REDHAT-BUG-2503636: Medium severity OpenJDK OpenJDK vulnerability

OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so NameConstraintsExtension.verify does not reject the chain when secret.foo.com is an exact-host exclusion. Later, HostnameChecker interprets the same SAN as a wildcard template and accepts secret.foo.com for .foo.com.