CVE-2020-2655 - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that ar

CVE-2020-2655

Summary

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

References

Vulnerable Configurations

cpe:2.3:a:oracle:jdk:11.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:11.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:13.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:13.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:13.0.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:13.0.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 28-01-2020 - 13:15)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

redhat via4

advisories

bugzilla

id	1791217
title	CVE-2020-2654 OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND

comment java-11-openjdk is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122001
comment java-11-openjdk is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521002

AND

comment java-11-openjdk-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122003
comment java-11-openjdk-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521004

AND

comment java-11-openjdk-demo is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122005
comment java-11-openjdk-demo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521006

AND

comment java-11-openjdk-demo-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122007
comment java-11-openjdk-demo-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521008

AND

comment java-11-openjdk-devel is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122009
comment java-11-openjdk-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521010

AND

comment java-11-openjdk-devel-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122011
comment java-11-openjdk-devel-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521012

AND

comment java-11-openjdk-headless is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122013
comment java-11-openjdk-headless is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521014

AND

comment java-11-openjdk-headless-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122015
comment java-11-openjdk-headless-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521016

AND

comment java-11-openjdk-javadoc is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122017
comment java-11-openjdk-javadoc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521018

AND

comment java-11-openjdk-javadoc-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122019
comment java-11-openjdk-javadoc-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521020

AND

comment java-11-openjdk-javadoc-zip is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122021
comment java-11-openjdk-javadoc-zip is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521022

AND

comment java-11-openjdk-javadoc-zip-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122023
comment java-11-openjdk-javadoc-zip-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521024

AND

comment java-11-openjdk-jmods is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122025
comment java-11-openjdk-jmods is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521026

AND

comment java-11-openjdk-jmods-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122027
comment java-11-openjdk-jmods-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521028

AND

comment java-11-openjdk-src is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122029
comment java-11-openjdk-src is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521030

AND

comment java-11-openjdk-src-debug is earlier than 1:11.0.6.10-1.el7_7
oval oval:com.redhat.rhsa:tst:20200122031
comment java-11-openjdk-src-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521032

rhsa

id	RHSA-2020:0122
released	2020-01-16
severity	Important
title	RHSA-2020:0122: java-11-openjdk security update (Important)

bugzilla

id	1791217
title	CVE-2020-2654 OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 8 is installed
oval oval:com.redhat.rhba:tst:20193384074

AND

comment java-11-openjdk is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128001
comment java-11-openjdk is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521002

AND

comment java-11-openjdk-debugsource is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128003
comment java-11-openjdk-debugsource is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20191518004

AND

comment java-11-openjdk-demo is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128005
comment java-11-openjdk-demo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521006

AND

comment java-11-openjdk-devel is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128007
comment java-11-openjdk-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521010

AND

comment java-11-openjdk-headless is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128009
comment java-11-openjdk-headless is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521014

AND

comment java-11-openjdk-javadoc is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128011
comment java-11-openjdk-javadoc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521018

AND

comment java-11-openjdk-javadoc-zip is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128013
comment java-11-openjdk-javadoc-zip is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521022

AND

comment java-11-openjdk-jmods is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128015
comment java-11-openjdk-jmods is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521026

AND

comment java-11-openjdk-src is earlier than 1:11.0.6.10-0.el8_1
oval oval:com.redhat.rhsa:tst:20200128017
comment java-11-openjdk-src is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20183521030

rhsa

id	RHSA-2020:0128
released	2020-01-16
severity	Important
title	RHSA-2020:0128: java-11-openjdk security update (Important)

rhsa
id RHSA-2020:0232

rpms

java-11-openjdk-1:11.0.6.10-1.el7_7
java-11-openjdk-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-debuginfo-1:11.0.6.10-1.el7_7
java-11-openjdk-demo-1:11.0.6.10-1.el7_7
java-11-openjdk-demo-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-devel-1:11.0.6.10-1.el7_7
java-11-openjdk-devel-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-headless-1:11.0.6.10-1.el7_7
java-11-openjdk-headless-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-javadoc-1:11.0.6.10-1.el7_7
java-11-openjdk-javadoc-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-javadoc-zip-1:11.0.6.10-1.el7_7
java-11-openjdk-javadoc-zip-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-jmods-1:11.0.6.10-1.el7_7
java-11-openjdk-jmods-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-src-1:11.0.6.10-1.el7_7
java-11-openjdk-src-debug-1:11.0.6.10-1.el7_7
java-11-openjdk-1:11.0.6.10-0.el8_1
java-11-openjdk-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-debugsource-1:11.0.6.10-0.el8_1
java-11-openjdk-demo-1:11.0.6.10-0.el8_1
java-11-openjdk-devel-1:11.0.6.10-0.el8_1
java-11-openjdk-devel-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-devel-slowdebug-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-headless-1:11.0.6.10-0.el8_1
java-11-openjdk-headless-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-headless-slowdebug-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-javadoc-1:11.0.6.10-0.el8_1
java-11-openjdk-javadoc-zip-1:11.0.6.10-0.el8_1
java-11-openjdk-jmods-1:11.0.6.10-0.el8_1
java-11-openjdk-slowdebug-debuginfo-1:11.0.6.10-0.el8_1
java-11-openjdk-src-1:11.0.6.10-0.el8_1
java-11-openjdk-1:11.0.6.10-0.el8_0
java-11-openjdk-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-debugsource-1:11.0.6.10-0.el8_0
java-11-openjdk-demo-1:11.0.6.10-0.el8_0
java-11-openjdk-devel-1:11.0.6.10-0.el8_0
java-11-openjdk-devel-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-devel-slowdebug-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-headless-1:11.0.6.10-0.el8_0
java-11-openjdk-headless-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-headless-slowdebug-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-javadoc-1:11.0.6.10-0.el8_0
java-11-openjdk-javadoc-zip-1:11.0.6.10-0.el8_0
java-11-openjdk-jmods-1:11.0.6.10-0.el8_0
java-11-openjdk-slowdebug-debuginfo-1:11.0.6.10-0.el8_0
java-11-openjdk-src-1:11.0.6.10-0.el8_0

refmap via4

bugtraq	20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update
confirm	https://security.netapp.com/advisory/ntap-20200122-0003/
debian	DSA-4605
misc	https://www.oracle.com/security-alerts/cpujan2020.html
suse	openSUSE-SU-2020:0113
ubuntu	USN-4257-1

Last major update

28-01-2020 - 13:15

Published

15-01-2020 - 17:15

Last modified

28-01-2020 - 13:15