8313657</span></a><span style="font-size:11.0pt">.<br>
I can even reproduce this with the HPE JDK 8 for HP-UX, so I guess they <br>
have backported that broken fix.<br>
<br>
Connection#flushAndCloseOutputStream() closes the SaslOutputStream() <br>
which disposes the GSS security context and sets it to null. After that <br>
Connection#abandonRequest(LdapRequest, Control[]) is invoked which still <br>
uses the SaslOutputStream:<br>
> synchronized (this) {<br>
> outStream.write(ber.getBuf(), 0, ber.getDataLen());<br>
> outStream.flush();<br>
> }<br>
<br>
Andrew,<br>
<br>
can you log a bug here?<br>
<br>
Michael<br>
<br>
<br>
End of security-dev Digest, Vol 214, Issue 151<br>
**********************************************<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>