Unknown SecurityExcetion from java webstart app

Question

We saw this exception from 3 different customer installs today (4/14/2015) in the span of a 30 minutes.

java.lang.SecurityException: Can not verify security pack jar
com.sun.deploy.util.SecurityBaseline.verifyJar(Unknown Source)
com.sun.deploy.util.SecurityBaseline.access$200(Unknown Source)
com.sun.deploy.util.SecurityBaseline$1.run(Unknown Source)
java.lang.Thread.run(Unknown Source)

I don't think it's causing a problem as it's in a background thread started from deploy.jar (SecurityBaseline.java) trying to verify something?? The odd thing is that it happened at multiple customers at the same time. The only reason I know about it is that we install an default uncaught exception handler to log and report any unhandled exceptions in the app.

Has anyone else seen this or know what it means? I tried reading a decompiled version of the source, and it wasn't clear exactly where the failure would be. I got the line of the exception, but it could come from 2 different paths, both of which were very non trivial to an outsider.

I'm inclined to ignore it for now, but I'm worried it is foreshadowing a larger problem.

Answer 1

I'm 100% sure that it's caused by https://bugs.openjdk.java.net/browse/JDK-8077736

If anyone has an account there please make a comment or if you know/can contact maintainers mentioned in the ticket any other way please do.

Answer 2

This bug has been fixed. javadl-esd-secure.oracle.com/update/securitypack.jar has been updated.

To resolve this issue on systems that are experiencing this problem, simply reinstall 8u45. As the securitypack.jar has been updated, any new installations will not see this issue.