Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Apple Mac OS X Java 1.5 limits encryption key size

CVE-2008-4368 · published 18 years ago
Summary

On Mac OS X 10.5.4 and 10.5.5, the built‑in Java 1.5 configuration restricts cryptographic keys to 128 bits. Smaller keys are weaker and can be broken more easily, exposing encrypted data. Update the Java policy files or install a newer Java version that allows stronger keys to protect your information.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple mac_os_x 10.5.4
10.5.5
cpe:2.3:o:apple:mac_os_x:10.5.4:*:*:*:*:*:*:*
Original advisory text
The default configuration of Java 1.5 on Apple Mac OS X 10.5.4 and 10.5.5 contains a jurisdiction policy that limits Java Cryptography Extension (JCE) key sizes to 128 bits, which makes it easier f...
The default configuration of Java 1.5 on Apple Mac OS X 10.5.4 and 10.5.5 contains a jurisdiction policy that limits Java Cryptography Extension (JCE) key sizes to 128 bits, which makes it easier for attackers to decrypt ciphertext produced by JCE.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published1 Oct 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-4368 · NVD
Track software like this
Free during beta