CVE-2020-2767

CWE-3589 documents9 sources
Severity
4.8MEDIUM
EPSS
0.3%
top 44.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Netapp E-series Santricity OS ControllerNetapp StoragegridOracle Openjdk+6 more
Timeline
PublishedApr 15
Latest updateMay 24

Description

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and se…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.5

Affected Packages8 packages

▶CVEListV5oracle_corporation/javaJava SE: 11.0.6, 14
▶NVDoracle/openjdk11 — 11.0.6+4
▶NVDoracle/jdk11.0.6, 14.0.0+1
▶NVDoracle/jre11.0.6, 14.0.0+1
▶Debianopenjdk-11< 11.0.7+10-1

Also affects: Debian Linux 10.0, Ubuntu Linux 16.04, 18.04, 19.10

🔴Vulnerability Details

3
GHSA
GHSA-f294-2h7r-gx55: Vulnerability in the Java SE product of Oracle Java SE (component: JSSE)↗2022-05-24
▶
CVEList
CVE-2020-2767: Vulnerability in the Java SE product of Oracle Java SE (component: JSSE)↗2020-04-15
▶
OSV
CVE-2020-2767: Vulnerability in the Java SE product of Oracle Java SE (component: JSSE)↗2020-04-15
▶

📋Vendor Advisories

4
Ubuntu
OpenJDK vulnerabilities↗2020-04-22
▶
Oracle
Oracle Oracle Java SE Risk Matrix: JSSE — CVE-2020-2767↗2020-04-15
▶
Red Hat
OpenJDK: Incorrect handling of Certificate messages during TLS handshake (JSSE, 8232581)↗2020-04-14
▶
Debian
CVE-2020-2767: openjdk-11 - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Suppor...↗2020
▶

💬Community

1
Bugzilla
CVE-2020-2767 OpenJDK: Incorrect handling of Certificate messages during TLS handshake (JSSE, 8232581)↗2020-04-14
▶