Check Point Response to CVE-2022-21449 Java "Psychic Signatures"

Solution

On April 20, 2022, security researcher Neil Madden published a blog post in which he provided details about a newly disclosed vulnerability in Java, CVE-2022-21449 or “Psychic Signatures”. This security vulnerability originates in an incorrect implementation of the ECDSA signature verification algorithm, introduced in Java 15.

The Check Point Infinity architecture is protected against this threat. We verified that this vulnerability does not affect our Infinity portfolio (including Quantum Security Gateways, Smart Management, Quantum Spark appliances with Gaia Embedded OS, Harmony Endpoint, Harmony Mobile, ThreatCloud, and CloudGuard).

Check Point Products Status

Notes:

• All Check Point software versions, including out of support versions, are not vulnerable.
• All Check Point appliances are not vulnerable.