CVE-2020-2654

Severity

37%

Complexity

22%

Confidentiality

23%

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 3.1 Base Score 3.7. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:N/A:P).

Overview

First reported 5 years ago

2020-01-15 17:15:00

Last updated 4 years ago

2020-05-13 08:15:00

Affected Software

Oracle JDK 1.7.0 Update 241

1.7.0

Oracle JDK 1.8.0 Update 231

1.8.0

Oracle JDK 11.0.5

11.0.5

Oracle JDK 13.0.1

13.0.1

Red Hat Enterprise Linux 6.0

6.0

Red Hat Enterprise Linux (RHEL) 7.0 (7)

7.0

Red Hat Enterprise Linux 8.0

8.0

Oracle OpenJDK 7

7

Oracle OpenJDK 7 Update 241

7

Oracle OpenJDK 7 Update 80

7

Oracle OpenJDK 7 Update 85

7

Oracle OpenJDK 8

8

Oracle OpenJDK 8 Update 102

8

Oracle OpenJDK 8 Update 112

8

Oracle OpenJDK 8 Update 152

8

Oracle OpenJDK 8 Update 162

8

Oracle OpenJDK 8 Update 172

8

Oracle OpenJDK 8 Update 192

8

Oracle OpenJDK 8 Update 20

8

Oracle OpenJDK 8 Update 202

8

Oracle OpenJDK 8 Update 212

8

Oracle OpenJDK 8 Update 222

8

Oracle OpenJDK 8 Update 232

8

Oracle OpenJDK 8 Update 40

8

Oracle OpenJDK 8 Update 60

8

Oracle OpenJDK 8 Update 66

8

Oracle OpenJDK 8 Update 72

8

Oracle OpenJDK 8 Update 92

8

Oracle OpenJDK 11

11

Oracle OpenJDK 11.0.1

11.0.1

Oracle OpenJDK 11.0.2

11.0.2

Oracle OpenJDK 11.0.3

11.0.3

Oracle OpenJDK 11.0.4

11.0.4

Oracle OpenJDK 11.0.5

11.0.5

Oracle OpenJDK 13

13

Oracle OpenJDK 13.0.1

13.0.1

Debian Linux 8.0 (Jessie)

8.0

Debian Linux 9.0

9.0

Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)

16.04

Canonical Ubuntu Linux 18.04 LTS Edition

18.04

Canonical Ubuntu Linux 19.10

19.10

Oracle JRE 11.0.5

11.0.5

Oracle JRE 13.0.1

13.0.1

References

openSUSE-SU-2020:0113

Mailing List, Third Party Advisory

openSUSE-SU-2020:0147

Mailing List, Third Party Advisory

RHSA-2020:0122

Third Party Advisory

RHSA-2020:0128

Third Party Advisory

RHSA-2020:0157

Third Party Advisory

RHSA-2020:0196

Third Party Advisory

RHSA-2020:0202

Third Party Advisory

RHSA-2020:0231

Third Party Advisory

RHSA-2020:0232

Third Party Advisory

RHSA-2020:0541

Third Party Advisory

RHSA-2020:0632

Third Party Advisory

[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update

Third Party Advisory

20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update

Mailing List, Third Party Advisory

20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update

Mailing List, Third Party Advisory

https://security.netapp.com/advisory/ntap-20200122-0003/

Third Party Advisory

USN-4257-1

Third Party Advisory

DSA-4605

Third Party Advisory

DSA-4621

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Patch, Vendor Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10315

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.