Vulnerability has been reported in Sun Java System and Sun ONE Application Server. The cause is being attributed to an error in OpenSSL which could be targeted by hackers for forging signatures without requiring any secret key.

The following products have been affected:

Sun Java System proxy Server 3.6
Sun Java System Web Server 6.0
Sun Java System Web Server 6.1
Sun ONE Application Server 7
Sun Java System Application Server 7 2004Q2
Sun Java System Application Server Platform Edition 8.1 2005 Q1
Sun Java System Application Server Enterprise Edition 8.1 2005 Q1

Avoid using RSA keys with an exponent of three. OpenSSL 0.9.7 branch users must upgrade to 0.9.7k version or later and OpenSSL 0.9.8 branch users must upgrade to 0.9.8c or later. Up till now there is no report of an official patch.