CVE-2020-2604 — Deserialization of Untrusted Data in Oracle Openjdk

CWE-502 — Deserialization of Untrusted DataCWE-471 — Modification of Assumed-Immutable Data10 documents9 sources
Severity
8.1HIGHNVD
EPSS
1.7%
top 17.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Netapp E-series Santricity OS ControllerOracle OpenjdkOracle Corporation Java+17 more
Timeline
PublishedJan 15
Latest updateMay 24

Description

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deplo…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages14 packages

▶CVEListV5oracle_corporation/javaJava SE Embedded: 8u231, Java SE: 7u241, 8u231, 11.0.5, 13.0.1+1
▶NVDoracle/openjdk11 — 11.0.5+3
▶NVDoracle/jdk4 versions+3
▶NVDoracle/jre1.8.0
▶NVDoracle/graalvm19.3.0.2

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 16.04, 18.04, 19.10, Enterprise Linux 8.0, 7.7, 8.1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-c9rv-f9qq-jjvf: Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java)↗2022-05-24
▶
CVEList
CVE-2020-2604: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)↗2020-01-15
▶
OSV
CVE-2020-2604: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization)↗2020-01-15
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Java SE) — CVE-2020-2604↗2021-07-15
▶
Ubuntu
OpenJDK vulnerabilities↗2020-01-28
▶
Oracle
Oracle Oracle GraalVM Risk Matrix: Java — CVE-2020-2604↗2020-01-15
▶
Red Hat
OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)↗2020-01-14
▶
Debian
CVE-2020-2604: openjdk-11 - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (compon...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-2604 OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)↗2020-01-14
▶
CVE-2020-2604 — Deserialization of Untrusted Data | cvebase