Vulnerabilites related to oracle - openjdk
CVE-2020-2590 (GCVE-0-2020-2590)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 16:30
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4605vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Jan/24mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://kc.mcafee.com/corporate/index?page=content&id=SB10315x_refsource_CONFIRM
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.836Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "DSA-4605",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4605"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/24"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2590",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:04:44.827068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:30:10.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:15",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "DSA-4605",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4605"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/24"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2590",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "DSA-4605",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4605"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/24"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2590",
    "datePublished": "2020-01-15T16:34:02",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T16:30:10.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21248 (GCVE-0-2022-21248)
Vulnerability from cvelistv5
Published
2022-01-19 11:22
Modified
2024-09-24 20:32
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPIWQ6DL5IPOT54UBWTISG5T24FQJ7MN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4J2N4FNXW6JKJBWUZH6SNI2UHCZXQXCY/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:31:59.380Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "FEDORA-2022-b706eef225",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPIWQ6DL5IPOT54UBWTISG5T24FQJ7MN/"
          },
          {
            "name": "FEDORA-2022-416be040a8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4J2N4FNXW6JKJBWUZH6SNI2UHCZXQXCY/"
          },
          {
            "name": "FEDORA-2022-477401b0f7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21248",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:45:14.155785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T20:32:08.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:56.641Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "FEDORA-2022-b706eef225",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPIWQ6DL5IPOT54UBWTISG5T24FQJ7MN/"
        },
        {
          "name": "FEDORA-2022-416be040a8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4J2N4FNXW6JKJBWUZH6SNI2UHCZXQXCY/"
        },
        {
          "name": "FEDORA-2022-477401b0f7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21248",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "FEDORA-2022-b706eef225",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPIWQ6DL5IPOT54UBWTISG5T24FQJ7MN/"
            },
            {
              "name": "FEDORA-2022-416be040a8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4J2N4FNXW6JKJBWUZH6SNI2UHCZXQXCY/"
            },
            {
              "name": "FEDORA-2022-477401b0f7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21248",
    "datePublished": "2022-01-19T11:22:01",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-09-24T20:32:08.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35559 (GCVE-0-2021-35559)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-04 00:40
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7u311"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8u301"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:11:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7u311"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8u301"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:11.0.12:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7u311"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8u301"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:11.0.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_20.3.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_21.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_20.3.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_20.3.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_21.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "oracle_graalvm_enterprise_edition_21.2.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35559",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-25T16:02:35.502056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-25T16:55:17.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.850Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:13.492147",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35559",
    "datePublished": "2021-10-20T10:50:07",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:46.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2803 (GCVE-0-2020-2803)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 14:48
Severity ?
8.3 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.732Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:41:31.754667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T14:48:44.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:36",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2803",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "8.3",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2803",
    "datePublished": "2020-04-15T13:29:47",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T14:48:44.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2805 (GCVE-0-2020-2805)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 14:47
Severity ?
8.3 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2805",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:41:30.438557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T14:47:34.000Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:44",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2805",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "8.3",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2805",
    "datePublished": "2020-04-15T13:29:47",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T14:47:34.000Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35556 (GCVE-0-2021-35556)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-04 00:40
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.103Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:17.736085",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35556",
    "datePublished": "2021-10-20T10:50:04",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:47.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21349 (GCVE-0-2022-21349)
Vulnerability from cvelistv5
Published
2022-01-19 11:25
Modified
2024-09-24 20:20
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.977Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-24T17:35:33.447848Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-24T20:20:19.898Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:07:17",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21349",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21349",
    "datePublished": "2022-01-19T11:25:16",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-09-24T20:20:19.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21540 (GCVE-0-2022-21540)
Vulnerability from cvelistv5
Published
2022-07-19 00:00
Modified
2024-08-03 02:46
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.debian.org/security/2022/dsa-5188vendor-advisory
https://www.debian.org/security/2022/dsa-5192vendor-advisory
https://security.netapp.com/advisory/ntap-20220729-0009/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/vendor-advisory
https://security.gentoo.org/glsa/202401-25vendor-advisory
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u343
Version: Oracle Java SE:8u333
Version: Oracle Java SE:11.0.15.1
Version: Oracle Java SE:17.0.3.1
Version: Oracle Java SE:18.0.1.1
Version: Oracle GraalVM Enterprise Edition:20.3.6
Version: Oracle GraalVM Enterprise Edition:21.3.2
Version: Oracle GraalVM Enterprise Edition:22.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "DSA-5188",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5188"
          },
          {
            "name": "DSA-5192",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5192"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
          },
          {
            "name": "FEDORA-2022-19b6f21746",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
          },
          {
            "name": "FEDORA-2022-ae563934f7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
          },
          {
            "name": "FEDORA-2022-e573851f56",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
          },
          {
            "name": "FEDORA-2022-d26586b419",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
          },
          {
            "name": "FEDORA-2022-80afe2304a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
          },
          {
            "name": "FEDORA-2022-b76ab52e73",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
          },
          {
            "name": "GLSA-202401-25",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-25"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u343"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u333"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.15.1"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.3.1"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:18.0.1.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.6"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-17T15:06:26.613438",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "name": "DSA-5188",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5188"
        },
        {
          "name": "DSA-5192",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5192"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
        },
        {
          "name": "FEDORA-2022-19b6f21746",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
        },
        {
          "name": "FEDORA-2022-ae563934f7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
        },
        {
          "name": "FEDORA-2022-e573851f56",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
        },
        {
          "name": "FEDORA-2022-d26586b419",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
        },
        {
          "name": "FEDORA-2022-80afe2304a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
        },
        {
          "name": "FEDORA-2022-b76ab52e73",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
        },
        {
          "name": "GLSA-202401-25",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-25"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21540",
    "datePublished": "2022-07-19T00:00:00",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:46:39.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1876 (GCVE-0-2014-1876)
Vulnerability from cvelistv5
Published
2014-02-10 23:00
Modified
2024-08-06 09:58
Severity ?
CWE
  • n/a
Summary
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
References
http://www.ubuntu.com/usn/USN-2187-1vendor-advisory, x_refsource_UBUNTU
http://rhn.redhat.com/errata/RHSA-2014-0675.htmlvendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2014:0414vendor-advisory, x_refsource_REDHAT
http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x_refsource_GENTOO
http://www.ubuntu.com/usn/USN-2191-1vendor-advisory, x_refsource_UBUNTU
http://marc.info/?l=bugtraq&m=140852886808946&w=2vendor-advisory, x_refsource_HP
http://www-01.ibm.com/support/docview.wss?uid=swg21672080x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2014:0413vendor-advisory, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1060907x_refsource_MISC
http://secunia.com/advisories/59058third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=bugtraq&m=140852886808946&w=2vendor-advisory, x_refsource_HP
http://marc.info/?l=bugtraq&m=140852974709252&w=2vendor-advisory, x_refsource_HP
http://rhn.redhat.com/errata/RHSA-2014-0685.htmlvendor-advisory, x_refsource_REDHAT
http://www.debian.org/security/2014/dsa-2912vendor-advisory, x_refsource_DEBIAN
http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlx_refsource_CONFIRM
http://secunia.com/advisories/58415third-party-advisory, x_refsource_SECUNIA
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562x_refsource_MISC
http://marc.info/?l=bugtraq&m=140852974709252&w=2vendor-advisory, x_refsource_HP
http://seclists.org/oss-sec/2014/q1/285mailing-list, x_refsource_MLIST
http://www-01.ibm.com/support/docview.wss?uid=swg21676746x_refsource_CONFIRM
http://seclists.org/oss-sec/2014/q1/242mailing-list, x_refsource_MLIST
http://www-01.ibm.com/support/docview.wss?uid=swg21679713x_refsource_CONFIRM
http://www.securityfocus.com/bid/65568vdb-entry, x_refsource_BID
http://osvdb.org/102808vdb-entry, x_refsource_OSVDB
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:58:15.835Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-2187-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2187-1"
          },
          {
            "name": "RHSA-2014:0675",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0675.html"
          },
          {
            "name": "RHSA-2014:0414",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2014:0414"
          },
          {
            "name": "GLSA-201406-32",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
          },
          {
            "name": "USN-2191-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2191-1"
          },
          {
            "name": "HPSBUX03091",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672080"
          },
          {
            "name": "RHSA-2014:0413",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2014:0413"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1060907"
          },
          {
            "name": "59058",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/59058"
          },
          {
            "name": "SSRT101667",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
          },
          {
            "name": "HPSBUX03092",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
          },
          {
            "name": "RHSA-2014:0685",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-0685.html"
          },
          {
            "name": "DSA-2912",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-2912"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html"
          },
          {
            "name": "58415",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/58415"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562"
          },
          {
            "name": "SSRT101668",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
          },
          {
            "name": "[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2014/q1/285"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676746"
          },
          {
            "name": "[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2014/q1/242"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21679713"
          },
          {
            "name": "65568",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/65568"
          },
          {
            "name": "102808",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/102808"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-02-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-2187-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2187-1"
        },
        {
          "name": "RHSA-2014:0675",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0675.html"
        },
        {
          "name": "RHSA-2014:0414",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2014:0414"
        },
        {
          "name": "GLSA-201406-32",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
        },
        {
          "name": "USN-2191-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2191-1"
        },
        {
          "name": "HPSBUX03091",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672080"
        },
        {
          "name": "RHSA-2014:0413",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2014:0413"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1060907"
        },
        {
          "name": "59058",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/59058"
        },
        {
          "name": "SSRT101667",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
        },
        {
          "name": "HPSBUX03092",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
        },
        {
          "name": "RHSA-2014:0685",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-0685.html"
        },
        {
          "name": "DSA-2912",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-2912"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html"
        },
        {
          "name": "58415",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/58415"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562"
        },
        {
          "name": "SSRT101668",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
        },
        {
          "name": "[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2014/q1/285"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676746"
        },
        {
          "name": "[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2014/q1/242"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21679713"
        },
        {
          "name": "65568",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/65568"
        },
        {
          "name": "102808",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/102808"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-1876",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-2187-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2187-1"
            },
            {
              "name": "RHSA-2014:0675",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0675.html"
            },
            {
              "name": "RHSA-2014:0414",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2014:0414"
            },
            {
              "name": "GLSA-201406-32",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
            },
            {
              "name": "USN-2191-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2191-1"
            },
            {
              "name": "HPSBUX03091",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21672080",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21672080"
            },
            {
              "name": "RHSA-2014:0413",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2014:0413"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1060907",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1060907"
            },
            {
              "name": "59058",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/59058"
            },
            {
              "name": "SSRT101667",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
            },
            {
              "name": "HPSBUX03092",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
            },
            {
              "name": "RHSA-2014:0685",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-0685.html"
            },
            {
              "name": "DSA-2912",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-2912"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html"
            },
            {
              "name": "58415",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/58415"
            },
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562",
              "refsource": "MISC",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562"
            },
            {
              "name": "SSRT101668",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852974709252\u0026w=2"
            },
            {
              "name": "[oss-security] 20140207 Re: CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2014/q1/285"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21676746",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676746"
            },
            {
              "name": "[oss-security] 20140203 CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)",
              "refsource": "MLIST",
              "url": "http://seclists.org/oss-sec/2014/q1/242"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21679713",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21679713"
            },
            {
              "name": "65568",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/65568"
            },
            {
              "name": "102808",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/102808"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-1876",
    "datePublished": "2014-02-10T23:00:00",
    "dateReserved": "2014-02-06T00:00:00",
    "dateUpdated": "2024-08-06T09:58:15.835Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35603 (GCVE-0-2021-35603)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-04 00:40
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35603",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T17:52:57.786974Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-18T17:53:05.342Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:44.582774",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35603",
    "datePublished": "2021-10-20T10:50:43",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:47.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21299 (GCVE-0-2022-21299)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2025-02-13 16:28
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.411Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:37.290Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21299",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21299",
    "datePublished": "2022-01-19T11:23:43.000Z",
    "dateReserved": "2021-11-15T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:28:53.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2830 (GCVE-0-2020-2830)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-27 19:06
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10318x_refsource_CONFIRM
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:53:52.379987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T19:06:46.444Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-09T07:06:10",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2830",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2830",
    "datePublished": "2020-04-15T13:29:48",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-27T19:06:46.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14577 (GCVE-0-2020-14577)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:38
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:34.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14577",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:58:56.789755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:38:12.047Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:41",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14577",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14577",
    "datePublished": "2020-07-15T17:34:28",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:38:12.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21476 (GCVE-0-2022-21476)
Vulnerability from cvelistv5
Published
2022-04-19 20:38
Modified
2024-08-03 02:38
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220429-0006/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5128vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5131vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/05/msg00017.htmlmailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u331
Version: Oracle Java SE:8u321
Version: Oracle Java SE:11.0.14
Version: Oracle Java SE:17.0.2
Version: Oracle Java SE:18
Version: Oracle GraalVM Enterprise Edition:20.3.5
Version: Oracle GraalVM Enterprise Edition:21.3.1
Version: Oracle GraalVM Enterprise Edition:22.0.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:56.676Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
          },
          {
            "name": "DSA-5128",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5128"
          },
          {
            "name": "DSA-5131",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5131"
          },
          {
            "name": "[debian-lts-announce] 20220514 [SECURITY] [DLA 3006-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u331"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.14"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.2"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:18"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.0.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-14T11:06:05",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
        },
        {
          "name": "DSA-5128",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5128"
        },
        {
          "name": "DSA-5131",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5131"
        },
        {
          "name": "[debian-lts-announce] 20220514 [SECURITY] [DLA 3006-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21476",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u331"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:18"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.5"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:22.0.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220429-0006/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
            },
            {
              "name": "DSA-5128",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5128"
            },
            {
              "name": "DSA-5131",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5131"
            },
            {
              "name": "[debian-lts-announce] 20220514 [SECURITY] [DLA 3006-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21476",
    "datePublished": "2022-04-19T20:38:20",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:56.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2800 (GCVE-0-2020-2800)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:02
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.727Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2800",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:59:16.949849Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:02:23.206Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:30",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2800",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.8",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2800",
    "datePublished": "2020-04-15T13:29:46",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:02:23.206Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21293 (GCVE-0-2022-21293)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.319Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "FEDORA-2022-477401b0f7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:42.144Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "FEDORA-2022-477401b0f7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21293",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "FEDORA-2022-477401b0f7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21293",
    "datePublished": "2022-01-19T11:23:33",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2773 (GCVE-0-2020-2773)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:39
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.372Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:59:40.704407Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:39:10.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:54",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2773",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2773",
    "datePublished": "2020-04-15T13:29:45",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:39:10.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2778 (GCVE-0-2020-2778)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:38
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 11.0.6, 14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2778",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:59:35.969192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:38:23.112Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 11.0.6, 14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-02T14:06:15",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2778",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 11.0.6, 14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2778",
    "datePublished": "2020-04-15T13:29:45",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:38:23.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2739 (GCVE-0-2012-2739)
Vulnerability from cvelistv5
Published
2012-11-28 11:00
Modified
2024-08-06 19:42
Severity ?
CWE
  • n/a
Summary
Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
References
http://www.nruns.com/_downloads/advisory28122011.pdfx_refsource_MISC
http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.htmlx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=750533x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2012/06/17/1mailing-list, x_refsource_MLIST
http://www.kb.cert.org/vuls/id/903934third-party-advisory, x_refsource_CERT-VN
http://www.openwall.com/lists/oss-security/2012/06/15/12mailing-list, x_refsource_MLIST
http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.htmlmailing-list, x_refsource_MLIST
http://www.ocert.org/advisories/ocert-2011-003.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:42:32.448Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750533"
          },
          {
            "name": "[oss-security] 20120616 Re: CVE request: java hashdos vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/06/17/1"
          },
          {
            "name": "VU#903934",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/903934"
          },
          {
            "name": "[oss-security] 20120615 CVE request: java hashdos vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/06/15/12"
          },
          {
            "name": "[core-libs-dev] 20120522 Review Request CR#7118743 : Alternative Hashing for String with Hash-based Maps",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2011-003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-11-28T11:00:00Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750533"
        },
        {
          "name": "[oss-security] 20120616 Re: CVE request: java hashdos vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/06/17/1"
        },
        {
          "name": "VU#903934",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/903934"
        },
        {
          "name": "[oss-security] 20120615 CVE request: java hashdos vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/06/15/12"
        },
        {
          "name": "[core-libs-dev] 20120522 Review Request CR#7118743 : Alternative Hashing for String with Hash-based Maps",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2011-003.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2739",
    "datePublished": "2012-11-28T11:00:00Z",
    "dateReserved": "2012-05-14T00:00:00Z",
    "dateUpdated": "2024-08-06T19:42:32.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21954 (GCVE-0-2023-21954)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:28.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T14:39:04.663342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T15:15:07.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:19.494Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21954",
    "datePublished": "2023-04-18T19:54:30.576Z",
    "dateReserved": "2022-12-17T19:26:00.728Z",
    "dateUpdated": "2025-02-13T16:40:32.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2604 (GCVE-0-2020-2604)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 14:51
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
References
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2020:0465vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0470vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0467vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0469vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0468vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
https://www.oracle.com/security-alerts/cpujul2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
https://kc.mcafee.com/corporate/index?page=content&id=SB10315x_refsource_CONFIRM
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "RHSA-2020:0465",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0465"
          },
          {
            "name": "RHSA-2020:0470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0470"
          },
          {
            "name": "RHSA-2020:0467",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0467"
          },
          {
            "name": "RHSA-2020:0469",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0469"
          },
          {
            "name": "RHSA-2020:0468",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0468"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:42:05.369215Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T14:51:54.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-20T22:43:05",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "RHSA-2020:0465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0465"
        },
        {
          "name": "RHSA-2020:0470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0470"
        },
        {
          "name": "RHSA-2020:0467",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0467"
        },
        {
          "name": "RHSA-2020:0469",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0469"
        },
        {
          "name": "RHSA-2020:0468",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0468"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2604",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "8.1",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "RHSA-2020:0465",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0465"
            },
            {
              "name": "RHSA-2020:0470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0470"
            },
            {
              "name": "RHSA-2020:0467",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0467"
            },
            {
              "name": "RHSA-2020:0469",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0469"
            },
            {
              "name": "RHSA-2020:0468",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0468"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2604",
    "datePublished": "2020-01-15T16:34:03",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T14:51:54.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21937 (GCVE-0-2023-21937)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T13:34:57.672416Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T13:35:04.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:28.528Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:51.844Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21937",
    "datePublished": "2023-04-18T19:54:25.624Z",
    "dateReserved": "2022-12-17T19:26:00.722Z",
    "dateUpdated": "2025-02-13T16:40:27.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-34169 (GCVE-0-2022-34169)
Vulnerability from cvelistv5
Published
2022-07-19 00:00
Modified
2025-02-13 16:32
Severity ?
CWE
  • integer truncation
Summary
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
References
https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8
https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw
http://www.openwall.com/lists/oss-security/2022/07/19/5mailing-list
https://www.oracle.com/security-alerts/cpujul2022.html
http://www.openwall.com/lists/oss-security/2022/07/19/6mailing-list
http://www.openwall.com/lists/oss-security/2022/07/20/2mailing-list
http://www.openwall.com/lists/oss-security/2022/07/20/3mailing-list
https://www.debian.org/security/2022/dsa-5188vendor-advisory
https://www.debian.org/security/2022/dsa-5192vendor-advisory
https://security.netapp.com/advisory/ntap-20220729-0009/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/vendor-advisory
http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html
http://www.openwall.com/lists/oss-security/2022/10/18/2mailing-list
https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlmailing-list
https://www.debian.org/security/2022/dsa-5256vendor-advisory
http://www.openwall.com/lists/oss-security/2022/11/04/8mailing-list
http://www.openwall.com/lists/oss-security/2022/11/07/2mailing-list
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Apache Software Foundation Apache Xalan-J Version: Xalan-J   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T08:16:17.277Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
          },
          {
            "name": "[oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
          },
          {
            "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
          },
          {
            "name": "[oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
          },
          {
            "name": "DSA-5188",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5188"
          },
          {
            "name": "DSA-5192",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5192"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
          },
          {
            "name": "FEDORA-2022-19b6f21746",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
          },
          {
            "name": "FEDORA-2022-ae563934f7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
          },
          {
            "name": "FEDORA-2022-e573851f56",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
          },
          {
            "name": "FEDORA-2022-d26586b419",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
          },
          {
            "name": "FEDORA-2022-80afe2304a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
          },
          {
            "name": "FEDORA-2022-b76ab52e73",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
          },
          {
            "name": "[oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
          },
          {
            "name": "[debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
          },
          {
            "name": "DSA-5256",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5256"
          },
          {
            "name": "[oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
          },
          {
            "name": "[oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-25"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Xalan-J",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.7.2",
              "status": "affected",
              "version": "Xalan-J",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Reported by Felix Wilhelm, Google Project Zero"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "integer truncation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:47.103Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
        },
        {
          "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
        },
        {
          "name": "[oss-security] 20220719 CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
        },
        {
          "name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
        },
        {
          "name": "[oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
        },
        {
          "name": "DSA-5188",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5188"
        },
        {
          "name": "DSA-5192",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5192"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
        },
        {
          "name": "FEDORA-2022-19b6f21746",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
        },
        {
          "name": "FEDORA-2022-ae563934f7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
        },
        {
          "name": "FEDORA-2022-e573851f56",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
        },
        {
          "name": "FEDORA-2022-d26586b419",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
        },
        {
          "name": "FEDORA-2022-80afe2304a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
        },
        {
          "name": "FEDORA-2022-b76ab52e73",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
        },
        {
          "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
        },
        {
          "name": "[oss-security] 20221017 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
        },
        {
          "name": "[debian-lts-announce] 20221018 [SECURITY] [DLA 3155-1] bcel security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
        },
        {
          "name": "DSA-5256",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5256"
        },
        {
          "name": "[oss-security] 20221104 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
        },
        {
          "name": "[oss-security] 20221107 Re: CVE-2022-42920: Apache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writing",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
        },
        {
          "url": "https://security.gentoo.org/glsa/202401-25"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-34169",
    "datePublished": "2022-07-19T00:00:00.000Z",
    "dateReserved": "2022-06-21T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:32:44.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3517 (GCVE-0-2021-3517)
Vulnerability from cvelistv5
Published
2021-05-19 13:45
Modified
2024-08-03 16:53
Severity ?
CWE
Summary
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlmailing-list, x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1954232x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/vendor-advisory, x_refsource_FEDORA
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Emailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202107-05vendor-advisory, x_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20210625-0002/x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20211022-0004/x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a libxml2 Version: libxml2 2.9.11
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:53:17.731Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2021-e3ed1ba38b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
          },
          {
            "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232"
          },
          {
            "name": "FEDORA-2021-b950000d2b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "GLSA-202107-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-05"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libxml2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "libxml2 2.9.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:35:17",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2021-e3ed1ba38b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
        },
        {
          "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232"
        },
        {
          "name": "FEDORA-2021-b950000d2b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "GLSA-202107-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-05"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3517",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libxml2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "libxml2 2.9.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-787"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2021-e3ed1ba38b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
            },
            {
              "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232"
            },
            {
              "name": "FEDORA-2021-b950000d2b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "GLSA-202107-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-05"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210625-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211022-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3517",
    "datePublished": "2021-05-19T13:45:00",
    "dateReserved": "2021-04-27T00:00:00",
    "dateUpdated": "2024-08-03T16:53:17.731Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-2483 (GCVE-0-2014-2483)
Vulnerability from cvelistv5
Published
2014-07-17 02:36
Modified
2024-08-06 10:14
Severity ?
CWE
  • n/a
Summary
Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor's claim that the issue is related to improper restriction of the "use of privileged annotations."
References
http://www.debian.org/security/2014/dsa-2987vendor-advisory, x_refsource_DEBIAN
http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlx_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=140852886808946&w=2vendor-advisory, x_refsource_HP
http://www.securitytracker.com/id/1030577vdb-entry, x_refsource_SECTRACK
http://marc.info/?l=bugtraq&m=140852886808946&w=2vendor-advisory, x_refsource_HP
http://secunia.com/advisories/60812third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/archive/1/534161/100/0/threadedmailing-list, x_refsource_BUGTRAQ
https://bugzilla.redhat.com/show_bug.cgi?id=1119626x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlx_refsource_CONFIRM
http://secunia.com/advisories/60485third-party-advisory, x_refsource_SECUNIA
http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/848481af9003x_refsource_CONFIRM
http://seclists.org/fulldisclosure/2014/Dec/23mailing-list, x_refsource_FULLDISC
https://access.redhat.com/errata/RHSA-2014:0902vendor-advisory, x_refsource_REDHAT
http://security.gentoo.org/glsa/glsa-201502-12.xmlvendor-advisory, x_refsource_GENTOO
http://www.securityfocus.com/bid/68608vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:26.682Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-2987",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-2987"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
          },
          {
            "name": "HPSBUX03091",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
          },
          {
            "name": "1030577",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1030577"
          },
          {
            "name": "SSRT101667",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
          },
          {
            "name": "60812",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60812"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119626"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
          },
          {
            "name": "60485",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/60485"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/848481af9003"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
          },
          {
            "name": "RHSA-2014:0902",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2014:0902"
          },
          {
            "name": "GLSA-201502-12",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201502-12.xml"
          },
          {
            "name": "68608",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/68608"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-07-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor\u0027s claim that the issue is related to improper restriction of the \"use of privileged annotations.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "DSA-2987",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-2987"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
        },
        {
          "name": "HPSBUX03091",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
        },
        {
          "name": "1030577",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1030577"
        },
        {
          "name": "SSRT101667",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
        },
        {
          "name": "60812",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60812"
        },
        {
          "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119626"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
        },
        {
          "name": "60485",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/60485"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/848481af9003"
        },
        {
          "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
        },
        {
          "name": "RHSA-2014:0902",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2014:0902"
        },
        {
          "name": "GLSA-201502-12",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201502-12.xml"
        },
        {
          "name": "68608",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/68608"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2014-2483",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Java SE component in Oracle Java SE Java SE 7u60 and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2014-4223. NOTE: the previous information is from the July 2014 CPU. Oracle has not commented on another vendor\u0027s claim that the issue is related to improper restriction of the \"use of privileged annotations.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-2987",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-2987"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
            },
            {
              "name": "HPSBUX03091",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
            },
            {
              "name": "1030577",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1030577"
            },
            {
              "name": "SSRT101667",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=140852886808946\u0026w=2"
            },
            {
              "name": "60812",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60812"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1119626",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119626"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
            },
            {
              "name": "60485",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/60485"
            },
            {
              "name": "http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/848481af9003",
              "refsource": "CONFIRM",
              "url": "http://hg.openjdk.java.net/jdk7u/jdk7u/hotspot/rev/848481af9003"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
            },
            {
              "name": "RHSA-2014:0902",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2014:0902"
            },
            {
              "name": "GLSA-201502-12",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201502-12.xml"
            },
            {
              "name": "68608",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/68608"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2014-2483",
    "datePublished": "2014-07-17T02:36:00",
    "dateReserved": "2014-03-13T00:00:00",
    "dateUpdated": "2024-08-06T10:14:26.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14579 (GCVE-0-2020-14579)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:37
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:35.006Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:58:53.726663Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:37:57.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:49",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14579",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14579",
    "datePublished": "2020-07-15T17:34:28",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:37:57.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21930 (GCVE-0-2023-21930)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:graalvm:21.3.5:*:*:*:enterprise:*:*:*",
              "cpe:2.3:a:oracle:graalvm:22.3.1:*:*:*:enterprise:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "graalvm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "21.3.5"
              },
              {
                "status": "affected",
                "version": "22.3.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jdk:11.0.18:*:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jdk:17.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jdk:1.8.0:update361:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jdk:20:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.18"
              },
              {
                "status": "affected",
                "version": "17.0.6"
              },
              {
                "status": "affected",
                "version": "1.8.0"
              },
              {
                "status": "affected",
                "version": "20"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:jre:11.0.18:*:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jre:17.0.6:*:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jre:1.8.0:update361:*:*:*:*:*:*",
              "cpe:2.3:a:oracle:jre:20:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jre",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.18"
              },
              {
                "status": "affected",
                "version": "17.0.6"
              },
              {
                "status": "affected",
                "version": "1.8.0"
              },
              {
                "status": "affected",
                "version": "20"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "oncommand_insight",
            "vendor": "netapp",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "10.0"
              },
              {
                "status": "affected",
                "version": "11.0"
              },
              {
                "status": "affected",
                "version": "12.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T19:44:31.998696Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T20:06:28.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:27.250Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:35.314Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21930",
    "datePublished": "2023-04-18T19:54:23.189Z",
    "dateReserved": "2022-12-17T19:26:00.718Z",
    "dateUpdated": "2025-02-13T16:40:25.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2341 (GCVE-0-2021-2341)
Vulnerability from cvelistv5
Published
2021-07-20 22:43
Modified
2024-09-26 14:04
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujul2021.htmlx_refsource_MISC
https://www.debian.org/security/2021/dsa-4946vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.htmlmailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20210723-0002/x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u301
Version: Java SE:8u291
Version: Java SE:11.0.11
Version: Java SE:16.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.2
Version: Oracle GraalVM Enterprise Edition:21.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:38:57.562Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "name": "DSA-4946",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4946"
          },
          {
            "name": "FEDORA-2021-d20d6712bc",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/"
          },
          {
            "name": "FEDORA-2021-ade03666c0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/"
          },
          {
            "name": "FEDORA-2021-e6b0792d75",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/"
          },
          {
            "name": "FEDORA-2021-4581ccb97d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/"
          },
          {
            "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T13:52:12.701754Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T14:04:53.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u301"
            },
            {
              "status": "affected",
              "version": "Java SE:8u291"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.11"
            },
            {
              "status": "affected",
              "version": "Java SE:16.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:06:46",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "name": "DSA-4946",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4946"
        },
        {
          "name": "FEDORA-2021-d20d6712bc",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/"
        },
        {
          "name": "FEDORA-2021-ade03666c0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/"
        },
        {
          "name": "FEDORA-2021-e6b0792d75",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/"
        },
        {
          "name": "FEDORA-2021-4581ccb97d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/"
        },
        {
          "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2341",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:7u301"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u291"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:16.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
            },
            {
              "name": "DSA-4946",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4946"
            },
            {
              "name": "FEDORA-2021-d20d6712bc",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TTUHVQF2MGUTP6GTCXLZS4GXK3XUWC/"
            },
            {
              "name": "FEDORA-2021-ade03666c0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PJJ75FHSUZGWPV4UJTSMQHWLOQ77LHTG/"
            },
            {
              "name": "FEDORA-2021-e6b0792d75",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N57OFX5EJKHHDW4WAOBZFWA5CL4VIIK5/"
            },
            {
              "name": "FEDORA-2021-4581ccb97d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VTRQIXB52KIXUAO6JBYUKYWXST2NKNAK/"
            },
            {
              "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210723-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2341",
    "datePublished": "2021-07-20T22:43:20",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T14:04:53.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2593 (GCVE-0-2020-2593)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 16:29
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4605vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Jan/24mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2020:0465vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0470vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0467vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0469vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0468vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://kc.mcafee.com/corporate/index?page=content&id=SB10315x_refsource_CONFIRM
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.836Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "DSA-4605",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4605"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/24"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "RHSA-2020:0465",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0465"
          },
          {
            "name": "RHSA-2020:0470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0470"
          },
          {
            "name": "RHSA-2020:0467",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0467"
          },
          {
            "name": "RHSA-2020:0469",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0469"
          },
          {
            "name": "RHSA-2020:0468",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0468"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:04:39.425813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:29:29.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:18",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "DSA-4605",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4605"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/24"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "RHSA-2020:0465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0465"
        },
        {
          "name": "RHSA-2020:0470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0470"
        },
        {
          "name": "RHSA-2020:0467",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0467"
        },
        {
          "name": "RHSA-2020:0469",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0469"
        },
        {
          "name": "RHSA-2020:0468",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0468"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2593",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.8",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "DSA-4605",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4605"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/24"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "RHSA-2020:0465",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0465"
            },
            {
              "name": "RHSA-2020:0470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0470"
            },
            {
              "name": "RHSA-2020:0467",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0467"
            },
            {
              "name": "RHSA-2020:0469",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0469"
            },
            {
              "name": "RHSA-2020:0468",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0468"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2593",
    "datePublished": "2020-01-15T16:34:02",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T16:29:29.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2754 (GCVE-0-2020-2754)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:42
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.636Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2754",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:00:12.324367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:42:05.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-14T07:06:11",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2754",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2754",
    "datePublished": "2020-04-15T13:29:44",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:42:05.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35578 (GCVE-0-2021-35578)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-22 14:44
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8u301"
              },
              {
                "status": "affected",
                "version": "11.0.12"
              },
              {
                "status": "affected",
                "version": "17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:graalvm_enterprise_edition:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "graalvm_enterprise_edition",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "20.33"
              },
              {
                "status": "affected",
                "version": "21.2.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T17:53:39.464164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T14:44:44.233Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:05.008220",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35578",
    "datePublished": "2021-10-20T10:50:24",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-22T14:44:44.233Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14781 (GCVE-0-2020-14781)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:24
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:41.333549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:24:11.172Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:20",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14781",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JNDI). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14781",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:24:11.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14803 (GCVE-0-2020-14803)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:20
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://www.oracle.com/security-alerts/cpujan2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 11.0.8
Version: 15
 Create a notification for this product.
   Oracle Corporation GraalVM Enterprise Edition Version: 19.3.4
Version: 20.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:00:50.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:56:08.056603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:20:23.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 11.0.8"
            },
            {
              "status": "affected",
              "version": "15"
            }
          ]
        },
        {
          "product": "GraalVM Enterprise Edition",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "19.3.4"
            },
            {
              "status": "affected",
              "version": "20.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:07",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14803",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "GraalVM Enterprise Edition",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "19.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "20.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 11.0.8 and 15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14803",
    "datePublished": "2020-10-21T14:04:26",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:20:23.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35567 (GCVE-0-2021-35567)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-09-25 19:35
Severity ?
6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CWE
  • Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20211022-0004/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory, x_refsource_FEDORA
https://www.debian.org/security/2021/dsa-5000vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2021/dsa-5012vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.953Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35567",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T19:14:55.364056Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T19:35:00.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:06:57",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-35567",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u301"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.12"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:17"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.8",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows low privileged attacker with network access via Kerberos to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211022-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
            },
            {
              "name": "FEDORA-2021-7701833090",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
            },
            {
              "name": "FEDORA-2021-1cc8ffd122",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
            },
            {
              "name": "FEDORA-2021-107c8c5063",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
            },
            {
              "name": "DSA-5000",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5000"
            },
            {
              "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
            },
            {
              "name": "DSA-5012",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5012"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35567",
    "datePublished": "2021-10-20T10:50:14",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-09-25T19:35:00.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21968 (GCVE-0-2023-21968)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:28.370Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:33.467Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21968",
    "datePublished": "2023-04-18T19:54:34.372Z",
    "dateReserved": "2022-12-17T19:26:00.733Z",
    "dateUpdated": "2025-02-13T16:40:35.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-8873 (GCVE-0-2014-8873)
Vulnerability from cvelistv5
Published
2015-11-09 16:00
Modified
2024-08-06 13:33
Severity ?
CWE
  • n/a
Summary
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
References
http://www.debian.org/security/2015/dsa-3235vendor-advisory, x_refsource_DEBIAN
http://www.securityfocus.com/bid/76019vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2015/07/18/2mailing-list, x_refsource_MLIST
http://www.debian.org/security/2015/dsa-3316vendor-advisory, x_refsource_DEBIAN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:33:11.878Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-3235",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3235"
          },
          {
            "name": "76019",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/76019"
          },
          {
            "name": "[oss-security] 20150718 CVE-2014-8873 was fixed in DSA-3235-1",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/07/18/2"
          },
          {
            "name": "DSA-3316",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2015/dsa-3316"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-07-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-11-09T15:57:02",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-3235",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3235"
        },
        {
          "name": "76019",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/76019"
        },
        {
          "name": "[oss-security] 20150718 CVE-2014-8873 was fixed in DSA-3235-1",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/07/18/2"
        },
        {
          "name": "DSA-3316",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2015/dsa-3316"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-8873",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-3235",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3235"
            },
            {
              "name": "76019",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/76019"
            },
            {
              "name": "[oss-security] 20150718 CVE-2014-8873 was fixed in DSA-3235-1",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/07/18/2"
            },
            {
              "name": "DSA-3316",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2015/dsa-3316"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-8873",
    "datePublished": "2015-11-09T16:00:00",
    "dateReserved": "2014-11-14T00:00:00",
    "dateUpdated": "2024-08-06T13:33:11.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2601 (GCVE-0-2020-2601)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 16:22
Severity ?
6.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4605vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Jan/24mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.842Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "DSA-4605",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4605"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/24"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2601",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:04:27.899340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:22:28.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded.  While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:17",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "DSA-4605",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4605"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/24"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2601",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.8",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded.  While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "DSA-4605",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4605"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/24"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2601",
    "datePublished": "2020-01-15T16:34:02",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T16:22:28.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35560 (GCVE-0-2021-35560)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-09-06 18:54
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:8u301
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:java_se:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "java_se",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8u301"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35560",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T18:18:03.172834Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-06T18:54:39.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:8u301"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:15.255742",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35560",
    "datePublished": "2021-10-20T10:50:08",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-09-06T18:54:39.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14782 (GCVE-0-2020-14782)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:23
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:39.909812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:23:59.582Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:13",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14782",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14782",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:23:59.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14796 (GCVE-0-2020-14796)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:21
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:00:50.979Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14796",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:20.611468Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:21:37.049Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:14",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14796",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14796",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:21:37.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35564 (GCVE-0-2021-35564)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-04 00:40
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:openjdk:11.0.12:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openjdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "11.0.12"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openjdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "17"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openjdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "8"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openjdk",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "7"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "graalvm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "20.3.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "graalvm",
            "vendor": "oracle",
            "versions": [
              {
                "status": "affected",
                "version": "21.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "oncommand_insight",
            "vendor": "netapp",
            "versions": [
              {
                "status": "affected",
                "version": "0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fedora",
            "vendor": "fedoraproject",
            "versions": [
              {
                "status": "affected",
                "version": "33"
              },
              {
                "status": "affected",
                "version": "34"
              },
              {
                "status": "affected",
                "version": "35"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "debian_linux",
            "vendor": "debian",
            "versions": [
              {
                "status": "affected",
                "version": "10.0"
              },
              {
                "status": "affected",
                "version": "11.0"
              },
              {
                "status": "affected",
                "version": "9.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35564",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T18:55:09.687351Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T19:06:41.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Keytool). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:35.036915",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35564",
    "datePublished": "2021-10-20T10:50:11",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:46.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-20264 (GCVE-0-2021-20264)
Vulnerability from cvelistv5
Published
2021-10-06 15:12
Modified
2024-08-03 17:37
Severity ?
CWE
Summary
An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1932283x_refsource_MISC
Impacted products
Vendor Product Version
n/a containers/openjdk Version: openjdk 1.8
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.455Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932283"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containers/openjdk",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "openjdk 1.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-06T15:12:05",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932283"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-20264",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "containers/openjdk",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "openjdk 1.8"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify the /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-266"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1932283",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1932283"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20264",
    "datePublished": "2021-10-06T15:12:05",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:37:23.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21967 (GCVE-0-2023-21967)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21967",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-17T13:34:32.918522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-17T13:34:40.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:28.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:05:57.984Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21967",
    "datePublished": "2023-04-18T19:54:33.967Z",
    "dateReserved": "2022-12-17T19:26:00.733Z",
    "dateUpdated": "2025-02-13T16:40:35.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3522 (GCVE-0-2021-3522)
Vulnerability from cvelistv5
Published
2021-06-02 14:38
Modified
2024-08-03 17:01
Severity ?
CWE
Summary
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1954761x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20211022-0004/x_refsource_CONFIRM
https://security.gentoo.org/glsa/202208-31vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
n/a GStreamer Version: All GStreamer version before 1.18.4
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.139Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954761"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "GLSA-202208-31",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202208-31"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GStreamer",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All GStreamer version before 1.18.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-15T01:06:26",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954761"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "GLSA-202208-31",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202208-31"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3522",
    "datePublished": "2021-06-02T14:38:16",
    "dateReserved": "2021-04-28T00:00:00",
    "dateUpdated": "2024-08-03T17:01:08.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3537 (GCVE-0-2021-3537)
Vulnerability from cvelistv5
Published
2021-05-14 19:50
Modified
2024-08-03 17:01
Severity ?
CWE
Summary
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlmailing-list, x_refsource_MLIST
https://bugzilla.redhat.com/show_bug.cgi?id=1956522x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202107-05vendor-advisory, x_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20210625-0002/x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a libxml2 Version: libxml2 2.9.11
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2021-e3ed1ba38b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
          },
          {
            "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522"
          },
          {
            "name": "FEDORA-2021-b950000d2b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
          },
          {
            "name": "GLSA-202107-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-05"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libxml2",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "libxml2 2.9.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:35:39",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2021-e3ed1ba38b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
        },
        {
          "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522"
        },
        {
          "name": "FEDORA-2021-b950000d2b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
        },
        {
          "name": "GLSA-202107-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202107-05"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3537",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "libxml2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "libxml2 2.9.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-476"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2021-e3ed1ba38b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
            },
            {
              "name": "[debian-lts-announce] 20210510 [SECURITY] [DLA 2653-1] libxml2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1956522"
            },
            {
              "name": "FEDORA-2021-b950000d2b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
            },
            {
              "name": "GLSA-202107-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202107-05"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210625-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3537",
    "datePublished": "2021-05-14T19:50:10",
    "dateReserved": "2021-05-05T00:00:00",
    "dateUpdated": "2024-08-03T17:01:08.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-32553 (GCVE-0-2021-32553)
Vulnerability from cvelistv5
Published
2021-06-12 03:40
Modified
2024-09-16 22:51
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
  • CWE-61 - UNIX Symbolic Link (Symlink) Following
Summary
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
References
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904x_refsource_MISC
Impacted products
Vendor Product Version
Canonical apport Version: 2.20.1   < 2.20.1-0ubuntu2.30+esm1
Version: 2.20.9   < 2.20.9-0ubuntu7.24
Version: 2.20.11-0ubuntu27   < 2.20.11-0ubuntu27.18
Version: 2.20.11-0ubuntu50   < 2.20.11-0ubuntu50.7
Version: 2.20.11-0ubuntu65   < 2.20.11-0ubuntu65.1
Version: 2.14.1-0ubuntu3   < 2.14.1-0ubuntu3.29+esm7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T23:25:30.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apport",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "2.20.1-0ubuntu2.30+esm1",
              "status": "affected",
              "version": "2.20.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.9-0ubuntu7.24",
              "status": "affected",
              "version": "2.20.9",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.11-0ubuntu27.18",
              "status": "affected",
              "version": "2.20.11-0ubuntu27",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.11-0ubuntu50.7",
              "status": "affected",
              "version": "2.20.11-0ubuntu50",
              "versionType": "custom"
            },
            {
              "lessThan": "2.20.11-0ubuntu65.1",
              "status": "affected",
              "version": "2.20.11-0ubuntu65",
              "versionType": "custom"
            },
            {
              "lessThan": "2.14.1-0ubuntu3.29+esm7",
              "status": "affected",
              "version": "2.14.1-0ubuntu3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "maik@secfault-security.com (@fktio)"
        }
      ],
      "datePublic": "2021-05-25T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61 UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-12T03:40:40",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
        }
      ],
      "source": {
        "advisory": "https://ubuntu.com/security/notices/USN-4965-1",
        "defect": [
          "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "apport read_file() function could follow maliciously constructed symbolic links",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@ubuntu.com",
          "DATE_PUBLIC": "2021-05-25T00:00:00.000Z",
          "ID": "CVE-2021-32553",
          "STATE": "PUBLIC",
          "TITLE": "apport read_file() function could follow maliciously constructed symbolic links"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "apport",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20.1",
                            "version_value": "2.20.1-0ubuntu2.30+esm1"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20.9",
                            "version_value": "2.20.9-0ubuntu7.24"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20.11-0ubuntu27",
                            "version_value": "2.20.11-0ubuntu27.18"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20.11-0ubuntu50",
                            "version_value": "2.20.11-0ubuntu50.7"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.20.11-0ubuntu65",
                            "version_value": "2.20.11-0ubuntu65.1"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_name": "2.14.1-0ubuntu3",
                            "version_value": "2.14.1-0ubuntu3.29+esm7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Canonical"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "maik@secfault-security.com (@fktio)"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-61 UNIX Symbolic Link (Symlink) Following"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904",
              "refsource": "MISC",
              "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
            }
          ]
        },
        "source": {
          "advisory": "https://ubuntu.com/security/notices/USN-4965-1",
          "defect": [
            "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
          ],
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2021-32553",
    "datePublished": "2021-06-12T03:40:40.514625Z",
    "dateReserved": "2021-05-10T00:00:00",
    "dateUpdated": "2024-09-16T22:51:04.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21291 (GCVE-0-2022-21291)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.283Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "FEDORA-2022-477401b0f7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:19:34.932Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "FEDORA-2022-477401b0f7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21291",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "FEDORA-2022-477401b0f7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21291",
    "datePublished": "2022-01-19T11:23:29",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2163 (GCVE-0-2021-2163)
Vulnerability from cvelistv5
Published
2021-04-22 21:53
Modified
2024-09-26 15:33
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2021.htmlx_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2021/dsa-4899vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/vendor-advisory, x_refsource_FEDORA
https://security.netapp.com/advisory/ntap-20210513-0001/x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u291
Version: Java SE:8u281
Version: Java SE:11.0.10
Version: Java SE:16
Version: Java SE Embedded:8u281
Version: Oracle GraalVM Enterprise Edition:19.3.5
Version: Oracle GraalVM Enterprise Edition:20.3.1.2
Version: Oracle GraalVM Enterprise Edition:21.0.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:32:03.140Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
          },
          {
            "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
          },
          {
            "name": "DSA-4899",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4899"
          },
          {
            "name": "FEDORA-2021-6eb9bbbf0c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
          },
          {
            "name": "FEDORA-2021-65aa196c14",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
          },
          {
            "name": "FEDORA-2021-25b47f16af",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
          },
          {
            "name": "FEDORA-2021-8b80ef64f1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
          },
          {
            "name": "FEDORA-2021-f71b592e07",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
          },
          {
            "name": "FEDORA-2021-b88e86b753",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2163",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T14:44:06.976321Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:33:21.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u291"
            },
            {
              "status": "affected",
              "version": "Java SE:8u281"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.10"
            },
            {
              "status": "affected",
              "version": "Java SE:16"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded:8u281"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:19.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.1.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.0.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:07:16",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
        },
        {
          "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
        },
        {
          "name": "DSA-4899",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4899"
        },
        {
          "name": "FEDORA-2021-6eb9bbbf0c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
        },
        {
          "name": "FEDORA-2021-65aa196c14",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
        },
        {
          "name": "FEDORA-2021-25b47f16af",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
        },
        {
          "name": "FEDORA-2021-8b80ef64f1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
        },
        {
          "name": "FEDORA-2021-f71b592e07",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
        },
        {
          "name": "FEDORA-2021-b88e86b753",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2163",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:7u291"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u281"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.10"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:16"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded:8u281"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:19.3.5"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.1.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.0.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
            },
            {
              "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
            },
            {
              "name": "DSA-4899",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4899"
            },
            {
              "name": "FEDORA-2021-6eb9bbbf0c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
            },
            {
              "name": "FEDORA-2021-65aa196c14",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
            },
            {
              "name": "FEDORA-2021-25b47f16af",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
            },
            {
              "name": "FEDORA-2021-8b80ef64f1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
            },
            {
              "name": "FEDORA-2021-f71b592e07",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
            },
            {
              "name": "FEDORA-2021-b88e86b753",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2163",
    "datePublished": "2021-04-22T21:53:46",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T15:33:21.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21541 (GCVE-0-2022-21541)
Vulnerability from cvelistv5
Published
2022-07-19 00:00
Modified
2024-09-23 19:22
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpujul2022.html
https://www.debian.org/security/2022/dsa-5188vendor-advisory
https://www.debian.org/security/2022/dsa-5192vendor-advisory
https://security.netapp.com/advisory/ntap-20220729-0009/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/vendor-advisory
https://security.gentoo.org/glsa/202401-25vendor-advisory
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u343
Version: Oracle Java SE:8u333
Version: Oracle Java SE:11.0.15.1
Version: Oracle Java SE:17.0.3.1
Version: Oracle Java SE:18.0.1.1
Version: Oracle GraalVM Enterprise Edition:20.3.6
Version: Oracle GraalVM Enterprise Edition:21.3.2
Version: Oracle GraalVM Enterprise Edition:22.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:38.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          },
          {
            "name": "DSA-5188",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5188"
          },
          {
            "name": "DSA-5192",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5192"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
          },
          {
            "name": "FEDORA-2022-19b6f21746",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
          },
          {
            "name": "FEDORA-2022-ae563934f7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
          },
          {
            "name": "FEDORA-2022-e573851f56",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
          },
          {
            "name": "FEDORA-2022-d26586b419",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
          },
          {
            "name": "FEDORA-2022-80afe2304a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
          },
          {
            "name": "FEDORA-2022-b76ab52e73",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
          },
          {
            "name": "GLSA-202401-25",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-25"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-11T20:42:01.658119Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-23T19:22:48.866Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u343"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u333"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.15.1"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.3.1"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:18.0.1.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.6"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-17T15:06:44.119587",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        },
        {
          "name": "DSA-5188",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5188"
        },
        {
          "name": "DSA-5192",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5192"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
        },
        {
          "name": "FEDORA-2022-19b6f21746",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
        },
        {
          "name": "FEDORA-2022-ae563934f7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
        },
        {
          "name": "FEDORA-2022-e573851f56",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
        },
        {
          "name": "FEDORA-2022-d26586b419",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
        },
        {
          "name": "FEDORA-2022-80afe2304a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
        },
        {
          "name": "FEDORA-2022-b76ab52e73",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
        },
        {
          "name": "GLSA-202401-25",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202401-25"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21541",
    "datePublished": "2022-07-19T00:00:00",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-09-23T19:22:48.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21939 (GCVE-0-2023-21939)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.9
Version: Oracle GraalVM Enterprise Edition:21.3.5
Version: Oracle GraalVM Enterprise Edition:22.3.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21939",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-05T19:26:29.575017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T19:26:49.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:27.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:18.372Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21939",
    "datePublished": "2023-04-18T19:54:26.274Z",
    "dateReserved": "2022-12-17T19:26:00.722Z",
    "dateUpdated": "2025-02-13T16:40:28.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-13117 (GCVE-0-2019-13117)
Vulnerability from cvelistv5
Published
2019-07-01 01:27
Modified
2024-08-04 23:41
Severity ?
CWE
  • n/a
Summary
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
References
https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1x_refsource_MISC
https://oss-fuzz.com/testcase-detail/5631739747106816x_refsource_MISC
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlmailing-list, x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20190806-0004/x_refsource_CONFIRM
https://usn.ubuntu.com/4164-1/vendor-advisory, x_refsource_UBUNTU
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/vendor-advisory, x_refsource_FEDORA
http://www.openwall.com/lists/oss-security/2019/11/17/2mailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlvendor-advisory, x_refsource_SUSE
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3Emailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:41:10.511Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://oss-fuzz.com/testcase-detail/5631739747106816"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"
          },
          {
            "name": "[debian-lts-announce] 20190722 [SECURITY] [DLA 1860-1] libxslt security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20190806-0004/"
          },
          {
            "name": "USN-4164-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4164-1/"
          },
          {
            "name": "FEDORA-2019-fdf6ec39b4",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"
          },
          {
            "name": "[oss-security] 20191117 Nokogiri security update v1.10.5",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0731",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-29T14:08:48",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://oss-fuzz.com/testcase-detail/5631739747106816"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"
        },
        {
          "name": "[debian-lts-announce] 20190722 [SECURITY] [DLA 1860-1] libxslt security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20190806-0004/"
        },
        {
          "name": "USN-4164-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4164-1/"
        },
        {
          "name": "FEDORA-2019-fdf6ec39b4",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"
        },
        {
          "name": "[oss-security] 20191117 Nokogiri security update v1.10.5",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0731",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13117",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1",
              "refsource": "MISC",
              "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"
            },
            {
              "name": "https://oss-fuzz.com/testcase-detail/5631739747106816",
              "refsource": "MISC",
              "url": "https://oss-fuzz.com/testcase-detail/5631739747106816"
            },
            {
              "name": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471",
              "refsource": "MISC",
              "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"
            },
            {
              "name": "[debian-lts-announce] 20190722 [SECURITY] [DLA 1860-1] libxslt security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20190806-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20190806-0004/"
            },
            {
              "name": "USN-4164-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4164-1/"
            },
            {
              "name": "FEDORA-2019-fdf6ec39b4",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"
            },
            {
              "name": "[oss-security] 20191117 Nokogiri security update v1.10.5",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0731",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-13117",
    "datePublished": "2019-07-01T01:27:02",
    "dateReserved": "2019-06-30T00:00:00",
    "dateUpdated": "2024-08-04T23:41:10.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14798 (GCVE-0-2020-14798)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:21
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:00:50.871Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:17.079782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:21:17.899Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:10",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14798",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14798",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:21:17.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2161 (GCVE-0-2021-2161)
Vulnerability from cvelistv5
Published
2021-04-22 21:53
Modified
2024-09-26 15:33
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2021.htmlx_refsource_MISC
https://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2021/dsa-4899vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/vendor-advisory, x_refsource_FEDORA
https://security.netapp.com/advisory/ntap-20210513-0001/x_refsource_CONFIRM
https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposuresx_refsource_MISC
https://kc.mcafee.com/corporate/index?page=content&id=SB10366x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u291
Version: Java SE:8u281
Version: Java SE:11.0.10
Version: Java SE:16
Version: Java SE Embedded:8u281
Version: Oracle GraalVM Enterprise Edition:19.3.5
Version: Oracle GraalVM Enterprise Edition:20.3.1.2
Version: Oracle GraalVM Enterprise Edition:21.0.0.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:32:03.135Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
          },
          {
            "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
          },
          {
            "name": "DSA-4899",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4899"
          },
          {
            "name": "FEDORA-2021-6eb9bbbf0c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
          },
          {
            "name": "FEDORA-2021-65aa196c14",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
          },
          {
            "name": "FEDORA-2021-25b47f16af",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
          },
          {
            "name": "FEDORA-2021-8b80ef64f1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
          },
          {
            "name": "FEDORA-2021-f71b592e07",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
          },
          {
            "name": "FEDORA-2021-b88e86b753",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2161",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T14:44:10.262858Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T15:33:42.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u291"
            },
            {
              "status": "affected",
              "version": "Java SE:8u281"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.10"
            },
            {
              "status": "affected",
              "version": "Java SE:16"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded:8u281"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:19.3.5"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.1.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.0.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:06:40",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
        },
        {
          "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
        },
        {
          "name": "DSA-4899",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4899"
        },
        {
          "name": "FEDORA-2021-6eb9bbbf0c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
        },
        {
          "name": "FEDORA-2021-65aa196c14",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
        },
        {
          "name": "FEDORA-2021-25b47f16af",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
        },
        {
          "name": "FEDORA-2021-8b80ef64f1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
        },
        {
          "name": "FEDORA-2021-f71b592e07",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
        },
        {
          "name": "FEDORA-2021-b88e86b753",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2161",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:7u291"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u281"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.10"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:16"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded:8u281"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:19.3.5"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.1.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.0.0.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.9",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
            },
            {
              "name": "[debian-lts-announce] 20210423 [SECURITY] [DLA 2634-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
            },
            {
              "name": "DSA-4899",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4899"
            },
            {
              "name": "FEDORA-2021-6eb9bbbf0c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
            },
            {
              "name": "FEDORA-2021-65aa196c14",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
            },
            {
              "name": "FEDORA-2021-25b47f16af",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
            },
            {
              "name": "FEDORA-2021-8b80ef64f1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
            },
            {
              "name": "FEDORA-2021-f71b592e07",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
            },
            {
              "name": "FEDORA-2021-b88e86b753",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
            },
            {
              "name": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures",
              "refsource": "MISC",
              "url": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2161",
    "datePublished": "2021-04-22T21:53:46",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T15:33:42.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14779 (GCVE-0-2020-14779)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:24
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7XEONOP6JB7SD7AMUWZTLZF2L4QD546/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMJMTXFJRONFT72YAEQNRFKYZZU4W3HD/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKRGVMZT3EUUWKUA6DBT56FT3UOKPHQ2/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCKZAI4AWSKO5O5VDXHFFKNLOZGZ3KEE/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVPLGNHNJ4UJ6IO6R2XXEKCTCI2DRPDQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6CJCO52DHIQJHLPF6HMTC5Z2VKFRQMY/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "FEDORA-2020-845860fd4f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7XEONOP6JB7SD7AMUWZTLZF2L4QD546/"
          },
          {
            "name": "FEDORA-2020-5708dd5b87",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMJMTXFJRONFT72YAEQNRFKYZZU4W3HD/"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "FEDORA-2020-febe36c3ac",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKRGVMZT3EUUWKUA6DBT56FT3UOKPHQ2/"
          },
          {
            "name": "FEDORA-2020-421f817e5f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCKZAI4AWSKO5O5VDXHFFKNLOZGZ3KEE/"
          },
          {
            "name": "FEDORA-2020-a405eea76a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVPLGNHNJ4UJ6IO6R2XXEKCTCI2DRPDQ/"
          },
          {
            "name": "FEDORA-2020-fdc79d8e5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6CJCO52DHIQJHLPF6HMTC5Z2VKFRQMY/"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:44.512253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:24:31.036Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:12",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "FEDORA-2020-845860fd4f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7XEONOP6JB7SD7AMUWZTLZF2L4QD546/"
        },
        {
          "name": "FEDORA-2020-5708dd5b87",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OMJMTXFJRONFT72YAEQNRFKYZZU4W3HD/"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "FEDORA-2020-febe36c3ac",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XKRGVMZT3EUUWKUA6DBT56FT3UOKPHQ2/"
        },
        {
          "name": "FEDORA-2020-421f817e5f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YCKZAI4AWSKO5O5VDXHFFKNLOZGZ3KEE/"
        },
        {
          "name": "FEDORA-2020-a405eea76a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVPLGNHNJ4UJ6IO6R2XXEKCTCI2DRPDQ/"
        },
        {
          "name": "FEDORA-2020-fdc79d8e5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6CJCO52DHIQJHLPF6HMTC5Z2VKFRQMY/"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14779",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "FEDORA-2020-845860fd4f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z7XEONOP6JB7SD7AMUWZTLZF2L4QD546/"
            },
            {
              "name": "FEDORA-2020-5708dd5b87",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OMJMTXFJRONFT72YAEQNRFKYZZU4W3HD/"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "FEDORA-2020-febe36c3ac",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XKRGVMZT3EUUWKUA6DBT56FT3UOKPHQ2/"
            },
            {
              "name": "FEDORA-2020-421f817e5f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YCKZAI4AWSKO5O5VDXHFFKNLOZGZ3KEE/"
            },
            {
              "name": "FEDORA-2020-a405eea76a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVPLGNHNJ4UJ6IO6R2XXEKCTCI2DRPDQ/"
            },
            {
              "name": "FEDORA-2020-fdc79d8e5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6CJCO52DHIQJHLPF6HMTC5Z2VKFRQMY/"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14779",
    "datePublished": "2020-10-21T14:04:24",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:24:31.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14621 (GCVE-0-2020-14621)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:31
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3Emailing-list, x_refsource_MLIST
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:42.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "name": "[xerces-j-users] 20201014 Security vulnerability in 2.12.0",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:53:09.488159Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:31:06.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:38",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "name": "[xerces-j-users] 20201014 Security vulnerability in 2.12.0",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14621",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "[xerces-j-users] 20201014 Security vulnerability in 2.12.0",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103@%3Cj-users.xerces.apache.org%3E"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14621",
    "datePublished": "2020-07-15T17:34:30",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:31:06.202Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21283 (GCVE-0-2022-21283)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:54.980Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "FEDORA-2022-477401b0f7",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:39.446Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "FEDORA-2022-477401b0f7",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21283",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "FEDORA-2022-477401b0f7",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DIN3L6L3SVZK75CKW2GPSU4HIGZR7XG/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21283",
    "datePublished": "2022-01-19T11:23:13",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:54.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2816 (GCVE-0-2020-2816)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-27 19:08
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 11.0.6, 14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.771Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:54:00.321524Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T19:08:23.886Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 11.0.6, 14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-02T14:06:12",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2816",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 11.0.6, 14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2816",
    "datePublished": "2020-04-15T13:29:47",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-27T19:08:23.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21366 (GCVE-0-2022-21366)
Vulnerability from cvelistv5
Published
2022-01-19 11:25
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.987Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:25.759Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21366",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21366",
    "datePublished": "2022-01-19T11:25:49",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21365 (GCVE-0-2022-21365)
Vulnerability from cvelistv5
Published
2022-01-19 11:25
Modified
2024-11-19 19:09
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.571Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21365",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-30T20:59:23.165168Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T19:09:11.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:22.839Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21365",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21365",
    "datePublished": "2022-01-19T11:25:47",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-11-19T19:09:11.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20952 (GCVE-0-2024-20952)
Vulnerability from cvelistv5
Published
2024-01-16 21:41
Modified
2025-02-13 17:32
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpujan2024.htmlvendor-advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html
https://security.netapp.com/advisory/ntap-20240201-0002/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u391
Version: Oracle Java SE:8u391-perf
Version: Oracle Java SE:11.0.21
Version: Oracle Java SE:17.0.9
Version: Oracle Java SE:21.0.1
Version: Oracle GraalVM for JDK:17.0.9
Version: Oracle GraalVM for JDK:21.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.12
Version: Oracle GraalVM Enterprise Edition:21.3.8
Version: Oracle GraalVM Enterprise Edition:22.3.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:06:37.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2024.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240201-0002/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20952",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-25T05:01:04.858571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-30T15:29:52.965Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u391"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u391-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.21"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.9"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:21.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:17.0.9"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM for JDK:21.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.12"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.8"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-01T17:06:51.113Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2024.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240201-0002/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2024-20952",
    "datePublished": "2024-01-16T21:41:20.593Z",
    "dateReserved": "2023-12-07T22:28:10.627Z",
    "dateUpdated": "2025-02-13T17:32:42.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-0431 (GCVE-0-2013-0431)
Vulnerability from cvelistv5
Published
2013-01-31 14:10
Modified
2025-02-10 19:50
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • n/a
Summary
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
References
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418vdb-entry, signature, x_refsource_OVAL
http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x_refsource_GENTOO
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095vendor-advisory, x_refsource_MANDRIVA
http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717x_refsource_MISC
http://www.us-cert.gov/cas/techalerts/TA13-032A.htmlthird-party-advisory, x_refsource_CERT
http://seclists.org/fulldisclosure/2013/Jan/142mailing-list, x_refsource_FULLDISC
http://www.kb.cert.org/vuls/id/858729third-party-advisory, x_refsource_CERT-VN
http://rhn.redhat.com/errata/RHSA-2013-0237.htmlvendor-advisory, x_refsource_REDHAT
http://marc.info/?l=bugtraq&m=136439120408139&w=2vendor-advisory, x_refsource_HP
http://rhn.redhat.com/errata/RHSA-2013-0247.htmlvendor-advisory, x_refsource_REDHAT
http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/x_refsource_MISC
http://seclists.org/fulldisclosure/2013/Jan/195mailing-list, x_refsource_FULLDISC
http://marc.info/?l=bugtraq&m=136733161405818&w=2vendor-advisory, x_refsource_HP
http://marc.info/?l=bugtraq&m=136439120408139&w=2vendor-advisory, x_refsource_HP
http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53x_refsource_MISC
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.htmlvendor-advisory, x_refsource_SUSE
http://www.securityfocus.com/archive/1/525387/30/0/threadedmailing-list, x_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579vdb-entry, signature, x_refsource_OVAL
http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.htmlx_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=136733161405818&w=2vendor-advisory, x_refsource_HP
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:25:10.309Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:19418",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418"
          },
          {
            "name": "GLSA-201406-32",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
          },
          {
            "name": "MDVSA-2013:095",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"
          },
          {
            "name": "TA13-032A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA13-032A.html"
          },
          {
            "name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2013/Jan/142"
          },
          {
            "name": "VU#858729",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/858729"
          },
          {
            "name": "RHSA-2013:0237",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0237.html"
          },
          {
            "name": "HPSBUX02857",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
          },
          {
            "name": "RHSA-2013:0247",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0247.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"
          },
          {
            "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2013/Jan/195"
          },
          {
            "name": "HPSBMU02874",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
          },
          {
            "name": "SSRT101103",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"
          },
          {
            "name": "openSUSE-SU-2013:0377",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html"
          },
          {
            "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:16579",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html"
          },
          {
            "name": "SSRT101184",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2013-0431",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-10T19:50:20.690678Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-05-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-0431"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-10T19:50:49.346Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-01-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka \"Issue 52,\" a different vulnerability than CVE-2013-1490."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:19418",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418"
        },
        {
          "name": "GLSA-201406-32",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
        },
        {
          "name": "MDVSA-2013:095",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"
        },
        {
          "name": "TA13-032A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA13-032A.html"
        },
        {
          "name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2013/Jan/142"
        },
        {
          "name": "VU#858729",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/858729"
        },
        {
          "name": "RHSA-2013:0237",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0237.html"
        },
        {
          "name": "HPSBUX02857",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
        },
        {
          "name": "RHSA-2013:0247",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0247.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"
        },
        {
          "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2013/Jan/195"
        },
        {
          "name": "HPSBMU02874",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
        },
        {
          "name": "SSRT101103",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"
        },
        {
          "name": "openSUSE-SU-2013:0377",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html"
        },
        {
          "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:16579",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html"
        },
        {
          "name": "SSRT101184",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2013-0431",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka \"Issue 52,\" a different vulnerability than CVE-2013-1490."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "oval:org.mitre.oval:def:19418",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19418"
            },
            {
              "name": "GLSA-201406-32",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
            },
            {
              "name": "MDVSA-2013:095",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
            },
            {
              "name": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717",
              "refsource": "MISC",
              "url": "http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717"
            },
            {
              "name": "TA13-032A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA13-032A.html"
            },
            {
              "name": "20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2013/Jan/142"
            },
            {
              "name": "VU#858729",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/858729"
            },
            {
              "name": "RHSA-2013:0237",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0237.html"
            },
            {
              "name": "HPSBUX02857",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
            },
            {
              "name": "RHSA-2013:0247",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0247.html"
            },
            {
              "name": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/",
              "refsource": "MISC",
              "url": "http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/"
            },
            {
              "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2013/Jan/195"
            },
            {
              "name": "HPSBMU02874",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
            },
            {
              "name": "SSRT101103",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
            },
            {
              "name": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53",
              "refsource": "MISC",
              "url": "http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53"
            },
            {
              "name": "openSUSE-SU-2013:0377",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00001.html"
            },
            {
              "name": "20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/525387/30/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:16579",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16579"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html"
            },
            {
              "name": "SSRT101184",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
            },
            {
              "name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056",
              "refsource": "CONFIRM",
              "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2013-0431",
    "datePublished": "2013-01-31T14:10:00.000Z",
    "dateReserved": "2012-12-07T00:00:00.000Z",
    "dateUpdated": "2025-02-10T19:50:49.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14581 (GCVE-0-2020-14581)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:37
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:41.868Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14581",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:58:50.930753Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:37:38.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:46",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14581",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14581",
    "datePublished": "2020-07-15T17:34:28",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:37:38.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21294 (GCVE-0-2022-21294)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.305Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:44.533Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21294",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21294",
    "datePublished": "2022-01-19T11:23:34",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14583 (GCVE-0-2020-14583)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:37
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:41.875Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:55:01.769871Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:37:10.873Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:25",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14583",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "8.3",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14583",
    "datePublished": "2020-07-15T17:34:28",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:37:10.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21282 (GCVE-0-2022-21282)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:54.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:29.329Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21282",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21282",
    "datePublished": "2022-01-19T11:23:11",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:54.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14797 (GCVE-0-2020-14797)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:21
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:00:50.808Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:18.443567Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:21:26.609Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:11",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14797",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14797",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:21:26.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2757 (GCVE-0-2020-2757)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:41
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.624Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2757",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:00:05.581818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:41:34.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:31",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2757",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2757",
    "datePublished": "2020-04-15T13:29:44",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:41:34.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-0169 (GCVE-0-2013-0169)
Vulnerability from cvelistv5
Published
2013-02-08 19:00
Modified
2024-08-06 14:18
Severity ?
CWE
  • n/a
Summary
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
References
https://lists.debian.org/debian-lts-announce/2018/09/msg00029.htmlmailing-list, x_refsource_MLIST
http://www.matrixssl.org/news.htmlx_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0587.htmlvendor-advisory, x_refsource_REDHAT
http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x_refsource_GENTOO
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.htmlvendor-advisory, x_refsource_FEDORA
http://www.us-cert.gov/cas/techalerts/TA13-051A.htmlthird-party-advisory, x_refsource_CERT
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016vdb-entry, signature, x_refsource_OVAL
http://www.mandriva.com/security/advisories?name=MDVSA-2013:095vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/55139third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/55322third-party-advisory, x_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608vdb-entry, signature, x_refsource_OVAL
http://www.openssl.org/news/secadv_20130204.txtx_refsource_CONFIRM
http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/x_refsource_MISC
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084x_refsource_CONFIRM
http://www.isg.rhul.ac.uk/tls/TLStiming.pdfx_refsource_MISC
http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.htmlx_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.htmlvendor-advisory, x_refsource_SUSE
http://www.debian.org/security/2013/dsa-2622vendor-advisory, x_refsource_DEBIAN
http://www.securityfocus.com/bid/57778vdb-entry, x_refsource_BID
http://www-01.ibm.com/support/docview.wss?uid=swg21644047x_refsource_CONFIRM
http://openwall.com/lists/oss-security/2013/02/05/24mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2013-1455.htmlvendor-advisory, x_refsource_REDHAT
http://secunia.com/advisories/55351third-party-advisory, x_refsource_SECUNIA
http://marc.info/?l=bugtraq&m=136396549913849&w=2vendor-advisory, x_refsource_HP
https://puppet.com/security/cve/cve-2013-0169x_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=137545771702053&w=2vendor-advisory, x_refsource_HP
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.htmlvendor-advisory, x_refsource_SUSE
http://marc.info/?l=bugtraq&m=136432043316835&w=2vendor-advisory, x_refsource_HP
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.htmlvendor-advisory, x_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2013-0833.htmlvendor-advisory, x_refsource_REDHAT
http://www.ubuntu.com/usn/USN-1735-1vendor-advisory, x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.htmlvendor-advisory, x_refsource_SUSE
http://marc.info/?l=bugtraq&m=136439120408139&w=2vendor-advisory, x_refsource_HP
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001x_refsource_CONFIRM
http://secunia.com/advisories/53623third-party-advisory, x_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.htmlvendor-advisory, x_refsource_SUSE
http://www.kb.cert.org/vuls/id/737740third-party-advisory, x_refsource_CERT-VN
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424vdb-entry, signature, x_refsource_OVAL
http://marc.info/?l=bugtraq&m=137545771702053&w=2vendor-advisory, x_refsource_HP
http://www.debian.org/security/2013/dsa-2621vendor-advisory, x_refsource_DEBIAN
http://rhn.redhat.com/errata/RHSA-2013-0783.htmlvendor-advisory, x_refsource_REDHAT
http://marc.info/?l=bugtraq&m=136733161405818&w=2vendor-advisory, x_refsource_HP
http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.htmlvendor-advisory, x_refsource_APPLE
http://secunia.com/advisories/55108third-party-advisory, x_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2013-0782.htmlvendor-advisory, x_refsource_REDHAT
http://marc.info/?l=bugtraq&m=136432043316835&w=2vendor-advisory, x_refsource_HP
http://marc.info/?l=bugtraq&m=136439120408139&w=2vendor-advisory, x_refsource_HP
http://marc.info/?l=bugtraq&m=136396549913849&w=2vendor-advisory, x_refsource_HP
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.htmlvendor-advisory, x_refsource_SUSE
https://polarssl.org/tech-updates/releases/polarssl-1.2.5-releasedx_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540vdb-entry, signature, x_refsource_OVAL
http://www.securitytracker.com/id/1029190vdb-entry, x_refsource_SECTRACK
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841vdb-entry, signature, x_refsource_OVAL
http://www.splunk.com/view/SP-CAAAHXGx_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-1456.htmlvendor-advisory, x_refsource_REDHAT
http://support.apple.com/kb/HT5880x_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=136733161405818&w=2vendor-advisory, x_refsource_HP
http://secunia.com/advisories/55350third-party-advisory, x_refsource_SECUNIA
https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdfx_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:18:09.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.matrixssl.org/news.html"
          },
          {
            "name": "RHSA-2013:0587",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html"
          },
          {
            "name": "GLSA-201406-32",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
          },
          {
            "name": "FEDORA-2013-4403",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html"
          },
          {
            "name": "TA13-051A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html"
          },
          {
            "name": "oval:org.mitre.oval:def:19016",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016"
          },
          {
            "name": "MDVSA-2013:095",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
          },
          {
            "name": "55139",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55139"
          },
          {
            "name": "55322",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55322"
          },
          {
            "name": "oval:org.mitre.oval:def:19608",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.openssl.org/news/secadv_20130204.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html"
          },
          {
            "name": "openSUSE-SU-2013:0378",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html"
          },
          {
            "name": "DSA-2622",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2013/dsa-2622"
          },
          {
            "name": "57778",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/57778"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
          },
          {
            "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://openwall.com/lists/oss-security/2013/02/05/24"
          },
          {
            "name": "RHSA-2013:1455",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
          },
          {
            "name": "55351",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55351"
          },
          {
            "name": "HPSBUX02856",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/cve-2013-0169"
          },
          {
            "name": "SSRT101289",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
          },
          {
            "name": "openSUSE-SU-2016:0640",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
          },
          {
            "name": "SSRT101108",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
          },
          {
            "name": "SUSE-SU-2013:0328",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html"
          },
          {
            "name": "RHSA-2013:0833",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html"
          },
          {
            "name": "USN-1735-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1735-1"
          },
          {
            "name": "SUSE-SU-2014:0320",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html"
          },
          {
            "name": "HPSBUX02857",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001"
          },
          {
            "name": "53623",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/53623"
          },
          {
            "name": "SUSE-SU-2013:0701",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html"
          },
          {
            "name": "VU#737740",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/737740"
          },
          {
            "name": "oval:org.mitre.oval:def:19424",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424"
          },
          {
            "name": "HPSBUX02909",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
          },
          {
            "name": "DSA-2621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2013/dsa-2621"
          },
          {
            "name": "RHSA-2013:0783",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html"
          },
          {
            "name": "HPSBMU02874",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
          },
          {
            "name": "APPLE-SA-2013-09-12-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html"
          },
          {
            "name": "55108",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55108"
          },
          {
            "name": "RHSA-2013:0782",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html"
          },
          {
            "name": "HPSBOV02852",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
          },
          {
            "name": "SSRT101103",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
          },
          {
            "name": "SSRT101104",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
          },
          {
            "name": "SUSE-SU-2015:0578",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
          },
          {
            "name": "openSUSE-SU-2013:0375",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released"
          },
          {
            "name": "oval:org.mitre.oval:def:19540",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540"
          },
          {
            "name": "1029190",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1029190"
          },
          {
            "name": "oval:org.mitre.oval:def:18841",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.splunk.com/view/SP-CAAAHXG"
          },
          {
            "name": "RHSA-2013:1456",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT5880"
          },
          {
            "name": "SSRT101184",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
          },
          {
            "name": "55350",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/55350"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-02-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-09T12:06:03",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.matrixssl.org/news.html"
        },
        {
          "name": "RHSA-2013:0587",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html"
        },
        {
          "name": "GLSA-201406-32",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
        },
        {
          "name": "FEDORA-2013-4403",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html"
        },
        {
          "name": "TA13-051A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html"
        },
        {
          "name": "oval:org.mitre.oval:def:19016",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016"
        },
        {
          "name": "MDVSA-2013:095",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
        },
        {
          "name": "55139",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55139"
        },
        {
          "name": "55322",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55322"
        },
        {
          "name": "oval:org.mitre.oval:def:19608",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.openssl.org/news/secadv_20130204.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html"
        },
        {
          "name": "openSUSE-SU-2013:0378",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html"
        },
        {
          "name": "DSA-2622",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2013/dsa-2622"
        },
        {
          "name": "57778",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/57778"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
        },
        {
          "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://openwall.com/lists/oss-security/2013/02/05/24"
        },
        {
          "name": "RHSA-2013:1455",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
        },
        {
          "name": "55351",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55351"
        },
        {
          "name": "HPSBUX02856",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/cve-2013-0169"
        },
        {
          "name": "SSRT101289",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
        },
        {
          "name": "openSUSE-SU-2016:0640",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
        },
        {
          "name": "SSRT101108",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
        },
        {
          "name": "SUSE-SU-2013:0328",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html"
        },
        {
          "name": "RHSA-2013:0833",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html"
        },
        {
          "name": "USN-1735-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1735-1"
        },
        {
          "name": "SUSE-SU-2014:0320",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html"
        },
        {
          "name": "HPSBUX02857",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001"
        },
        {
          "name": "53623",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/53623"
        },
        {
          "name": "SUSE-SU-2013:0701",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html"
        },
        {
          "name": "VU#737740",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/737740"
        },
        {
          "name": "oval:org.mitre.oval:def:19424",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424"
        },
        {
          "name": "HPSBUX02909",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
        },
        {
          "name": "DSA-2621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2013/dsa-2621"
        },
        {
          "name": "RHSA-2013:0783",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html"
        },
        {
          "name": "HPSBMU02874",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
        },
        {
          "name": "APPLE-SA-2013-09-12-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html"
        },
        {
          "name": "55108",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55108"
        },
        {
          "name": "RHSA-2013:0782",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html"
        },
        {
          "name": "HPSBOV02852",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
        },
        {
          "name": "SSRT101103",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
        },
        {
          "name": "SSRT101104",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
        },
        {
          "name": "SUSE-SU-2015:0578",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
        },
        {
          "name": "openSUSE-SU-2013:0375",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released"
        },
        {
          "name": "oval:org.mitre.oval:def:19540",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540"
        },
        {
          "name": "1029190",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1029190"
        },
        {
          "name": "oval:org.mitre.oval:def:18841",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.splunk.com/view/SP-CAAAHXG"
        },
        {
          "name": "RHSA-2013:1456",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT5880"
        },
        {
          "name": "SSRT101184",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
        },
        {
          "name": "55350",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/55350"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2013-0169",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the \"Lucky Thirteen\" issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html"
            },
            {
              "name": "http://www.matrixssl.org/news.html",
              "refsource": "CONFIRM",
              "url": "http://www.matrixssl.org/news.html"
            },
            {
              "name": "RHSA-2013:0587",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0587.html"
            },
            {
              "name": "GLSA-201406-32",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
            },
            {
              "name": "FEDORA-2013-4403",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html"
            },
            {
              "name": "TA13-051A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA13-051A.html"
            },
            {
              "name": "oval:org.mitre.oval:def:19016",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19016"
            },
            {
              "name": "MDVSA-2013:095",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
            },
            {
              "name": "55139",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/55139"
            },
            {
              "name": "55322",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/55322"
            },
            {
              "name": "oval:org.mitre.oval:def:19608",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19608"
            },
            {
              "name": "http://www.openssl.org/news/secadv_20130204.txt",
              "refsource": "CONFIRM",
              "url": "http://www.openssl.org/news/secadv_20130204.txt"
            },
            {
              "name": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/",
              "refsource": "MISC",
              "url": "http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/"
            },
            {
              "name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084",
              "refsource": "CONFIRM",
              "url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084"
            },
            {
              "name": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf",
              "refsource": "MISC",
              "url": "http://www.isg.rhul.ac.uk/tls/TLStiming.pdf"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html"
            },
            {
              "name": "openSUSE-SU-2013:0378",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00002.html"
            },
            {
              "name": "DSA-2622",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2013/dsa-2622"
            },
            {
              "name": "57778",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/57778"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644047"
            },
            {
              "name": "[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations",
              "refsource": "MLIST",
              "url": "http://openwall.com/lists/oss-security/2013/02/05/24"
            },
            {
              "name": "RHSA-2013:1455",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1455.html"
            },
            {
              "name": "55351",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/55351"
            },
            {
              "name": "HPSBUX02856",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
            },
            {
              "name": "https://puppet.com/security/cve/cve-2013-0169",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/cve-2013-0169"
            },
            {
              "name": "SSRT101289",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
            },
            {
              "name": "openSUSE-SU-2016:0640",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html"
            },
            {
              "name": "SSRT101108",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
            },
            {
              "name": "SUSE-SU-2013:0328",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html"
            },
            {
              "name": "RHSA-2013:0833",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0833.html"
            },
            {
              "name": "USN-1735-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1735-1"
            },
            {
              "name": "SUSE-SU-2014:0320",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html"
            },
            {
              "name": "HPSBUX02857",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-c03883001"
            },
            {
              "name": "53623",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/53623"
            },
            {
              "name": "SUSE-SU-2013:0701",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00020.html"
            },
            {
              "name": "VU#737740",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/737740"
            },
            {
              "name": "oval:org.mitre.oval:def:19424",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19424"
            },
            {
              "name": "HPSBUX02909",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=137545771702053\u0026w=2"
            },
            {
              "name": "DSA-2621",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2013/dsa-2621"
            },
            {
              "name": "RHSA-2013:0783",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0783.html"
            },
            {
              "name": "HPSBMU02874",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
            },
            {
              "name": "APPLE-SA-2013-09-12-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html"
            },
            {
              "name": "55108",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/55108"
            },
            {
              "name": "RHSA-2013:0782",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0782.html"
            },
            {
              "name": "HPSBOV02852",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136432043316835\u0026w=2"
            },
            {
              "name": "SSRT101103",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136439120408139\u0026w=2"
            },
            {
              "name": "SSRT101104",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136396549913849\u0026w=2"
            },
            {
              "name": "SUSE-SU-2015:0578",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html"
            },
            {
              "name": "openSUSE-SU-2013:0375",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html"
            },
            {
              "name": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released",
              "refsource": "CONFIRM",
              "url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released"
            },
            {
              "name": "oval:org.mitre.oval:def:19540",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19540"
            },
            {
              "name": "1029190",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1029190"
            },
            {
              "name": "oval:org.mitre.oval:def:18841",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18841"
            },
            {
              "name": "http://www.splunk.com/view/SP-CAAAHXG",
              "refsource": "CONFIRM",
              "url": "http://www.splunk.com/view/SP-CAAAHXG"
            },
            {
              "name": "RHSA-2013:1456",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1456.html"
            },
            {
              "name": "http://support.apple.com/kb/HT5880",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT5880"
            },
            {
              "name": "SSRT101184",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=136733161405818\u0026w=2"
            },
            {
              "name": "55350",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/55350"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-0169",
    "datePublished": "2013-02-08T19:00:00",
    "dateReserved": "2012-12-06T00:00:00",
    "dateUpdated": "2024-08-06T14:18:09.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2659 (GCVE-0-2020-2659)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 15:58
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2020:0465vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0470vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0467vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0469vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0468vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.920Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "RHSA-2020:0465",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0465"
          },
          {
            "name": "RHSA-2020:0470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0470"
          },
          {
            "name": "RHSA-2020:0467",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0467"
          },
          {
            "name": "RHSA-2020:0469",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0469"
          },
          {
            "name": "RHSA-2020:0468",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0468"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:02:31.237374Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:58:31.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:19",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "RHSA-2020:0465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0465"
        },
        {
          "name": "RHSA-2020:0470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0470"
        },
        {
          "name": "RHSA-2020:0467",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0467"
        },
        {
          "name": "RHSA-2020:0469",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0469"
        },
        {
          "name": "RHSA-2020:0468",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0468"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2659",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "RHSA-2020:0465",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0465"
            },
            {
              "name": "RHSA-2020:0470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0470"
            },
            {
              "name": "RHSA-2020:0467",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0467"
            },
            {
              "name": "RHSA-2020:0469",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0469"
            },
            {
              "name": "RHSA-2020:0468",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0468"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2659",
    "datePublished": "2020-01-15T16:34:05",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:58:31.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35586 (GCVE-0-2021-35586)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-09-25 19:33
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://www.debian.org/security/2021/dsa-5012vendor-advisory
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.246Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T19:32:02.914714Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T19:33:20.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:08:03.822691",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35586",
    "datePublished": "2021-10-20T10:50:30",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-09-25T19:33:20.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14792 (GCVE-0-2020-14792)
Vulnerability from cvelistv5
Published
2020-10-21 14:04
Modified
2024-09-26 20:22
Severity ?
4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20201023-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4779vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlmailing-list, x_refsource_MLIST
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE: 7u271
Version: 8u261
Version: 11.0.8
Version: 15; Java SE Embedded: 8u261
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:43.278Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
          },
          {
            "name": "DSA-4779",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4779"
          },
          {
            "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14792",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T19:44:26.978320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T20:22:17.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u271"
            },
            {
              "status": "affected",
              "version": "8u261"
            },
            {
              "status": "affected",
              "version": "11.0.8"
            },
            {
              "status": "affected",
              "version": "15; Java SE Embedded: 8u261"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:08",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
        },
        {
          "name": "DSA-4779",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4779"
        },
        {
          "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14792",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u271"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "8u261"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "11.0.8"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "15; Java SE Embedded: 8u261"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.2",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201023-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
            },
            {
              "name": "DSA-4779",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4779"
            },
            {
              "name": "[debian-lts-announce] 20201030 [SECURITY] [DLA 2412-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14792",
    "datePublished": "2020-10-21T14:04:25",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-26T20:22:17.546Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-2405 (GCVE-0-2014-2405)
Vulnerability from cvelistv5
Published
2014-05-14 00:00
Modified
2024-08-06 10:14
Severity ?
CWE
  • n/a
Summary
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.
References
http://www.ubuntu.com/usn/USN-2191-1vendor-advisory, x_refsource_UBUNTU
http://www.debian.org/security/2014/dsa-2912vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/58415third-party-advisory, x_refsource_SECUNIA
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:26.232Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-2191-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2191-1"
          },
          {
            "name": "DSA-2912",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-2912"
          },
          {
            "name": "58415",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/58415"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-05-13T23:57:00",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "USN-2191-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2191-1"
        },
        {
          "name": "DSA-2912",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-2912"
        },
        {
          "name": "58415",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/58415"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2014-2405",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-2191-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2191-1"
            },
            {
              "name": "DSA-2912",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-2912"
            },
            {
              "name": "58415",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/58415"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2014-2405",
    "datePublished": "2014-05-14T00:00:00",
    "dateReserved": "2014-03-13T00:00:00",
    "dateUpdated": "2024-08-06T10:14:26.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2369 (GCVE-0-2021-2369)
Vulnerability from cvelistv5
Published
2021-07-20 00:00
Modified
2024-09-26 14:08
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujul2021.html
https://www.debian.org/security/2021/dsa-4946vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.htmlmailing-list
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20210723-0002/
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1982879
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u301
Version: Java SE:8u291
Version: Java SE:11.0.11
Version: Java SE:16.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.2
Version: Oracle GraalVM Enterprise Edition:21.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:38:57.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "name": "DSA-4946",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4946"
          },
          {
            "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982879"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T13:52:28.173631Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T14:08:00.251Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u301"
            },
            {
              "status": "affected",
              "version": "Java SE:8u291"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.11"
            },
            {
              "status": "affected",
              "version": "Java SE:16.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-03T00:00:00",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "name": "DSA-4946",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4946"
        },
        {
          "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1982879"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2369",
    "datePublished": "2021-07-20T00:00:00",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T14:08:00.251Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2583 (GCVE-0-2020-2583)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 16:31
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4605vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Jan/24mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://access.redhat.com/errata/RHSA-2020:0465vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0470vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0467vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0469vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0468vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://kc.mcafee.com/corporate/index?page=content&id=SB10315x_refsource_CONFIRM
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
Version: Java SE Embedded: 8u231
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:54.723Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "DSA-4605",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4605"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/24"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "RHSA-2020:0465",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0465"
          },
          {
            "name": "RHSA-2020:0470",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0470"
          },
          {
            "name": "RHSA-2020:0467",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0467"
          },
          {
            "name": "RHSA-2020:0469",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0469"
          },
          {
            "name": "RHSA-2020:0468",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0468"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:04:53.482302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T16:31:41.183Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u231"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:16",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "DSA-4605",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4605"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/24"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "RHSA-2020:0465",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0465"
        },
        {
          "name": "RHSA-2020:0470",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0470"
        },
        {
          "name": "RHSA-2020:0467",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0467"
        },
        {
          "name": "RHSA-2020:0469",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0469"
        },
        {
          "name": "RHSA-2020:0468",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0468"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2583",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u231"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "DSA-4605",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4605"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/24"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "RHSA-2020:0465",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0465"
            },
            {
              "name": "RHSA-2020:0470",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0470"
            },
            {
              "name": "RHSA-2020:0467",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0467"
            },
            {
              "name": "RHSA-2020:0469",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0469"
            },
            {
              "name": "RHSA-2020:0468",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0468"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2583",
    "datePublished": "2020-01-15T16:34:02",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T16:31:41.183Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-0462 (GCVE-0-2014-0462)
Vulnerability from cvelistv5
Published
2014-05-14 00:00
Modified
2024-08-06 09:13
Severity ?
CWE
  • n/a
Summary
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.
References
http://www.ubuntu.com/usn/USN-2191-1vendor-advisory, x_refsource_UBUNTU
http://www.debian.org/security/2014/dsa-2912vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/58415third-party-advisory, x_refsource_SECUNIA
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:13:10.733Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-2191-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2191-1"
          },
          {
            "name": "DSA-2912",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-2912"
          },
          {
            "name": "58415",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/58415"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-04-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-05-13T23:57:00",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "USN-2191-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2191-1"
        },
        {
          "name": "DSA-2912",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-2912"
        },
        {
          "name": "58415",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/58415"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2014-0462",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-2191-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2191-1"
            },
            {
              "name": "DSA-2912",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-2912"
            },
            {
              "name": "58415",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/58415"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2014-0462",
    "datePublished": "2014-05-14T00:00:00",
    "dateReserved": "2013-12-12T00:00:00",
    "dateUpdated": "2024-08-06T09:13:10.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-2388 (GCVE-0-2021-2388)
Vulnerability from cvelistv5
Published
2021-07-20 22:44
Modified
2024-09-26 14:00
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
https://www.oracle.com/security-alerts/cpujul2021.htmlx_refsource_MISC
https://www.debian.org/security/2021/dsa-4946vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2021/08/msg00011.htmlmailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20210723-0002/x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:8u291
Version: Java SE:11.0.11
Version: Java SE:16.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.2
Version: Oracle GraalVM Enterprise Edition:21.1.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:38:57.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
          },
          {
            "name": "DSA-4946",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4946"
          },
          {
            "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-2388",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-26T13:58:23.852089Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-26T14:00:55.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:8u291"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.11"
            },
            {
              "status": "affected",
              "version": "Java SE:16.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.2"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:06:50",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
        },
        {
          "name": "DSA-4946",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4946"
        },
        {
          "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-2388",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u291"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.11"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:16.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.2"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
            },
            {
              "name": "DSA-4946",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4946"
            },
            {
              "name": "[debian-lts-announce] 20210809 [SECURITY] [DLA 2737-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210723-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-2388",
    "datePublished": "2021-07-20T22:44:03",
    "dateReserved": "2020-12-09T00:00:00",
    "dateUpdated": "2024-09-26T14:00:55.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14593 (GCVE-0-2020-14593)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:35
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:53:42.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:58:35.278922Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:35:33.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:43",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14593",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "7.4",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14593",
    "datePublished": "2020-07-15T17:34:29",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:35:33.800Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14578 (GCVE-0-2020-14578)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:38
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u261, 8u251
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:34.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:58:55.382224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:38:05.115Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u261, 8u251"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:28",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u261, 8u251"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14578",
    "datePublished": "2020-07-15T17:34:28",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:38:05.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-14556 (GCVE-0-2020-14556)
Vulnerability from cvelistv5
Published
2020-07-15 17:34
Modified
2024-09-27 18:41
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujul2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200717-0005/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/vendor-advisory, x_refsource_FEDORA
https://usn.ubuntu.com/4433-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4734vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlvendor-advisory, x_refsource_SUSE
https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlmailing-list, x_refsource_MLIST
https://usn.ubuntu.com/4453-1/vendor-advisory, x_refsource_UBUNTU
https://security.gentoo.org/glsa/202008-24vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 8u251, 11.0.7, 14.0.1
Version: Java SE Embedded: 8u251
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:46:34.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
          },
          {
            "name": "FEDORA-2020-e418151dc3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
          },
          {
            "name": "FEDORA-2020-5d0b4a2b5b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
          },
          {
            "name": "USN-4433-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4433-1/"
          },
          {
            "name": "DSA-4734",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4734"
          },
          {
            "name": "FEDORA-2020-508df53719",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
          },
          {
            "name": "FEDORA-2020-93cc9c3ef2",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
          },
          {
            "name": "openSUSE-SU-2020:1175",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
          },
          {
            "name": "openSUSE-SU-2020:1191",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
          },
          {
            "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
          },
          {
            "name": "USN-4453-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4453-1/"
          },
          {
            "name": "GLSA-202008-24",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202008-24"
          },
          {
            "name": "openSUSE-SU-2020:1893",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-14556",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T17:59:18.810625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T18:41:03.969Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 8u251, 11.0.7, 14.0.1"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u251"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:26",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
        },
        {
          "name": "FEDORA-2020-e418151dc3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
        },
        {
          "name": "FEDORA-2020-5d0b4a2b5b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
        },
        {
          "name": "USN-4433-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4433-1/"
        },
        {
          "name": "DSA-4734",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4734"
        },
        {
          "name": "FEDORA-2020-508df53719",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
        },
        {
          "name": "FEDORA-2020-93cc9c3ef2",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
        },
        {
          "name": "openSUSE-SU-2020:1175",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
        },
        {
          "name": "openSUSE-SU-2020:1191",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
        },
        {
          "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
        },
        {
          "name": "USN-4453-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4453-1/"
        },
        {
          "name": "GLSA-202008-24",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202008-24"
        },
        {
          "name": "openSUSE-SU-2020:1893",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-14556",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 8u251, 11.0.7, 14.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u251"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.8",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as  unauthorized read access to a subset of Java SE, Java SE Embedded accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200717-0005/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
            },
            {
              "name": "FEDORA-2020-e418151dc3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
            },
            {
              "name": "FEDORA-2020-5d0b4a2b5b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
            },
            {
              "name": "USN-4433-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4433-1/"
            },
            {
              "name": "DSA-4734",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4734"
            },
            {
              "name": "FEDORA-2020-508df53719",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
            },
            {
              "name": "FEDORA-2020-93cc9c3ef2",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
            },
            {
              "name": "openSUSE-SU-2020:1175",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
            },
            {
              "name": "openSUSE-SU-2020:1191",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
            },
            {
              "name": "[debian-lts-announce] 20200813 [SECURITY] [DLA 2325-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
            },
            {
              "name": "USN-4453-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4453-1/"
            },
            {
              "name": "GLSA-202008-24",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202008-24"
            },
            {
              "name": "openSUSE-SU-2020:1893",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-14556",
    "datePublished": "2020-07-15T17:34:27",
    "dateReserved": "2020-06-19T00:00:00",
    "dateUpdated": "2024-09-27T18:41:03.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2781 (GCVE-0-2020-2781)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:05
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10318x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:57:27.440297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:05:39.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:35",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2781",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10318"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2781",
    "datePublished": "2020-04-15T13:29:46",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:05:39.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35550 (GCVE-0-2021-35550)
Vulnerability from cvelistv5
Published
2021-10-20 10:49
Modified
2024-08-04 00:40
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T14:29:28.454778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T14:30:11.763Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:58.485392",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35550",
    "datePublished": "2021-10-20T10:49:59",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:46.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21360 (GCVE-0-2022-21360)
Vulnerability from cvelistv5
Published
2022-01-19 11:25
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:16.462Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21360",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21360",
    "datePublished": "2022-01-19T11:25:37",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2767 (GCVE-0-2020-2767)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:40
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 11.0.6, 14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.632Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T14:59:51.390149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:40:08.657Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 11.0.6, 14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE accessible data as well as  unauthorized read access to a subset of Java SE accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-06-02T14:06:17",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2767",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 11.0.6, 14"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "4.8",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Java SE accessible data as well as  unauthorized read access to a subset of Java SE accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2767",
    "datePublished": "2020-04-15T13:29:45",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:40:08.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21938 (GCVE-0-2023-21938)
Vulnerability from cvelistv5
Published
2023-04-18 19:54
Modified
2025-02-13 16:40
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpuapr2023.htmlvendor-advisory
https://www.couchbase.com/alerts/
https://security.netapp.com/advisory/ntap-20230427-0008/
https://www.debian.org/security/2023/dsa-5430
https://www.debian.org/security/2023/dsa-5478
https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:8u361
Version: Oracle Java SE:8u361-perf
Version: Oracle Java SE:11.0.18
Version: Oracle Java SE:17.0.6
Version: Oracle Java SE:20
Version: Oracle GraalVM Enterprise Edition:20.3.8
Version: Oracle GraalVM Enterprise Edition:21.3.4
Version: Oracle GraalVM Enterprise Edition:22.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:59:27.256Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Oracle Advisory",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.couchbase.com/alerts/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5430"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5478"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21938",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-16T14:39:35.865049Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-16T15:17:40.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u361-perf"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.18"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.6"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:20"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.8"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:22.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and  22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en-US"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:07:50.001Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "name": "Oracle Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
        },
        {
          "url": "https://www.couchbase.com/alerts/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5430"
        },
        {
          "url": "https://www.debian.org/security/2023/dsa-5478"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2023-21938",
    "datePublished": "2023-04-18T19:54:25.948Z",
    "dateReserved": "2022-12-17T19:26:00.722Z",
    "dateUpdated": "2025-02-13T16:40:27.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2654 (GCVE-0-2020-2654)
Vulnerability from cvelistv5
Published
2020-01-15 16:34
Modified
2024-09-30 15:59
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE.
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2020.htmlx_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0128vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0122vendor-advisory, x_refsource_REDHAT
https://www.debian.org/security/2020/dsa-4605vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Jan/24mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0157vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0196vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20200122-0003/x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlvendor-advisory, x_refsource_SUSE
https://access.redhat.com/errata/RHSA-2020:0232vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0231vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0202vendor-advisory, x_refsource_REDHAT
https://usn.ubuntu.com/4257-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4621vendor-advisory, x_refsource_DEBIAN
https://seclists.org/bugtraq/2020/Feb/22mailing-list, x_refsource_BUGTRAQ
https://access.redhat.com/errata/RHSA-2020:0541vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0632vendor-advisory, x_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlmailing-list, x_refsource_MLIST
https://kc.mcafee.com/corporate/index?page=content&id=SB10315x_refsource_CONFIRM
https://security.gentoo.org/glsa/202101-19vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u241, 8u231, 11.0.5, 13.0.1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:09:55.025Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "name": "RHSA-2020:0128",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0128"
          },
          {
            "name": "RHSA-2020:0122",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0122"
          },
          {
            "name": "DSA-4605",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4605"
          },
          {
            "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Jan/24"
          },
          {
            "name": "RHSA-2020:0157",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0157"
          },
          {
            "name": "RHSA-2020:0196",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0196"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
          },
          {
            "name": "openSUSE-SU-2020:0113",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
          },
          {
            "name": "openSUSE-SU-2020:0147",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
          },
          {
            "name": "RHSA-2020:0232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0232"
          },
          {
            "name": "RHSA-2020:0231",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0231"
          },
          {
            "name": "RHSA-2020:0202",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0202"
          },
          {
            "name": "USN-4257-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4257-1/"
          },
          {
            "name": "DSA-4621",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4621"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/22"
          },
          {
            "name": "RHSA-2020:0541",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0541"
          },
          {
            "name": "RHSA-2020:0632",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0632"
          },
          {
            "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
          },
          {
            "name": "GLSA-202101-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:02:46.145962Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:59:18.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T02:06:12",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "name": "RHSA-2020:0128",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0128"
        },
        {
          "name": "RHSA-2020:0122",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0122"
        },
        {
          "name": "DSA-4605",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4605"
        },
        {
          "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Jan/24"
        },
        {
          "name": "RHSA-2020:0157",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0157"
        },
        {
          "name": "RHSA-2020:0196",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0196"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
        },
        {
          "name": "openSUSE-SU-2020:0113",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
        },
        {
          "name": "openSUSE-SU-2020:0147",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
        },
        {
          "name": "RHSA-2020:0232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0232"
        },
        {
          "name": "RHSA-2020:0231",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0231"
        },
        {
          "name": "RHSA-2020:0202",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0202"
        },
        {
          "name": "USN-4257-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4257-1/"
        },
        {
          "name": "DSA-4621",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4621"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/22"
        },
        {
          "name": "RHSA-2020:0541",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0541"
        },
        {
          "name": "RHSA-2020:0632",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0632"
        },
        {
          "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
        },
        {
          "name": "GLSA-202101-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-19"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2654",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u241, 8u231, 11.0.5, 13.0.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
            },
            {
              "name": "RHSA-2020:0128",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0128"
            },
            {
              "name": "RHSA-2020:0122",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0122"
            },
            {
              "name": "DSA-4605",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4605"
            },
            {
              "name": "20200120 [SECURITY] [DSA 4605-1] openjdk-11 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Jan/24"
            },
            {
              "name": "RHSA-2020:0157",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0157"
            },
            {
              "name": "RHSA-2020:0196",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0196"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200122-0003/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
            },
            {
              "name": "openSUSE-SU-2020:0113",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
            },
            {
              "name": "openSUSE-SU-2020:0147",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
            },
            {
              "name": "RHSA-2020:0232",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0232"
            },
            {
              "name": "RHSA-2020:0231",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0231"
            },
            {
              "name": "RHSA-2020:0202",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0202"
            },
            {
              "name": "USN-4257-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4257-1/"
            },
            {
              "name": "DSA-4621",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4621"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/22"
            },
            {
              "name": "RHSA-2020:0541",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0541"
            },
            {
              "name": "RHSA-2020:0632",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0632"
            },
            {
              "name": "[debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
            },
            {
              "name": "GLSA-202101-19",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-19"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2654",
    "datePublished": "2020-01-15T16:34:05",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:59:18.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21296 (GCVE-0-2022-21296)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.557Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:33.516Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21296",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21296",
    "datePublished": "2022-01-19T11:23:38",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21341 (GCVE-0-2022-21341)
Vulnerability from cvelistv5
Published
2022-01-19 11:25
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:53.724Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21341",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21341",
    "datePublished": "2022-01-19T11:25:02",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2755 (GCVE-0-2020-2755)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:41
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.660Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2755",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:00:10.185809Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:41:54.140Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:51",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2755",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2755",
    "datePublished": "2020-04-15T13:29:44",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:41:54.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2013-2461 (GCVE-0-2013-2461)
Vulnerability from cvelistv5
Published
2013-06-18 22:00
Modified
2024-08-06 15:36
Severity ?
CWE
  • n/a
Summary
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm."
References
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2x_refsource_MISC
http://marc.info/?l=bugtraq&m=137545592101387&w=2vendor-advisory, x_refsource_HP
https://access.redhat.com/errata/RHSA-2014:0414vendor-advisory, x_refsource_REDHAT
http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisory, x_refsource_GENTOO
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16887vdb-entry, signature, x_refsource_OVAL
http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlx_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.htmlx_refsource_CONFIRM
http://marc.info/?l=bugtraq&m=137545505800971&w=2vendor-advisory, x_refsource_HP
http://secunia.com/advisories/54154third-party-advisory, x_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19582vdb-entry, signature, x_refsource_OVAL
http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlx_refsource_CONFIRM
http://www.securityfocus.com/archive/1/534161/100/0/threadedmailing-list, x_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19565vdb-entry, signature, x_refsource_OVAL
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlx_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.htmlx_refsource_CONFIRM
http://seclists.org/fulldisclosure/2014/Dec/23mailing-list, x_refsource_FULLDISC
http://www.us-cert.gov/ncas/alerts/TA13-169Athird-party-advisory, x_refsource_CERT
http://advisories.mageia.org/MGASA-2013-0185.htmlx_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0963.htmlvendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/bid/60645vdb-entry, x_refsource_BID
http://www.mandriva.com/security/advisories?name=MDVSA-2013:183vendor-advisory, x_refsource_MANDRIVA
https://bugzilla.redhat.com/show_bug.cgi?id=975126x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T15:36:46.518Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2"
          },
          {
            "name": "HPSBUX02908",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=137545592101387\u0026w=2"
          },
          {
            "name": "RHSA-2014:0414",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2014:0414"
          },
          {
            "name": "GLSA-201406-32",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
          },
          {
            "name": "oval:org.mitre.oval:def:16887",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16887"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html"
          },
          {
            "name": "HPSBUX02907",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=137545505800971\u0026w=2"
          },
          {
            "name": "54154",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/54154"
          },
          {
            "name": "oval:org.mitre.oval:def:19582",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19582"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:19565",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19565"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
          },
          {
            "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
          },
          {
            "name": "TA13-169A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/ncas/alerts/TA13-169A"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://advisories.mageia.org/MGASA-2013-0185.html"
          },
          {
            "name": "RHSA-2013:0963",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0963.html"
          },
          {
            "name": "60645",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/60645"
          },
          {
            "name": "MDVSA-2013:183",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:183"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=975126"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-06-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.  NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a \"Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-09T18:57:01",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2"
        },
        {
          "name": "HPSBUX02908",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=137545592101387\u0026w=2"
        },
        {
          "name": "RHSA-2014:0414",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2014:0414"
        },
        {
          "name": "GLSA-201406-32",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
        },
        {
          "name": "oval:org.mitre.oval:def:16887",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16887"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html"
        },
        {
          "name": "HPSBUX02907",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=137545505800971\u0026w=2"
        },
        {
          "name": "54154",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/54154"
        },
        {
          "name": "oval:org.mitre.oval:def:19582",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19582"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html"
        },
        {
          "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
        },
        {
          "name": "oval:org.mitre.oval:def:19565",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19565"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
        },
        {
          "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
        },
        {
          "name": "TA13-169A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/ncas/alerts/TA13-169A"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://advisories.mageia.org/MGASA-2013-0185.html"
        },
        {
          "name": "RHSA-2013:0963",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0963.html"
        },
        {
          "name": "60645",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/60645"
        },
        {
          "name": "MDVSA-2013:183",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:183"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=975126"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2013-2461",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.  NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a \"Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2",
              "refsource": "MISC",
              "url": "http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/abe9ea5a50d2"
            },
            {
              "name": "HPSBUX02908",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=137545592101387\u0026w=2"
            },
            {
              "name": "RHSA-2014:0414",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2014:0414"
            },
            {
              "name": "GLSA-201406-32",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-201406-32.xml"
            },
            {
              "name": "oval:org.mitre.oval:def:16887",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16887"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2014-0012.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html"
            },
            {
              "name": "HPSBUX02907",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=137545505800971\u0026w=2"
            },
            {
              "name": "54154",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/54154"
            },
            {
              "name": "oval:org.mitre.oval:def:19582",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19582"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/534161/100/0/threaded"
            },
            {
              "name": "oval:org.mitre.oval:def:19565",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19565"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2013-1899837.html"
            },
            {
              "name": "20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2014/Dec/23"
            },
            {
              "name": "TA13-169A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/ncas/alerts/TA13-169A"
            },
            {
              "name": "http://advisories.mageia.org/MGASA-2013-0185.html",
              "refsource": "CONFIRM",
              "url": "http://advisories.mageia.org/MGASA-2013-0185.html"
            },
            {
              "name": "RHSA-2013:0963",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0963.html"
            },
            {
              "name": "60645",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/60645"
            },
            {
              "name": "MDVSA-2013:183",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:183"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=975126",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=975126"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2013-2461",
    "datePublished": "2013-06-18T22:00:00",
    "dateReserved": "2013-03-05T00:00:00",
    "dateUpdated": "2024-08-06T15:36:46.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35588 (GCVE-0-2021-35588)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-08-04 00:40
Severity ?
3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u311, 8u301; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-26T19:11:40.314837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-26T19:11:50.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.361Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u311, 8u301; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:08:08.052182",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35588",
    "datePublished": "2021-10-20T10:50:31",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-08-04T00:40:47.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-5373 (GCVE-0-2012-5373)
Vulnerability from cvelistv5
Published
2012-11-28 11:00
Modified
2024-08-06 21:05
Severity ?
CWE
  • n/a
Summary
Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.
References
http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdfx_refsource_MISC
http://www.securityfocus.com/bid/56673vdb-entry, x_refsource_BID
https://www.131002.net/data/talks/appsec12_slides.pdfx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=880705x_refsource_CONFIRM
http://2012.appsec-forum.ch/conferences/#c17x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/80299vdb-entry, x_refsource_XF
http://www.ocert.org/advisories/ocert-2012-001.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:05:47.234Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf"
          },
          {
            "name": "56673",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/56673"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.131002.net/data/talks/appsec12_slides.pdf"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=880705"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://2012.appsec-forum.ch/conferences/#c17"
          },
          {
            "name": "java-murmur-hash-dos(80299)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80299"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2012-001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-11-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf"
        },
        {
          "name": "56673",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/56673"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.131002.net/data/talks/appsec12_slides.pdf"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=880705"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://2012.appsec-forum.ch/conferences/#c17"
        },
        {
          "name": "java-murmur-hash-dos(80299)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80299"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2012-001.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-5373",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf",
              "refsource": "MISC",
              "url": "http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf"
            },
            {
              "name": "56673",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/56673"
            },
            {
              "name": "https://www.131002.net/data/talks/appsec12_slides.pdf",
              "refsource": "MISC",
              "url": "https://www.131002.net/data/talks/appsec12_slides.pdf"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=880705",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=880705"
            },
            {
              "name": "http://2012.appsec-forum.ch/conferences/#c17",
              "refsource": "MISC",
              "url": "http://2012.appsec-forum.ch/conferences/#c17"
            },
            {
              "name": "java-murmur-hash-dos(80299)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80299"
            },
            {
              "name": "http://www.ocert.org/advisories/ocert-2012-001.html",
              "refsource": "MISC",
              "url": "http://www.ocert.org/advisories/ocert-2012-001.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-5373",
    "datePublished": "2012-11-28T11:00:00",
    "dateReserved": "2012-10-10T00:00:00",
    "dateUpdated": "2024-08-06T21:05:47.234Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21340 (GCVE-0-2022-21340)
Vulnerability from cvelistv5
Published
2022-01-19 11:24
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.601Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:47.711Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21340",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21340",
    "datePublished": "2022-01-19T11:24:59",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21277 (GCVE-0-2022-21277)
Vulnerability from cvelistv5
Published
2022-01-19 11:22
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.127Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:12.305Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21277",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21277",
    "datePublished": "2022-01-19T11:22:59",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.127Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35565 (GCVE-0-2021-35565)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-09-25 19:35
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.html
https://security.netapp.com/advisory/ntap-20211022-0004/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory
https://www.debian.org/security/2021/dsa-5000vendor-advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list
https://security.gentoo.org/glsa/202209-05vendor-advisory
https://security.netapp.com/advisory/ntap-20240621-0006/
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:46.747Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T19:32:11.232825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T19:35:12.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:06:17.151862",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35565",
    "datePublished": "2021-10-20T10:50:12",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-09-25T19:35:12.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-2756 (GCVE-0-2020-2756)
Vulnerability from cvelistv5
Published
2020-04-15 13:29
Modified
2024-09-30 15:41
Severity ?
3.7 (Low) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20200416-0004/x_refsource_CONFIRM
https://www.debian.org/security/2020/dsa-4662vendor-advisory, x_refsource_DEBIAN
https://usn.ubuntu.com/4337-1/vendor-advisory, x_refsource_UBUNTU
https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2020/dsa-4668vendor-advisory, x_refsource_DEBIAN
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/vendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlvendor-advisory, x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlvendor-advisory, x_refsource_SUSE
https://security.gentoo.org/glsa/202006-22vendor-advisory, x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlvendor-advisory, x_refsource_SUSE
https://kc.mcafee.com/corporate/index?page=content&id=SB10332x_refsource_CONFIRM
https://security.gentoo.org/glsa/202209-15vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java Version: Java SE: 7u251, 8u241, 11.0.6, 14
Version: Java SE Embedded: 8u241
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:17:02.285Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
          },
          {
            "name": "DSA-4662",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4662"
          },
          {
            "name": "USN-4337-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4337-1/"
          },
          {
            "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
          },
          {
            "name": "DSA-4668",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4668"
          },
          {
            "name": "FEDORA-2020-5386fe3bbb",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
          },
          {
            "name": "FEDORA-2020-21ca991b3b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
          },
          {
            "name": "FEDORA-2020-a60ad9d4ec",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
          },
          {
            "name": "openSUSE-SU-2020:0757",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0800",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
          },
          {
            "name": "GLSA-202006-22",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202006-22"
          },
          {
            "name": "openSUSE-SU-2020:0841",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
          },
          {
            "name": "GLSA-202209-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2020-2756",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-30T15:00:07.558268Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-30T15:41:43.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE: 7u251, 8u241, 11.0.6, 14"
            },
            {
              "status": "affected",
              "version": "Java SE Embedded: 8u241"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-25T15:06:33",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
        },
        {
          "name": "DSA-4662",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4662"
        },
        {
          "name": "USN-4337-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4337-1/"
        },
        {
          "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
        },
        {
          "name": "DSA-4668",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4668"
        },
        {
          "name": "FEDORA-2020-5386fe3bbb",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
        },
        {
          "name": "FEDORA-2020-21ca991b3b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
        },
        {
          "name": "FEDORA-2020-a60ad9d4ec",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
        },
        {
          "name": "openSUSE-SU-2020:0757",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0800",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
        },
        {
          "name": "GLSA-202006-22",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202006-22"
        },
        {
          "name": "openSUSE-SU-2020:0841",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
        },
        {
          "name": "GLSA-202209-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-15"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2020-2756",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE: 7u251, 8u241, 11.0.6, 14"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE Embedded: 8u241"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "3.7",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2020.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20200416-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
            },
            {
              "name": "DSA-4662",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4662"
            },
            {
              "name": "USN-4337-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4337-1/"
            },
            {
              "name": "[debian-lts-announce] 20200429 [SECURITY] [DLA 2193-1] openjdk-7 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
            },
            {
              "name": "DSA-4668",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4668"
            },
            {
              "name": "FEDORA-2020-5386fe3bbb",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
            },
            {
              "name": "FEDORA-2020-21ca991b3b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
            },
            {
              "name": "FEDORA-2020-a60ad9d4ec",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
            },
            {
              "name": "openSUSE-SU-2020:0757",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0800",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
            },
            {
              "name": "GLSA-202006-22",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202006-22"
            },
            {
              "name": "openSUSE-SU-2020:0841",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
            },
            {
              "name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332",
              "refsource": "CONFIRM",
              "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
            },
            {
              "name": "GLSA-202209-15",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-15"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2020-2756",
    "datePublished": "2020-04-15T13:29:44",
    "dateReserved": "2019-12-10T00:00:00",
    "dateUpdated": "2024-09-30T15:41:43.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-0581 (GCVE-0-2009-0581)
Vulnerability from cvelistv5
Published
2009-03-23 14:00
Modified
2024-08-07 04:40
Severity ?
CWE
  • n/a
Summary
Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
References
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.htmlvendor-advisory, x_refsource_FEDORA
http://www.mandriva.com/security/advisories?name=MDVSA-2009:137vendor-advisory, x_refsource_MANDRIVA
http://secunia.com/advisories/34632third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34450third-party-advisory, x_refsource_SECUNIA
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.htmlvendor-advisory, x_refsource_FEDORA
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlvendor-advisory, x_refsource_SUSE
http://www.ubuntu.com/usn/USN-744-1vendor-advisory, x_refsource_UBUNTU
http://www.debian.org/security/2009/dsa-1745vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/34675third-party-advisory, x_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilities/49328vdb-entry, x_refsource_XF
http://secunia.com/advisories/34454third-party-advisory, x_refsource_SECUNIA
http://www.securitytracker.com/id?1021870vdb-entry, x_refsource_SECTRACK
http://secunia.com/advisories/34442third-party-advisory, x_refsource_SECUNIA
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.htmlvendor-advisory, x_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.htmlvendor-advisory, x_refsource_FEDORA
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.htmlvendor-advisory, x_refsource_FEDORA
http://scary.beasts.org/security/CESA-2009-003.htmlx_refsource_MISC
http://secunia.com/advisories/34382third-party-advisory, x_refsource_SECUNIA
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.487438vendor-advisory, x_refsource_SLACKWARE
http://secunia.com/advisories/34418third-party-advisory, x_refsource_SECUNIA
http://www.securityfocus.com/archive/1/502031/100/0/threadedmailing-list, x_refsource_BUGTRAQ
https://rhn.redhat.com/errata/RHSA-2009-0377.htmlvendor-advisory, x_refsource_REDHAT
http://www.ocert.org/advisories/ocert-2009-003.htmlx_refsource_MISC
http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.htmlx_refsource_MISC
http://secunia.com/advisories/34782third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34367third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2009:162vendor-advisory, x_refsource_MANDRIVA
http://www.redhat.com/support/errata/RHSA-2009-0339.htmlvendor-advisory, x_refsource_REDHAT
http://www.vupen.com/english/advisories/2009/0775vdb-entry, x_refsource_VUPEN
http://secunia.com/advisories/34463third-party-advisory, x_refsource_SECUNIA
http://secunia.com/advisories/34408third-party-advisory, x_refsource_SECUNIA
http://www.debian.org/security/2009/dsa-1769vendor-advisory, x_refsource_DEBIAN
http://secunia.com/advisories/34400third-party-advisory, x_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-2009:121vendor-advisory, x_refsource_MANDRIVA
http://www.securityfocus.com/archive/1/502018/100/0/threadedmailing-list, x_refsource_BUGTRAQ
https://bugzilla.redhat.com/show_bug.cgi?id=487509x_refsource_CONFIRM
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.htmlvendor-advisory, x_refsource_FEDORA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023vdb-entry, signature, x_refsource_OVAL
http://www.securityfocus.com/bid/34185vdb-entry, x_refsource_BID
http://security.gentoo.org/glsa/glsa-200904-19.xmlvendor-advisory, x_refsource_GENTOO
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.htmlvendor-advisory, x_refsource_FEDORA
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T04:40:04.074Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2009-2970",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html"
          },
          {
            "name": "MDVSA-2009:137",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:137"
          },
          {
            "name": "34632",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34632"
          },
          {
            "name": "34450",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34450"
          },
          {
            "name": "FEDORA-2009-2928",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html"
          },
          {
            "name": "SUSE-SR:2009:007",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
          },
          {
            "name": "USN-744-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-744-1"
          },
          {
            "name": "DSA-1745",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1745"
          },
          {
            "name": "34675",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34675"
          },
          {
            "name": "littlecms-unspecified-dos(49328)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49328"
          },
          {
            "name": "34454",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34454"
          },
          {
            "name": "1021870",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1021870"
          },
          {
            "name": "34442",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34442"
          },
          {
            "name": "FEDORA-2009-2982",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html"
          },
          {
            "name": "FEDORA-2009-3034",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html"
          },
          {
            "name": "FEDORA-2009-2903",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://scary.beasts.org/security/CESA-2009-003.html"
          },
          {
            "name": "34382",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34382"
          },
          {
            "name": "SSA:2009-083-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_SLACKWARE",
              "x_transferred"
            ],
            "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.487438"
          },
          {
            "name": "34418",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34418"
          },
          {
            "name": "20090320 [oCERT-2009-003] LittleCMS integer errors",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502031/100/0/threaded"
          },
          {
            "name": "RHSA-2009:0377",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2009-0377.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.ocert.org/advisories/ocert-2009-003.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html"
          },
          {
            "name": "34782",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34782"
          },
          {
            "name": "34367",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34367"
          },
          {
            "name": "MDVSA-2009:162",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:162"
          },
          {
            "name": "RHSA-2009:0339",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-0339.html"
          },
          {
            "name": "ADV-2009-0775",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0775"
          },
          {
            "name": "34463",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34463"
          },
          {
            "name": "34408",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34408"
          },
          {
            "name": "DSA-1769",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1769"
          },
          {
            "name": "34400",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/34400"
          },
          {
            "name": "MDVSA-2009:121",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:121"
          },
          {
            "name": "20090320 LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/502018/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=487509"
          },
          {
            "name": "FEDORA-2009-2910",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10023",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023"
          },
          {
            "name": "34185",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34185"
          },
          {
            "name": "GLSA-200904-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200904-19.xml"
          },
          {
            "name": "FEDORA-2009-2983",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-03-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2009-2970",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00851.html"
        },
        {
          "name": "MDVSA-2009:137",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:137"
        },
        {
          "name": "34632",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34632"
        },
        {
          "name": "34450",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34450"
        },
        {
          "name": "FEDORA-2009-2928",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00811.html"
        },
        {
          "name": "SUSE-SR:2009:007",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html"
        },
        {
          "name": "USN-744-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-744-1"
        },
        {
          "name": "DSA-1745",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1745"
        },
        {
          "name": "34675",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34675"
        },
        {
          "name": "littlecms-unspecified-dos(49328)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49328"
        },
        {
          "name": "34454",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34454"
        },
        {
          "name": "1021870",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1021870"
        },
        {
          "name": "34442",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34442"
        },
        {
          "name": "FEDORA-2009-2982",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00856.html"
        },
        {
          "name": "FEDORA-2009-3034",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00921.html"
        },
        {
          "name": "FEDORA-2009-2903",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00794.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://scary.beasts.org/security/CESA-2009-003.html"
        },
        {
          "name": "34382",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34382"
        },
        {
          "name": "SSA:2009-083-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_SLACKWARE"
          ],
          "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.487438"
        },
        {
          "name": "34418",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34418"
        },
        {
          "name": "20090320 [oCERT-2009-003] LittleCMS integer errors",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502031/100/0/threaded"
        },
        {
          "name": "RHSA-2009:0377",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2009-0377.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.ocert.org/advisories/ocert-2009-003.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://scarybeastsecurity.blogspot.com/2009/03/littlecms-vulnerabilities.html"
        },
        {
          "name": "34782",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34782"
        },
        {
          "name": "34367",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34367"
        },
        {
          "name": "MDVSA-2009:162",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:162"
        },
        {
          "name": "RHSA-2009:0339",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-0339.html"
        },
        {
          "name": "ADV-2009-0775",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0775"
        },
        {
          "name": "34463",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34463"
        },
        {
          "name": "34408",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34408"
        },
        {
          "name": "DSA-1769",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1769"
        },
        {
          "name": "34400",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/34400"
        },
        {
          "name": "MDVSA-2009:121",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:121"
        },
        {
          "name": "20090320 LittleCMS vulnerabilities (OpenJDK, Firefox, GIMP, etc. impacted)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/502018/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=487509"
        },
        {
          "name": "FEDORA-2009-2910",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00799.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10023",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10023"
        },
        {
          "name": "34185",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34185"
        },
        {
          "name": "GLSA-200904-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200904-19.xml"
        },
        {
          "name": "FEDORA-2009-2983",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00857.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-0581",
    "datePublished": "2009-03-23T14:00:00",
    "dateReserved": "2009-02-13T00:00:00",
    "dateUpdated": "2024-08-07T04:40:04.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35561 (GCVE-0-2021-35561)
Vulnerability from cvelistv5
Published
2021-10-20 10:50
Modified
2024-09-25 19:35
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
https://www.oracle.com/security-alerts/cpuoct2021.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20211022-0004/x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/vendor-advisory, x_refsource_FEDORA
https://www.debian.org/security/2021/dsa-5000vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlmailing-list, x_refsource_MLIST
https://www.debian.org/security/2021/dsa-5012vendor-advisory, x_refsource_DEBIAN
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Java SE:7u311
Version: Java SE:8u301
Version: Java SE:11.0.12
Version: Java SE:17
Version: Oracle GraalVM Enterprise Edition:20.3.3
Version: Oracle GraalVM Enterprise Edition:21.2.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:40:47.369Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
          },
          {
            "name": "FEDORA-2021-35145352b0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
          },
          {
            "name": "FEDORA-2021-7701833090",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
          },
          {
            "name": "FEDORA-2021-9a51a6f8b1",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
          },
          {
            "name": "FEDORA-2021-1cc8ffd122",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
          },
          {
            "name": "FEDORA-2021-eb3e3e87d3",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
          },
          {
            "name": "FEDORA-2021-107c8c5063",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
          },
          {
            "name": "DSA-5000",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5000"
          },
          {
            "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
          },
          {
            "name": "DSA-5012",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-5012"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35561",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T19:32:13.560580Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T19:35:41.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Java SE:7u311"
            },
            {
              "status": "affected",
              "version": "Java SE:8u301"
            },
            {
              "status": "affected",
              "version": "Java SE:11.0.12"
            },
            {
              "status": "affected",
              "version": "Java SE:17"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.3"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:07:06",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
        },
        {
          "name": "FEDORA-2021-35145352b0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
        },
        {
          "name": "FEDORA-2021-7701833090",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
        },
        {
          "name": "FEDORA-2021-9a51a6f8b1",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
        },
        {
          "name": "FEDORA-2021-1cc8ffd122",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
        },
        {
          "name": "FEDORA-2021-eb3e3e87d3",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
        },
        {
          "name": "FEDORA-2021-107c8c5063",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
        },
        {
          "name": "DSA-5000",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5000"
        },
        {
          "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
        },
        {
          "name": "DSA-5012",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-5012"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2021-35561",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:7u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:8u301"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:11.0.12"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Java SE:17"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.3"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.2.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpuoct2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20211022-0004/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
            },
            {
              "name": "FEDORA-2021-35145352b0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
            },
            {
              "name": "FEDORA-2021-7701833090",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
            },
            {
              "name": "FEDORA-2021-9a51a6f8b1",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
            },
            {
              "name": "FEDORA-2021-1cc8ffd122",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
            },
            {
              "name": "FEDORA-2021-eb3e3e87d3",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
            },
            {
              "name": "FEDORA-2021-107c8c5063",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
            },
            {
              "name": "DSA-5000",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5000"
            },
            {
              "name": "[debian-lts-announce] 20211109 [SECURITY] [DLA 2814-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
            },
            {
              "name": "DSA-5012",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-5012"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2021-35561",
    "datePublished": "2021-10-20T10:50:09",
    "dateReserved": "2021-06-28T00:00:00",
    "dateUpdated": "2024-09-25T19:35:41.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21305 (GCVE-0-2022-21305)
Vulnerability from cvelistv5
Published
2022-01-19 11:23
Modified
2024-08-03 02:38
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://security.netapp.com/advisory/ntap-20220121-0007/x_refsource_CONFIRM
https://www.debian.org/security/2022/dsa-5057vendor-advisory, x_refsource_DEBIAN
https://www.debian.org/security/2022/dsa-5058vendor-advisory, x_refsource_DEBIAN
https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlmailing-list, x_refsource_MLIST
https://security.gentoo.org/glsa/202209-05vendor-advisory, x_refsource_GENTOO
Impacted products
Vendor Product Version
Oracle Corporation Java SE JDK and JRE Version: Oracle Java SE:7u321
Version: Oracle Java SE:8u311
Version: Oracle Java SE:11.0.13
Version: Oracle Java SE:17.0.1
Version: Oracle GraalVM Enterprise Edition:20.3.4
Version: Oracle GraalVM Enterprise Edition:21.3.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:38:55.470Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
          },
          {
            "name": "DSA-5057",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5057"
          },
          {
            "name": "DSA-5058",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5058"
          },
          {
            "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
          },
          {
            "name": "GLSA-202209-05",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-05"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Java SE JDK and JRE",
          "vendor": "Oracle Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Oracle Java SE:7u321"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:8u311"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:11.0.13"
            },
            {
              "status": "affected",
              "version": "Oracle Java SE:17.0.1"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:20.3.4"
            },
            {
              "status": "affected",
              "version": "Oracle GraalVM Enterprise Edition:21.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-07T23:20:02.221Z",
        "orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
        "shortName": "oracle"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
        },
        {
          "name": "DSA-5057",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5057"
        },
        {
          "name": "DSA-5058",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5058"
        },
        {
          "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
        },
        {
          "name": "GLSA-202209-05",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-05"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert_us@oracle.com",
          "ID": "CVE-2022-21305",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Java SE JDK and JRE",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:7u321"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:8u311"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:11.0.13"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle Java SE:17.0.1"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:20.3.4"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "Oracle GraalVM Enterprise Edition:21.3.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Oracle Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "5.3",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.oracle.com/security-alerts/cpujan2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20220121-0007/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
            },
            {
              "name": "DSA-5057",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5057"
            },
            {
              "name": "DSA-5058",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2022/dsa-5058"
            },
            {
              "name": "[debian-lts-announce] 20220210 [SECURITY] [DLA 2917-1] openjdk-8 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
            },
            {
              "name": "GLSA-202209-05",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-05"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
    "assignerShortName": "oracle",
    "cveId": "CVE-2022-21305",
    "datePublished": "2022-01-19T11:23:55",
    "dateReserved": "2021-11-15T00:00:00",
    "dateUpdated": "2024-08-03T02:38:55.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2022-04-19 21:15
Modified
2024-11-21 06:44
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2022/05/msg00017.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20220429-0006/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5128Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5131Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/05/msg00017.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220429-0006/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5128Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5131Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.5
oracle graalvm 21.3.1
oracle graalvm 22.0.0.2
oracle jdk 7.0
oracle jdk 8.0
oracle jdk 11.0.14
oracle jdk 17.0.2
oracle jdk 18
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_insights_acquisition_unit -
netapp cloud_secure_agent -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp element_software -
netapp hci_management_node -
netapp oncommand_insight -
netapp santricity_unified_manager -
netapp solidfire -
netapp bootstrap_os -
netapp hci_compute_node -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
azul zulu 7.52
azul zulu 8.60
azul zulu 11.54
azul zulu 13.46
azul zulu 15.38
azul zulu 17.32
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 18


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.5:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "079F2588-2746-408B-9BB0-9A569289985B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "51600424-E294-41E0-9C8B-12D0C3456027",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:22.0.0.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "C3D12B98-032F-49A6-B237-E0CAD32D9A25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:7.0:update_331:*:*:*:*:*:*",
              "matchCriteriaId": "AC99AA10-93C5-4B27-A991-FD29496FDF1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:8.0:update_321:*:*:*:*:*:*",
              "matchCriteriaId": "C66D72B5-055F-45BD-AD02-C5E086AB5B63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "681BFE5C-6F33-4084-8F0D-2DD573782004",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A29CF53D-7DDC-4B60-8232-6C173083101F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:18:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBA091EC-B5A9-468D-B99C-BB6F333E7B64",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "85DF4B3F-4BBC-42B7-B729-096934523D63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "95BA156C-C977-4F0C-8DFB-3FAE9CC8C02D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:azul:zulu:7.52:*:*:*:*:*:*:*",
              "matchCriteriaId": "5522AD81-A23E-47D3-82E4-6D71ECEB1DBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:8.60:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AC61C25-871B-4F6F-A5F0-77359F373681",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:11.54:*:*:*:*:*:*:*",
              "matchCriteriaId": "12A59E25-5ED3-4A6D-95F6-45750866E0D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:13.46:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC0DC492-706E-42FE-8757-71873B53C417",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:15.38:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1441FE9-45C5-46C4-BF78-FD5D30F9C80C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:17.32:*:*:*:*:*:*:*",
              "matchCriteriaId": "28D25E37-5479-4876-B46C-28FF87384852",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C0D3169-24B4-4733-BD40-59D0BB5DAC13",
              "versionEndIncluding": "11.0.14",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1D003C0-042E-4126-AEDA-F85863FEAB45",
              "versionEndIncluding": "13.0.10",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC2C87EC-6234-482F-B597-962E3C52D01B",
              "versionEndIncluding": "15.0.6",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "38F4BE82-B2A6-4E48-B1E0-100ACF94B9CD",
              "versionEndIncluding": "17.0.2",
              "versionStartIncluding": "17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update301:*:*:*:*:*:*",
              "matchCriteriaId": "95954182-9541-4181-9647-B17FA5A79F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update321:*:*:*:*:*:*",
              "matchCriteriaId": "EAFB6B15-4AE6-47FC-8847-9DFADB7AE253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update331:*:*:*:*:*:*",
              "matchCriteriaId": "A8971E08-2CA2-46F4-8C26-12D2AFAC3B04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update322:*:*:*:*:*:*",
              "matchCriteriaId": "DAB4F663-BCAF-43DB-BCC3-24C060B0CBAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:18:*:*:*:*:*:*:*",
              "matchCriteriaId": "56CBFC1F-C120-44F2-877A-C1C880AA89C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Libraries). Las versiones afectadas son Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 y 22.0.0.2. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso no autorizado a datos cr\u00edticos o el acceso completo a todos los datos accesibles de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad es aplicada a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen del sandbox de Java para la seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada mediante el uso de APIs en el componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1, Puntuaci\u00f3n Base 7.5 (impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)"
    }
  ],
  "id": "CVE-2022-21476",
  "lastModified": "2024-11-21T06:44:47.470",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-04-19T21:15:17.503",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5128"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5131"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/05/msg00017.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220429-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5128"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5131"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2014-05-14 00:55
Modified
2025-04-12 10:46
Severity ?
Summary
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462.
References
secalert_us@oracle.comhttp://secunia.com/advisories/58415Vendor Advisory
secalert_us@oracle.comhttp://www.debian.org/security/2014/dsa-2912
secalert_us@oracle.comhttp://www.ubuntu.com/usn/USN-2191-1
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58415Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2014/dsa-2912
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2191-1
Impacted products
Vendor Product Version
oracle openjdk 1.6.0
canonical ubuntu_linux 10.04
canonical ubuntu_linux 12.04
debian debian_linux *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:1.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A6505E4-8E6A-4888-8B9C-2B2C10546CB6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "7118F616-25CA-4E34-AA13-4D14BB62419F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C8919F1-CD33-437E-9627-69352B276BA3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-0462."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en OpenJDK 6 anterior a 6b31 en Debian GNU/Linux y Ubuntu 12.04 LTS y 10.04 LTS tiene impacto y vectores de ataque desconocidos, una vulnerabilidad diferente a CVE-2014-0462."
    }
  ],
  "id": "CVE-2014-2405",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-05-14T00:55:08.697",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/58415"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.debian.org/security/2014/dsa-2912"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.ubuntu.com/usn/USN-2191-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/58415"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2014/dsa-2912"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2191-1"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp plug-in_for_symantec_netbackup -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
debian debian_linux 10.0
opensuse leap 15.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE de Oracle Java SE (componente: JSSE). Las versiones compatibles que est\u00e1n afectadas son Java SE: 11.0.6 y 14. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de HTTPS comprometer a Java SE. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Java SE, as\u00ed como el acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE. Nota: Se aplica a la implementaci\u00f3n de cliente y servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start dentro del sandbox y applets de Java dentro del sandbox. Tambi\u00e9n puede ser explotada al proporcionar datos a las API en el Componente especificado sin usar aplicaciones de Java Web Start dentro del sandbox o applets de Java dentro del sandbox, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 4.8 (Impactos de la confidencialidad y la integridad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
    }
  ],
  "id": "CVE-2020-2767",
  "lastModified": "2024-11-21T05:26:12.807",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:26.187",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-05-19 14:15
Modified
2024-11-21 06:21
Severity ?
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Summary
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1954232Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
secalert@redhat.comhttps://lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlMailing List, Third Party Advisory
secalert@redhat.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
secalert@redhat.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
secalert@redhat.comhttps://security.gentoo.org/glsa/202107-05Third Party Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20210625-0002/Third Party Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1954232Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/05/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202107-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210625-0002/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.htmlNot Applicable
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
xmlsoft libxml2 *
redhat jboss_core_services -
redhat enterprise_linux 8.0
fedoraproject fedora 33
fedoraproject fedora 34
debian debian_linux 9.0
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp clustered_data_ontap -
netapp clustered_data_ontap_antivirus_connector -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp manageability_software_development_kit -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp ontap_select_deploy_administration_utility -
netapp santricity_unified_manager -
netapp snapdrive -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
netapp hci_h410c_firmware -
netapp hci_h410c -
oracle communications_cloud_native_core_network_function_cloud_native_environment 1.10.0
oracle enterprise_manager_base_platform 13.4.0.0
oracle enterprise_manager_base_platform 13.5.0.0
oracle mysql_workbench *
oracle openjdk 8
oracle peoplesoft_enterprise_peopletools 8.58
oracle real_user_experience_insight 13.4.1.0
oracle real_user_experience_insight 13.5.1.0
oracle zfs_storage_appliance_kit 8.8


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "208AF535-5D38-45B4-B227-2892611C5A20",
              "versionEndExcluding": "2.9.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B453CF7-9AA6-4B94-A003-BF7AE0B82F53",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "1FE996B1-6951-4F85-AA58-B99A379D2163",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62347994-1353-497C-9C4A-D5D8D95F67E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D39DCAE7-494F-40B2-867F-6C6A077939DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7CF3019-975D-40BB-A8A4-894E62BD3797",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BEDE62C6-D571-4AF8-B85E-CBBCE4AF98B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:netapp:hci_h410c_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "08C564D8-E21F-403C-B4BB-7B14B7FB5DAE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:netapp:hci_h410c:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8532F5F0-00A1-4FA9-A80B-09E46D03F74F",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2A5B24D-BDF2-423C-98EA-A40778C01A05",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E8758C8-87D3-450A-878B-86CE8C9FC140",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EED6C8C2-F986-4CFD-A343-AD2340F850F2",
              "versionEndIncluding": "8.0.26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:real_user_experience_insight:13.4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CADD7026-EF85-40A5-8563-7A34C6941B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:real_user_experience_insight:13.5.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "58F019E8-F68D-41B5-9480-0A81616F2E7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3E503FB-6279-4D4A-91D8-E237ECF9D2B0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application."
    },
    {
      "lang": "es",
      "value": "Se presenta un fallo en la funcionalidad xml entity encoding de libxml2 en versiones anteriores a 2.9.11.\u0026#xa0;Un atacante que sea capaz de proporcionar un archivo dise\u00f1ado para que sea procesado por una aplicaci\u00f3n vinculada con la funcionalidad afectada de libxml2 podr\u00eda desencadenar una lectura fuera de los l\u00edmites.\u0026#xa0;El impacto m\u00e1s probable de este fallo es la disponibilidad de la aplicaci\u00f3n, con alg\u00fan impacto potencial en la confidencialidad e integridad si un atacante puede usar la informaci\u00f3n de la memoria para explotar a\u00fan m\u00e1s la aplicaci\u00f3n"
    }
  ],
  "id": "CVE-2021-3517",
  "lastModified": "2024-11-21T06:21:44.107",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-19T14:15:07.553",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202107-05"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954232"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202107-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210625-0002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-06-12 04:15
Modified
2024-11-21 06:07
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
References
security@ubuntu.comhttps://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
canonical ubuntu_linux 18.04
canonical ubuntu_linux 20.04
canonical ubuntu_linux 20.10
canonical ubuntu_linux 21.04
canonical ubuntu_linux 21.10
oracle openjdk 17


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "338B3AAC-C147-4A31-95E7-6E8A6FB4B3FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "D5F0EBD8-0681-4AE6-90E5-78F8AAB39123",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAE4D2D0-CEEB-416F-8BC5-A7987DF56190",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users."
    },
    {
      "lang": "es",
      "value": "Se ha detectado que la funci\u00f3n read_file() en el archivo apport/hookutils.py podr\u00eda seguir enlaces simb\u00f3licos o abrir FIFOs. Cuando esta funci\u00f3n es usada por el paquete openjdk-17 apport hooks, podr\u00eda exponer datos privados a otros usuarios locales"
    }
  ],
  "id": "CVE-2021-32553",
  "lastModified": "2024-11-21T06:07:15.390",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.7,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-12T04:15:12.157",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1917904"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        },
        {
          "lang": "en",
          "value": "CWE-61"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2015-11-09 16:59
Modified
2025-04-12 10:46
Severity ?
Summary
A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.
References
cve@mitre.orghttp://www.debian.org/security/2015/dsa-3235Vendor Advisory
cve@mitre.orghttp://www.debian.org/security/2015/dsa-3316Vendor Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2015/07/18/2
cve@mitre.orghttp://www.securityfocus.com/bid/76019
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3235Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2015/dsa-3316Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2015/07/18/2
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/76019
Impacted products
Vendor Product Version
oracle openjdk 1.7.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:1.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "662D4C81-DD97-4A36-8F15-CCE6ADA6456E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file."
    },
    {
      "lang": "es",
      "value": "Un archivo .desktop en el paquete Debian openjdk-7 7u79-2.5.5-1~deb8u1 incluye un registro de tipo MIME que se a\u00f1ade a /etc/mailcap por mime-support, lo que permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un archivo JAR."
    }
  ],
  "id": "CVE-2014-8873",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2015-11-09T16:59:00.103",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3235"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3316"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2015/07/18/2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/76019"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3235"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.debian.org/security/2015/dsa-3316"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2015/07/18/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/76019"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
8.3 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlThird Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlThird Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlThird Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202006-22Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4668Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-22Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4668Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp plug-in_for_symantec_netbackup -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.1
opensuse leap 15.2
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "E3B8B378-3211-4E63-873D-A05574B39E14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "CEAD5DA3-6D7D-4127-8E58-E0ACA8A611D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update_251:*:*:*:*:*:*",
              "matchCriteriaId": "8F257E03-5BA1-4743-983A-6C08F8572FFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update_241:*:*:*:*:*:*",
              "matchCriteriaId": "C49049F7-8BA7-4787-8C55-CABFAB6BC0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
              "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Libraries). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u251, 8u241, 11.0.6 y 14; Java SE Embedded: 8u241. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito requieren una interacci\u00f3n humana de una persona diferente del atacante y, aunque la vulnerabilidad se encuentra en Java SE, Java SE Embedded, los ataques pueden afectar significativamente a productos adicionales. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la toma de control de Java SE, Java SE Embedded. Nota: Esta vulnerabilidad se aplica a las implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start dentro del sandbox o applets de Java dentro del sandbox, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo que proviene de Internet) y conf\u00edan en el sandbox de Java para la seguridad. Esta vulnerabilidad no se aplica a las implementaciones de Java, com\u00fanmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). CVSS 3.0 Puntuaci\u00f3n Base 8.3 (Impactos de la confidencialidad, la integridad y la disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."
    }
  ],
  "id": "CVE-2020-2805",
  "lastModified": "2024-11-21T05:26:19.240",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:28.437",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2019-07-01 02:15
Modified
2024-11-21 04:24
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
References
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlMailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2019/11/17/2Mailing List, Third Party Advisory
cve@mitre.orghttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471Issue Tracking, Mailing List, Third Party Advisory
cve@mitre.orghttps://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1Patch, Third Party Advisory
cve@mitre.orghttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
cve@mitre.orghttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
cve@mitre.orghttps://oss-fuzz.com/testcase-detail/5631739747106816Permissions Required
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20190806-0004/Third Party Advisory
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20200122-0003/Third Party Advisory
cve@mitre.orghttps://usn.ubuntu.com/4164-1/Third Party Advisory
cve@mitre.orghttps://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2019/11/17/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471Issue Tracking, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2019/07/msg00020.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/
af854a3a-2127-422b-91ae-364da2661108https://oss-fuzz.com/testcase-detail/5631739747106816Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20190806-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200122-0003/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4164-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.htmlThird Party Advisory
Impacted products
Vendor Product Version
xmlsoft libxslt 1.1.33
debian debian_linux 8.0
canonical ubuntu_linux 12.04
canonical ubuntu_linux 14.04
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.04
canonical ubuntu_linux 19.10
fedoraproject fedora 31
opensuse leap 15.1
oracle openjdk 8


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xmlsoft:libxslt:1.1.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBF9724E-ED48-45EB-92DF-1223ECF12693",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*",
              "matchCriteriaId": "CB66DB75-2B16-4EBF-9B93-CE49D8086E41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD783B0C-9246-47D9-A937-6144FE8BFF0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character."
    },
    {
      "lang": "es",
      "value": "En el archivo numbers.c en libxslt versi\u00f3n 1.1.33, un xsl:number con ciertas cadenas de formato conllevar\u00eda a una lectura no inicializada en la funci\u00f3n xsltNumberFormatInsertNumbers. Esto podr\u00eda permitir a un atacante discernir si un byte en la pila contiene los caracteres A, a, I, i o 0, o cualquier otro car\u00e1cter."
    }
  ],
  "id": "CVE-2019-13117",
  "lastModified": "2024-11-21T04:24:13.630",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-07-01T02:15:09.737",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://oss-fuzz.com/testcase-detail/5631739747106816"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20190806-0004/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4164-1/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00062.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2019/11/17/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14471"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOYJKXPQCUNBMMQJWYXOR6QRUJZHEDRZ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://oss-fuzz.com/testcase-detail/5631739747106816"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20190806-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4164-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-908"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:16
Modified
2024-11-21 06:12
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5000Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5012Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5000Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5012Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.3
oracle graalvm 21.2.0
oracle openjdk 7
oracle openjdk 8
oracle openjdk 11.0.12
oracle openjdk 17
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "53B2BB06-A2F7-4603-89C3-C8500E55483A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "01E88C86-8C04-4A4A-BF45-9082AA783056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "190C4FEC-ECFD-4E46-8C4D-F99241CF0F75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27723C4B-C434-4733-96E4-397AA6ECE601",
              "versionEndIncluding": "11.50.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Swing). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 y 21.2.0. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una negaci\u00f3n parcial de servicio (DOS parcial) de Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad no se aplica a las implantaciones de Java, normalmente en servidores, que cargan y ejecutan \u00fanicamente c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). CVSS 3.1 Puntuaci\u00f3n Base 5.3 (impactos en la Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)"
    }
  ],
  "id": "CVE-2021-35556",
  "lastModified": "2024-11-21T06:12:30.510",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-10-20T11:16:33.723",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2023-04-18 20:15
Modified
2024-11-21 07:43
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2023/09/msg00018.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20230427-0008/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.couchbase.com/alerts/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2023/dsa-5430Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2023/dsa-5478Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2023.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/09/msg00018.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230427-0008/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.couchbase.com/alerts/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5430Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5478Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2023.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.9
oracle graalvm 21.3.5
oracle graalvm 22.3.1
oracle jdk 1.8.0
oracle jdk 11.0.18
oracle jdk 17.0.6
oracle jdk 20
oracle jre 1.8.0
oracle jre 11.0.18
oracle jre 17.0.6
oracle jre 20
netapp 7-mode_transition_tool -
netapp brocade_san_navigator -
netapp cloud_insights_acquisition_unit -
netapp cloud_insights_storage_workload_security_agent -
netapp oncommand_insight -
debian debian_linux 10.0
debian debian_linux 11.0
debian debian_linux 12.0
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 20


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.9:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "FE7FF02E-5A54-47BD-8FAC-E1F1E23CBD0B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.5:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "725D21E1-8FEF-492C-9CCF-75DDD286FA71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:22.3.1:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CBC05434-18E2-43D2-901F-BA97A3A3AC3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update361:*:*:*:*:*:*",
              "matchCriteriaId": "BB648C28-DCDF-4CEE-816C-2D7EF91D2689",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA4C6A6B-46BA-471A-959C-D1819B5D5196",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "751BA15B-1950-4ABD-AFEB-B4F90587FF61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:20:*:*:*:*:*:*:*",
              "matchCriteriaId": "F26CDEF2-A840-4957-A390-19E48AEEC70A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update361:*:*:*:*:*:*",
              "matchCriteriaId": "DB18EEA4-9670-4EBC-8559-6766740980F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "B85FB47B-1A8B-4758-83A7-3AC5B74D73FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B973ADC-5F00-4CC5-985F-F4E1BB9FF1EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:20:*:*:*:*:*:*:*",
              "matchCriteriaId": "AC10C81D-E148-4208-BA86-086B935A1254",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:brocade_san_navigator:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "25FA7A4D-B0E2-423E-8146-E221AE2D6120",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B199052-5732-4726-B06B-A12C70DFB891",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "111E81BB-7D96-44EB-ACFA-415C3F3EA62A",
              "versionEndExcluding": "8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "90F6CEC5-2FD9-4ADB-9D86-B741C0ABCD7B",
              "versionEndIncluding": "11.0.18",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "83395182-E46E-47FF-A781-4EF235BC83B6",
              "versionEndIncluding": "17.0.6",
              "versionStartIncluding": "17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update322:*:*:*:*:*:*",
              "matchCriteriaId": "DAB4F663-BCAF-43DB-BCC3-24C060B0CBAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update332:*:*:*:*:*:*",
              "matchCriteriaId": "A8EF5BB8-7DAF-49B0-A11E-14E89EF7377A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update342:*:*:*:*:*:*",
              "matchCriteriaId": "383F0B07-59BF-4744-87F2-04C98BC183B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update352:*:*:*:*:*:*",
              "matchCriteriaId": "494C17C6-54A3-4BE6-A4FF-2D54DF2B38D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update362:*:*:*:*:*:*",
              "matchCriteriaId": "1058ABDC-D652-4E2D-964D-C9C98FD404F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:20:*:*:*:*:*:*:*",
              "matchCriteriaId": "77172BC0-8637-41F6-AE3B-83006D6735DE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).  Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and  22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."
    }
  ],
  "id": "CVE-2023-21939",
  "lastModified": "2024-11-21T07:43:57.377",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-04-18T20:15:14.690",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.couchbase.com/alerts/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5430"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5478"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00018.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20230427-0008/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.couchbase.com/alerts/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5430"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2023/dsa-5478"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2023.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-04-22 22:15
Modified
2024-11-21 06:02
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
secalert_us@oracle.comhttps://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposuresThird Party Advisory
secalert_us@oracle.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20210513-0001/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-4899Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposuresThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10366Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/04/msg00021.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210513-0001/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4899Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.10
oracle jdk 16.0.0
oracle jre 1.8.0
debian debian_linux 9.0
debian debian_linux 10.0
fedoraproject fedora 32
fedoraproject fedora 33
fedoraproject fedora 34
oracle graalvm 19.3.5
oracle graalvm 20.3.1.2
oracle graalvm 21.0.0.2
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 16
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp hci_management_node -
netapp solidfire -
netapp hci_compute_node -
netapp hci_storage_node -
mcafee epolicy_orchestrator *
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update291:*:*:*:*:*:*",
              "matchCriteriaId": "CC7644D5-EEA1-4FA8-8F5E-9C476DACF956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3484EAC9-2F68-4952-8F0B-D1B83B5956CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "5FCE2C42-BFFB-4E1E-9E37-07F334BA3C12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:16.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "16BDD043-0138-4F9E-A369-B1AA779CA4C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update281:*:*:*:*:*:*",
              "matchCriteriaId": "6DFA7B46-AA37-4943-81A1-DF8C7F2CB038",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "058C7C4B-D692-49DE-924A-C2725A8162D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "0F0434A5-F2A1-4973-917C-A95F2ABE97D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "96DD93E0-274E-4C36-99F3-EEF085E57655",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5344C25-BD71-4228-903F-E419A4455F5F",
              "versionEndIncluding": "11.0.10",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D1453F5-ABB5-48F8-9C1C-69EEEE3949A5",
              "versionEndIncluding": "13.0.6",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8602555C-1C07-4A4C-8DBB-5D304366A7E7",
              "versionEndIncluding": "15.0.2",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:16:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCFB65CD-98D5-4024-86CF-130D70DC5A5F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DEB4FB-A21D-4CB1-B522-EEE5093E8521",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5",
              "versionEndExcluding": "5.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*",
              "matchCriteriaId": "DB88C165-BB24-49FB-AAF6-087A766D5AD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
              "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
              "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*",
              "matchCriteriaId": "823DBE80-CB8D-4981-AE7C-28F3FDD40451",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u291, 8u281, 11.0.10, 16; Java SE Embedded: 8u281; Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 and 21.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. It can also be exploited by supplying untrusted data to APIs in the specified Component. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Libraries).\u0026#xa0;Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u291, 8u281, 11.0.10, 16;\u0026#xa0;Java SE integrado: 8u281;\u0026#xa0;Oracle GraalVM Enterprise Edition: 19.3.5, 20.3.1.2 y 21.0.0.2.\u0026#xa0;La vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.\u0026#xa0;Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n no autorizada del acceso a datos cr\u00edticos o todos los datos accesibles de Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition.\u0026#xa0;Nota: Esta vulnerabilidad se aplica a las implementaciones de Java que cargan y ejecutan c\u00f3digo que no es confiable (p. Ej.,\u0026#xa0;c\u00f3digo que proviene de Internet) y conf\u00eda en el sandbox de Java para la seguridad.\u0026#xa0;Tambi\u00e9n puede ser explotado proporcionando datos no confiables a las API en el Componente especificado.\u0026#xa0;CVSS 3.1 Puntuaci\u00f3n Base 5.9 (Impactos en la Integridad).\u0026#xa0;Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)"
    }
  ],
  "id": "CVE-2021-2161",
  "lastModified": "2024-11-21T06:02:30.543",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-04-22T22:15:13.037",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4899"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://docs.azul.com/core/zulu-openjdk/release-notes/april-2021.html#fixed-common-vulnerabilities-and-exposures"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5ACX4JEVYH6H4PSMGMYWTGABPOFPH3TS/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFXOKM2233JVGYDOWW77BN54X3GZTIBK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CG7EWXSO6JUCVHP7R3SOZQ7WPNBOISJH/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MAULPCQFLAMBJIS27YLNNX6IHRFJMVP4/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MVDY4T5XMSYDQT6RRKPMRCV4MVGS7KXF/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD3JEP4HPLK7MNZHVUMKIJPBP74M3A2V/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210513-0001/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4899"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-07-21 15:15
Modified
2025-05-27 16:45
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/08/msg00011.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20210723-0002/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-4946Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujul2021.htmlVendor Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/08/msg00011.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210723-0002/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4946Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2021.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 11
oracle openjdk 11.0.1
oracle openjdk 11.0.2
oracle openjdk 11.0.3
oracle openjdk 11.0.4
oracle openjdk 11.0.5
oracle openjdk 11.0.6
oracle openjdk 11.0.7
oracle openjdk 11.0.8
oracle openjdk 11.0.9
oracle openjdk 11.0.10
oracle openjdk 11.0.11
oracle openjdk 13
oracle openjdk 13.0.1
oracle openjdk 13.0.2
oracle openjdk 13.0.3
oracle openjdk 13.0.4
oracle openjdk 13.0.5
oracle openjdk 13.0.6
oracle openjdk 13.0.7
oracle openjdk 15
oracle openjdk 15.0.1
oracle openjdk 15.0.2
oracle openjdk 15.0.3
oracle openjdk 16
oracle openjdk 16.0.1
oracle graalvm 20.3.2
oracle graalvm 21.1.0
oracle jdk 1.8.0
oracle jdk 11.0.11
oracle jdk 16.0.1
oracle jre 1.8.0
oracle jre 11.0.11
oracle jre 16.0.1
debian debian_linux 9.0
debian debian_linux 10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update292:*:*:*:*:*:*",
              "matchCriteriaId": "71F08D72-37B5-49C2-B8C9-ECF0C9C435D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*",
              "matchCriteriaId": "465CFA59-8E94-415A-ACF0-E678826813BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BDC28A-484B-4D14-8D68-890450DCE3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "635DEFDD-4840-48C6-AB1C-ADAFF4A1E50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A221DB-1684-4C87-B576-0969FE13E1AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B86-3688-4A13-AB37-DBD0DA323202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E0085B-4748-4F79-BEF6-CD9C3D2E6FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C4DAA76-EAA9-4C85-A92A-181EA49F3270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "19FC2907-1712-4E81-AC35-E3A15BF27606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "140F8ECC-F5DB-474E-ADA4-99EC9FBA45EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7A1C3EA-BBF2-4A3F-BACE-D4A5CF9E9B88",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A001F5EC-B534-424E-A8E7-FD4B1DD94BB1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DF5E492-5C34-4ABB-9934-8C4CF29EE097",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD3A4AFB-8D76-4B16-A306-2A10F23E51EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1704C904-6E0A-4972-BC94-326D8BC6315A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35FA24D1-8BDA-4DD4-A74C-C041C44A1455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "790FD30A-CE27-4A1E-A753-BE0A6B17B262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "254B5086-305E-4A19-8845-02BF7B8AA3F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "D418243D-BE1E-4E43-915A-57208E9C38CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAA80ACA-8243-4E7E-98D7-594DDA75FBF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E2041A-65AB-4BFD-BDB7-2CA4711FDE2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "65118341-0005-405D-B688-A3D98FD97A76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8BB14B2-CA52-4439-A156-56C4CFF2F73A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0ADD6CAB-B69C-418A-817A-4AC02FA02FD4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE9026AD-DD0C-47F3-BE28-6C8A88D199C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:16:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCFB65CD-98D5-4024-86CF-130D70DC5A5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:16.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "24023B81-2034-4CDB-9116-D8D006FD600B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "C21EB1C3-3251-4B99-9D5F-E4E089E2EC62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.1.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CA0CBB5F-6CA5-4DFC-97A3-05643F8885DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update291:*:*:*:*:*:*",
              "matchCriteriaId": "791E436C-516A-423D-98A1-0F446C5027AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C0C71DD-48B0-4BB6-8A6E-A43E3161B825",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:16.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "10601225-3E13-45DC-A9E3-029AD286000C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update291:*:*:*:*:*:*",
              "matchCriteriaId": "34D8ED6C-86C3-4EFB-B94A-C7E4BE4D003F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "7029CB86-1358-478A-9062-0ECB77B8AAAE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:16.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "506059B3-3E98-4999-83A9-8AC6B0009820",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Hotspot). Las versiones compatibles que est\u00e1n afectadas son Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM Enterprise Edition: versiones 20.3.2 y 21.1.0. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito requieren una interacci\u00f3n humana de una persona diferente del atacante. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la toma de control de Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a las implementaciones de Java, generalmente en clientes que ejecutan aplicaciones Java Web Start dentro del sandbox o applets de Java dentro del sandbox, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo que proviene de Internet) y conf\u00edan en el sandbox de Java para la seguridad. Esta vulnerabilidad no se aplica a las implementaciones de Java, com\u00fanmente en servidores, que cargan y ejecutan solo c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). CVSS 3.1 Puntuaci\u00f3n Base 7.5 (Impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)"
    }
  ],
  "id": "CVE-2021-2388",
  "lastModified": "2025-05-27T16:45:29.283",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-07-21T15:15:40.827",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4946"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00011.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20210723-0002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-4946"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:16
Modified
2024-11-21 06:12
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5000Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5012Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5000Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5012Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.3
oracle graalvm 21.2.0
oracle openjdk 8
oracle openjdk 11.0.12
oracle openjdk 17
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "53B2BB06-A2F7-4603-89C3-C8500E55483A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "01E88C86-8C04-4A4A-BF45-9082AA783056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "190C4FEC-ECFD-4E46-8C4D-F99241CF0F75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27723C4B-C434-4733-96E4-397AA6ECE601",
              "versionEndIncluding": "11.50.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: JSSE). Las versiones compatibles que est\u00e1n afectadas son Java SE: 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 y 21.2.0. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de TLS comprometer Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una negaci\u00f3n parcial de servicio (DOS parcial) de Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad s\u00f3lo puede ser explotada al  suministrar datos a las API en el componente especificado sin usar aplicaciones Java Web Start no confiables o applets Java no confiables, como por ejemplo mediante un servicio web. CVSS 3.1 Puntuaci\u00f3n Base 5.3 (impactos en la Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)"
    }
  ],
  "id": "CVE-2021-35578",
  "lastModified": "2024-11-21T06:12:34.163",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-10-20T11:16:55.333",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-10-21 15:15
Modified
2025-05-27 16:41
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202101-19Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20201023-0004/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4779Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202101-19Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201023-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4779Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 11
oracle openjdk 11.0.1
oracle openjdk 11.0.2
oracle openjdk 11.0.3
oracle openjdk 11.0.4
oracle openjdk 11.0.5
oracle openjdk 11.0.6
oracle openjdk 11.0.7
oracle openjdk 11.0.8
oracle openjdk 13
oracle openjdk 13.0.1
oracle openjdk 13.0.2
oracle openjdk 13.0.3
oracle openjdk 13.0.4
oracle openjdk 15
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.8
oracle jdk 15
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.8
oracle jre 15
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services_proxy -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_unified_manager -
netapp santricity_cloud_connector -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
netapp hci_storage_node -
opensuse leap 15.2
debian debian_linux 9.0
debian debian_linux 10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*",
              "matchCriteriaId": "465CFA59-8E94-415A-ACF0-E678826813BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BDC28A-484B-4D14-8D68-890450DCE3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "635DEFDD-4840-48C6-AB1C-ADAFF4A1E50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A221DB-1684-4C87-B576-0969FE13E1AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B86-3688-4A13-AB37-DBD0DA323202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E0085B-4748-4F79-BEF6-CD9C3D2E6FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C4DAA76-EAA9-4C85-A92A-181EA49F3270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "19FC2907-1712-4E81-AC35-E3A15BF27606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "140F8ECC-F5DB-474E-ADA4-99EC9FBA45EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD3A4AFB-8D76-4B16-A306-2A10F23E51EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1704C904-6E0A-4972-BC94-326D8BC6315A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35FA24D1-8BDA-4DD4-A74C-C041C44A1455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "790FD30A-CE27-4A1E-A753-BE0A6B17B262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "254B5086-305E-4A19-8845-02BF7B8AA3F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "65118341-0005-405D-B688-A3D98FD97A76",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3D07DCC8-4D24-4B8F-B72E-83DC311BD683",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "AAC508A2-CF8A-4037-87C8-B87E19ABC644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "41F90A96-7F92-4DB8-9B76-BA558FDF9BBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3917541-7ACF-4033-86EC-DB54938DBF41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update271:*:*:*:*:*:*",
              "matchCriteriaId": "CD023425-3457-4ABC-B1CF-9BA2F68924F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "240E3859-040C-4E94-806C-E40E9E2C5EA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB90BAC0-EC64-48BF-9B22-41F5B540AB04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "4806C163-0E76-49C3-BE42-F90E4B451051",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFA6AD29-34C2-4FEC-9585-C42C6615C6CC",
              "versionEndIncluding": "11.60.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "23F148EC-6D6D-4C4F-B57C-CFBCD3D32B41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C18CA4B5-28FD-4199-B1F0-B1E59E920370",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB15BCF1-1B1D-49D8-9B76-46DCB10044DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*",
              "matchCriteriaId": "C57D2B31-9696-4451-BA04-D093FFCF7E39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DEB4FB-A21D-4CB1-B522-EEE5093E8521",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Libraries).\u0026#xa0;Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u271, 8u261, 11.0.8 y 15;\u0026#xa0;Java SE integrado: 8u261.\u0026#xa0;Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded.\u0026#xa0;Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Java SE, Java SE Embedded.\u0026#xa0;Nota: Aplica a la implementaci\u00f3n de cliente y servidor de Java.\u0026#xa0;Esta vulnerabilidad puede ser explotada por medio de unas aplicaciones Java Web Start en sandbox y applets de Java en sandbox.\u0026#xa0;Tambi\u00e9n puede explotarse proporcionando datos hacia las API en el Componente especificado sin usar aplicaciones Java Web Start en sandbox o applets de Java en sandbox, como por medio de un servicio web.\u0026#xa0;CVSS 3.1 Puntuaci\u00f3n Base 3.7 (Impactos de la Integridad).\u0026#xa0;Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)"
    }
  ],
  "id": "CVE-2020-14797",
  "lastModified": "2025-05-27T16:41:23.967",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-10-21T15:15:19.703",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4779"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4779"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-06-02 15:15
Modified
2024-11-21 06:21
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Summary
GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1954761Issue Tracking, Third Party Advisory
secalert@redhat.comhttps://security.gentoo.org/glsa/202208-31Third Party Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1954761Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202208-31Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
gstreamer_project gstreamer *
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
oracle openjdk 8


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gstreamer_project:gstreamer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "221254EA-BFFC-41D8-B255-9A0C5F625C6A",
              "versionEndExcluding": "1.18.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags."
    },
    {
      "lang": "es",
      "value": "GStreamer versiones anteriores a 1.18.4, puede llevar a cabo una lectura fuera de l\u00edmites al manejar determinadas etiquetas ID3v2"
    }
  ],
  "id": "CVE-2021-3522",
  "lastModified": "2024-11-21T06:21:45.420",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-02T15:15:07.857",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954761"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202208-31"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1954761"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202208-31"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-01-19 12:15
Modified
2024-11-21 06:44
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20220121-0007/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5057Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5058Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220121-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5057Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5058Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.4
oracle graalvm 21.3.0
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.13
oracle jdk 17.0.1
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.13
oracle jre 17.0.1
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_insights_acquisition_unit -
netapp cloud_secure_agent -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_storage_plugin -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 17
oracle openjdk 17.0.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "9F300E13-1B40-4B35-ACA5-4D402CD41055",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B10E38A6-783C-45A2-98A1-12FA1EB3D3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:*",
              "matchCriteriaId": "F3E9DB6B-06BC-47F9-AEB9-E36378A97543",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:*",
              "matchCriteriaId": "3C9591ED-CA9E-4844-9B7F-D477D7A51413",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7F43D86-B696-41E4-A288-6A2D43A1774A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3575C88F-05D3-49F6-A60B-7ED902E318F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update321:*:*:*:*:*:*",
              "matchCriteriaId": "C5988521-7571-4AE7-BD02-2C8765FC464B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update311:*:*:*:*:*:*",
              "matchCriteriaId": "29AB737A-FB85-4E91-B8D3-A4B9A780FC0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "90EC4B85-A88A-4EC3-9EA0-3A24874D5F87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "962026D1-1E50-480F-921C-C7EE32AA0107",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*",
              "matchCriteriaId": "82E94B87-065E-475F-815C-F49978CE22FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6489B616-476E-46AB-8795-7EFDD9074899",
              "versionEndIncluding": "11.0.13",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8A2B4B3-64EC-4930-9F31-202E4D19AF98",
              "versionEndIncluding": "13.0.9",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9DCD68-A054-456D-8A3C-15939F85DF90",
              "versionEndIncluding": "15.0.5",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update301:*:*:*:*:*:*",
              "matchCriteriaId": "95954182-9541-4181-9647-B17FA5A79F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update321:*:*:*:*:*:*",
              "matchCriteriaId": "EAFB6B15-4AE6-47FC-8847-9DFADB7AE253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE7858DA-58DE-4920-B678-7800BD084EA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: JAXP). Las versiones compatibles que est\u00e1n afectadas son Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 y 21.3.0. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso de lectura no autorizado a un subconjunto de datos accesibles de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad es aplicada a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada al usar APIs en el Componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1, Puntuaci\u00f3n base 5.3 (impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)"
    }
  ],
  "id": "CVE-2022-21296",
  "lastModified": "2024-11-21T06:44:20.930",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-01-19T12:15:12.587",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5057"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5058"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5057"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:17
Modified
2024-11-21 06:12
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5000Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5012Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5000Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5012Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.3
oracle graalvm 21.2.0
oracle openjdk 7
oracle openjdk 8
oracle openjdk 11.0.12
oracle openjdk 17
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "53B2BB06-A2F7-4603-89C3-C8500E55483A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "01E88C86-8C04-4A4A-BF45-9082AA783056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "190C4FEC-ECFD-4E46-8C4D-F99241CF0F75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: JSSE). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 y 21.2.0. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de TLS comprometer Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada al usar APIs en el Componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1 Puntuaci\u00f3n Base 3.7 (impactos en la Confidencialidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)"
    }
  ],
  "id": "CVE-2021-35603",
  "lastModified": "2024-11-21T06:12:37.800",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-10-20T11:17:05.727",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202006-22Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4668Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-22Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4668Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp plug-in_for_symantec_netbackup -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.1
opensuse leap 15.2
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "E3B8B378-3211-4E63-873D-A05574B39E14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "CEAD5DA3-6D7D-4127-8E58-E0ACA8A611D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update_251:*:*:*:*:*:*",
              "matchCriteriaId": "8F257E03-5BA1-4743-983A-6C08F8572FFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update_241:*:*:*:*:*:*",
              "matchCriteriaId": "C49049F7-8BA7-4787-8C55-CABFAB6BC0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
              "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Lightweight HTTP Server). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u251, 8u241, 11.0.6 y 14; Java SE Embedded: 8u241. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Java SE, Java SE Embedded, as\u00ed como el acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE, Java SE Embedded. Nota: Esta vulnerabilidad solo puede ser explotada al proporcionar datos a las API en el Componente especificado sin utilizar aplicaciones Java Web Start No Confiables o applets Java No Confiables, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 4.8 (Impactos de la confidencialidad y la integridad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
    }
  ],
  "id": "CVE-2020-2800",
  "lastModified": "2024-11-21T05:26:18.180",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:28.060",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202006-22Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4668Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-22Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4668Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.1
opensuse leap 15.2
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
mcafee epolicy_orchestrator 5.9.0
mcafee epolicy_orchestrator 5.9.1
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "E3B8B378-3211-4E63-873D-A05574B39E14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "CEAD5DA3-6D7D-4127-8E58-E0ACA8A611D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "221B755E-48C0-4530-AFBD-4B00CF6A696F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "27495366-B260-4F56-9BC2-9B862E7DCABC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
              "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEB90C24-D252-4099-A7A1-9F8754DFB4A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "106FDF5A-D377-4E5F-8BF9-09290019C98A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
              "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
              "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Security). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u251, 8u241, 11.0.6 y 14; Java SE Embedded: 8u241. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Java SE, Java SE Embedded. Nota: Se aplica a la implementaci\u00f3n de cliente y servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start dentro del sandbox y applets de Java dentro del sandbox. Tambi\u00e9n puede ser explotada al proporcionar datos hacia las API en el Componente especificado sin usar aplicaciones de Java Web Start dentro del sandbox o applets de Java dentro del sandbox, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 3.7 (Impactos de la disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    }
  ],
  "id": "CVE-2020-2773",
  "lastModified": "2024-11-21T05:26:13.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:26.547",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-07-15 18:15
Modified
2025-05-27 16:35
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202008-24Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200717-0005/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4453-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4734Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202008-24Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200717-0005/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4453-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4734Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jre 1.7.0
oracle jre 1.8.0
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.2
debian debian_linux 9.0
debian debian_linux 10.0
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 20.04
mcafee epolicy_orchestrator 5.9.0
mcafee epolicy_orchestrator 5.9.1
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "C9F6C698-54CB-4CBE-BBC9-2A059D419BAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "FF39F7B1-6571-4BF6-A58F-4A6801636217",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "127983EF-72C6-4DCA-923A-8C6D51380A7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "D2DD43D4-AF2E-41DF-90C0-F899C624430E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEB90C24-D252-4099-A7A1-9F8754DFB4A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "106FDF5A-D377-4E5F-8BF9-09290019C98A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
              "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
              "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and 8u251; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Libraries). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u261 y 8u251; Java SE Embedded: 8u251. La vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso de red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Java SE, Java SE Embedded. Nota: Aplica a la implementaci\u00f3n del cliente y el servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start en sandbox y applets de Java en sandbox. Tambi\u00e9n puede ser explotada mediante el suministro de datos a las API en el Componente especificado sin utilizar aplicaciones de Java Web Start en sandbox o applets de Java en sandbox, como por medio de un servicio web. CVSS 3.1 Puntuaci\u00f3n Base 3.7 (Impactos de la Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)"
    }
  ],
  "id": "CVE-2020-14578",
  "lastModified": "2025-05-27T16:35:52.807",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-07-15T18:15:23.833",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-24"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4453-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4734"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-24"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4453-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4734"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:16
Modified
2024-11-21 06:12
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5000Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5012Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5000Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-5012Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.3
oracle graalvm 21.2.0
oracle openjdk 7
oracle openjdk 8
oracle openjdk 11.0.12
oracle openjdk 17
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
fedoraproject fedora 33
fedoraproject fedora 34
fedoraproject fedora 35
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "53B2BB06-A2F7-4603-89C3-C8500E55483A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "01E88C86-8C04-4A4A-BF45-9082AA783056",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "190C4FEC-ECFD-4E46-8C4D-F99241CF0F75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
              "matchCriteriaId": "A930E247-0B43-43CB-98FF-6CE7B8189835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: ImageIO). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 y 21.2.0. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una negaci\u00f3n parcial de servicio (DOS parcial) de Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada al usar APIs en el Componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1 Puntuaci\u00f3n Base 5.3 (impactos en la Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)"
    }
  ],
  "id": "CVE-2021-35586",
  "lastModified": "2024-11-21T06:12:35.307",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-10-20T11:16:59.280",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00008.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5000"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2021/dsa-5012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:16
Modified
2024-11-21 06:12
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
References
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240621-0006/
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 8
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp santricity_unified_manager -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27723C4B-C434-4733-96E4-397AA6ECE601",
              "versionEndIncluding": "11.50.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Java SE de Oracle Java SE (componente: Deployment). La versi\u00f3n compatible que est\u00e1 afectada es Java SE: 8u301. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer Java SE. Los ataques con \u00e9xito requieren una interacci\u00f3n humana de una persona diferente del atacante. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la toma de control de Java SE. Nota: Esta vulnerabilidad se aplica a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad no se aplica a las implantaciones de Java, normalmente en servidores, que cargan y ejecutan \u00fanicamente c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). CVSS 3.1 Puntuaci\u00f3n Base 7.5 (impactos en la Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)"
    }
  ],
  "id": "CVE-2021-35560",
  "lastModified": "2024-11-21T06:12:31.217",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-10-20T11:16:35.240",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20211022-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2012-11-28 13:03
Modified
2025-04-11 00:51
Severity ?
Summary
Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
References
secalert@redhat.comhttp://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.htmlExploit
secalert@redhat.comhttp://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.htmlVendor Advisory
secalert@redhat.comhttp://www.kb.cert.org/vuls/id/903934US Government Resource
secalert@redhat.comhttp://www.nruns.com/_downloads/advisory28122011.pdf
secalert@redhat.comhttp://www.ocert.org/advisories/ocert-2011-003.html
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/06/15/12
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2012/06/17/1
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=750533
af854a3a-2127-422b-91ae-364da2661108http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/903934US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.nruns.com/_downloads/advisory28122011.pdf
af854a3a-2127-422b-91ae-364da2661108http://www.ocert.org/advisories/ocert-2011-003.html
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/06/15/12
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2012/06/17/1
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=750533
Impacted products
Vendor Product Version
oracle jdk *
oracle jdk 1.7.0
oracle jdk 1.7.0
oracle jdk 1.7.0
oracle jdk 1.7.0
oracle jdk 1.7.0
oracle jre *
oracle jre 1.7.0
oracle jre 1.7.0
oracle jre 1.7.0
oracle jre 1.7.0
oracle jre 1.7.0
oracle openjdk *
oracle openjdk 1.6.0
oracle openjdk 1.8.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:*:update5:*:*:*:*:*:*",
              "matchCriteriaId": "F20B2290-B3B8-41A1-AC5F-38CE0B2FD644",
              "versionEndIncluding": "1.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E44FC8AF-F76F-4A8E-8D03-4F8BCA8CB031",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "6152036D-6421-4AE4-9223-766FE07B5A44",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "D375CECB-405C-4E18-A7E8-9C5A2F97BD69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*",
              "matchCriteriaId": "52EEEA5A-E77C-43CF-A063-9D5C64EA1870",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*",
              "matchCriteriaId": "003746F6-DEF0-4D0F-AD97-9E335868E301",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:*:update5:*:*:*:*:*:*",
              "matchCriteriaId": "EBD01453-4644-47A2-9FD5-7606CCB483F6",
              "versionEndIncluding": "1.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C27372B-A091-46D5-AE39-A44BBB1D9EE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update1:*:*:*:*:*:*",
              "matchCriteriaId": "F4B153FD-E20B-4909-8B10-884E48F5B590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update2:*:*:*:*:*:*",
              "matchCriteriaId": "CB106FA9-26CE-48C5-AEA5-FD1A5454AEE2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update3:*:*:*:*:*:*",
              "matchCriteriaId": "5831D70B-3854-4CB8-B88D-40F1743DAEE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update4:*:*:*:*:*:*",
              "matchCriteriaId": "EEB101C9-CA38-4421-BC0C-C1AD47AA2CC9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E496C8B-BA28-4E4F-8168-10E623179DF9",
              "versionEndIncluding": "1.7.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:1.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A6505E4-8E6A-4888-8B9C-2B2C10546CB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:1.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CA81243-2FC7-481B-AFD8-067E3EC9DF77",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table."
    },
    {
      "lang": "es",
      "value": "Oracle Java SE anteriores a 7 Update 6, y OpenJDK 7 anteriores a 7u6 build 12 y 8 anteriores a build 39, calculan los valores de hash sin restringir la posibilidad de provocar colisiones hash previsibles, lo que permite a atacantes dependientes de contexto provocar una denegaci\u00f3n de servicio (consumo de CPU) a trav\u00e9s de la manipulaci\u00f3n de una entrada para la aplicaci\u00f3n que mantiene la tabla de valores hash."
    }
  ],
  "id": "CVE-2012-2739",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-11-28T13:03:09.793",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/903934"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ocert.org/advisories/ocert-2011-003.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/06/15/12"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/06/17/1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750533"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://armoredbarista.blogspot.de/2012/02/investigating-hashdos-issue.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://mail.openjdk.java.net/pipermail/core-libs-dev/2012-May/010238.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/903934"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.nruns.com/_downloads/advisory28122011.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ocert.org/advisories/ocert-2011-003.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/06/15/12"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/06/17/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=750533"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-01-19 12:15
Modified
2024-11-21 06:44
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20220121-0007/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5057Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5058Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/02/msg00011.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-05Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220121-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5057Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5058Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.4
oracle graalvm 21.3.0
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.13
oracle jdk 17.0.1
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.13
oracle jre 17.0.1
debian debian_linux 9.0
debian debian_linux 10.0
debian debian_linux 11.0
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_insights_acquisition_unit -
netapp cloud_secure_agent -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_storage_plugin -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 17
oracle openjdk 17.0.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.4:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "9F300E13-1B40-4B35-ACA5-4D402CD41055",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B10E38A6-783C-45A2-98A1-12FA1EB3D3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update321:*:*:*:*:*:*",
              "matchCriteriaId": "F3E9DB6B-06BC-47F9-AEB9-E36378A97543",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update311:*:*:*:*:*:*",
              "matchCriteriaId": "3C9591ED-CA9E-4844-9B7F-D477D7A51413",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7F43D86-B696-41E4-A288-6A2D43A1774A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3575C88F-05D3-49F6-A60B-7ED902E318F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update321:*:*:*:*:*:*",
              "matchCriteriaId": "C5988521-7571-4AE7-BD02-2C8765FC464B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update311:*:*:*:*:*:*",
              "matchCriteriaId": "29AB737A-FB85-4E91-B8D3-A4B9A780FC0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "90EC4B85-A88A-4EC3-9EA0-3A24874D5F87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "962026D1-1E50-480F-921C-C7EE32AA0107",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF971916-C526-43A9-BD80-985BCC476569",
              "versionEndIncluding": "11.70.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_storage_plugin:-:*:*:*:*:vcenter:*:*",
              "matchCriteriaId": "82E94B87-065E-475F-815C-F49978CE22FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*",
              "matchCriteriaId": "26A2B713-7D6D-420A-93A4-E0D983C983DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6489B616-476E-46AB-8795-7EFDD9074899",
              "versionEndIncluding": "11.0.13",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8A2B4B3-64EC-4930-9F31-202E4D19AF98",
              "versionEndIncluding": "13.0.9",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CF9DCD68-A054-456D-8A3C-15939F85DF90",
              "versionEndIncluding": "15.0.5",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update301:*:*:*:*:*:*",
              "matchCriteriaId": "95954182-9541-4181-9647-B17FA5A79F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update321:*:*:*:*:*:*",
              "matchCriteriaId": "EAFB6B15-4AE6-47FC-8847-9DFADB7AE253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D0A929D-6054-4EFB-8BAD-58826D22D34B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE7858DA-58DE-4920-B678-7800BD084EA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: ImageIO). Las versiones soportadas que est\u00e1n afectadas son Oracle Java SE: 7u321, 8u311, 11.0.13, 17.01; Oracle GraalVM Enterprise Edition: 20.3.4 y 21.3.0. Una vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una negaci\u00f3n parcial del servicio (DOS parcial) de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad es aplicada a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start con sandbox o applets Java con sandbox, que cargan y ejecutan c\u00f3digo que no es confiable (por ejemplo, c\u00f3digo que viene de Internet) y dependen de la sandbox de Java para la seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada al usar APIs en el Componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1, Puntuaci\u00f3n base 5.3 (impactos en la Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)"
    }
  ],
  "id": "CVE-2022-21365",
  "lastModified": "2024-11-21T06:44:31.517",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2022-01-19T12:15:15.770",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5057"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5058"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/02/msg00011.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220121-0007/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5057"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5058"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-07-19 22:15
Modified
2024-11-21 06:44
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202401-25
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5188Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2022/dsa-5192Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202401-25
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5188Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5192Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle graalvm 20.3.6
oracle graalvm 21.3.2
oracle graalvm 22.1.0
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.15.1
oracle jdk 17.0.3.1
oracle jdk 18.0.1.1
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.15.1
oracle jre 17.0.3.1
oracle jre 18.0.1.1
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 18
fedoraproject fedora 36
debian debian_linux 10.0
debian debian_linux 11.0
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_insights_acquisition_unit -
netapp cloud_secure_agent -
netapp hci_management_node -
netapp oncommand_insight -
netapp solidfire -
netapp hci_compute_node -
azul zulu 7.54
azul zulu 8.62
azul zulu 11.56
azul zulu 13.48
azul zulu 15.40
azul zulu 17.34
azul zulu 18.30


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "7D961E24-EA18-4217-B5F5-F847726D84E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "601D92C4-F71F-47E2-9041-5C286D2137F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B18FE85D-C53D-44E9-8992-715820D1264B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update343:*:*:*:*:*:*",
              "matchCriteriaId": "6E3C0BA3-FCD3-4CB8-B8C7-F931090A7DBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update333:*:*:*:*:*:*",
              "matchCriteriaId": "EB2A5440-7FA7-4A86-AA19-E2ABBD809B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C0485FC-E4B2-464E-8228-1387AC5F353B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AF3539B-0434-4310-AE88-F46864C7C20F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:18.0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5CC9398-71B6-4480-95ED-EDCE838D157E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update343:*:*:*:*:*:*",
              "matchCriteriaId": "60614E43-090E-44D7-94AD-FFAE38FF111F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update333:*:*:*:*:*:*",
              "matchCriteriaId": "131E1C9E-721C-4176-B78B-69C01F90A9A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4BFA12-588A-4D8D-B45F-648A55EC674C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DF70EEA-EC9D-4FFC-B7BE-76F50C34D999",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:18.0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EF9CFB1-CEC9-483E-BECF-618190C03944",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD2ADA66-DCD0-4D28-80B2-77A0265CE7B9",
              "versionEndIncluding": "11.0.15",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CA6BC07-2BDA-4913-AF2B-FD2146B0E539",
              "versionEndIncluding": "13.0.11",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A2E366B-549D-48C5-B3FB-AD0E8C75AE08",
              "versionEndIncluding": "15.0.7",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "15FD6A0B-BB1A-4875-926C-AB1B6EC1A053",
              "versionEndIncluding": "17.0.3",
              "versionStartIncluding": "17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update301:*:*:*:*:*:*",
              "matchCriteriaId": "95954182-9541-4181-9647-B17FA5A79F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update321:*:*:*:*:*:*",
              "matchCriteriaId": "EAFB6B15-4AE6-47FC-8847-9DFADB7AE253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update322:*:*:*:*:*:*",
              "matchCriteriaId": "DAB4F663-BCAF-43DB-BCC3-24C060B0CBAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update332:*:*:*:*:*:*",
              "matchCriteriaId": "A8EF5BB8-7DAF-49B0-A11E-14E89EF7377A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:18:*:*:*:*:*:*:*",
              "matchCriteriaId": "56CBFC1F-C120-44F2-877A-C1C880AA89C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:azul:zulu:7.54:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C77346-8893-44F0-B0D1-5D4D30A9CA3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:8.62:*:*:*:*:*:*:*",
              "matchCriteriaId": "63E58DE0-A96A-452E-986F-3BD2FEA7C723",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:11.56:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3FB1BF4-3FCF-4007-A9E3-97C35483D6A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:13.48:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD7A33EC-DE03-424F-9796-E5EA071FF6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:15.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCDAFFA9-0AA4-4C70-9154-8DA4BB255FD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:17.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6302149-28AA-481E-BC6C-87D05E73768A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:18.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "20DFD9D8-8648-40F7-81B8-04F852A337FA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Hotspot). Las versiones afectadas son Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 y 22.1.0. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Oracle Java SE, Oracle GraalVM Enterprise Edition. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la creaci\u00f3n no autorizada, la eliminaci\u00f3n o el acceso a la modificaci\u00f3n de datos cr\u00edticos o de todos los datos accesibles de Oracle Java SE, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad es aplicada a las implantaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start o applets Java con sandbox, que cargan y ejecutan c\u00f3digo no confiable (por ejemplo, c\u00f3digo procedente de Internet) y que dependen de la sandbox de Java para su seguridad. Esta vulnerabilidad tambi\u00e9n puede ser explotada mediante el uso de APIs en el componente especificado, por ejemplo, mediante un servicio web que suministra datos a las APIs. CVSS 3.1, Puntuaci\u00f3n Base 5.9 (impactos en la Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    }
  ],
  "id": "CVE-2022-21541",
  "lastModified": "2024-11-21T06:44:55.193",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "secalert_us@oracle.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-07-19T22:15:11.783",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://security.gentoo.org/glsa/202401-25"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5188"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5192"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202401-25"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5188"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5192"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-10-21 15:15
Modified
2025-05-27 16:40
Severity ?
4.2 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202101-19Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20201023-0004/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4779Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/10/msg00031.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202101-19Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201023-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4779Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 11
oracle openjdk 11.0.1
oracle openjdk 11.0.2
oracle openjdk 11.0.3
oracle openjdk 11.0.4
oracle openjdk 11.0.5
oracle openjdk 11.0.6
oracle openjdk 11.0.7
oracle openjdk 11.0.8
oracle openjdk 13
oracle openjdk 13.0.1
oracle openjdk 13.0.2
oracle openjdk 13.0.3
oracle openjdk 13.0.4
oracle openjdk 15
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.8
oracle jdk 15
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.8
oracle jre 15
debian debian_linux 9.0
debian debian_linux 10.0
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services_proxy -
netapp hci_management_node -
netapp oncommand_insight -
netapp oncommand_unified_manager -
netapp santricity_cloud_connector -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp solidfire -
netapp hci_storage_node -
mcafee epolicy_orchestrator 5.9.0
mcafee epolicy_orchestrator 5.9.1
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
opensuse leap 15.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*",
              "matchCriteriaId": "465CFA59-8E94-415A-ACF0-E678826813BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BDC28A-484B-4D14-8D68-890450DCE3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "635DEFDD-4840-48C6-AB1C-ADAFF4A1E50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A221DB-1684-4C87-B576-0969FE13E1AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B86-3688-4A13-AB37-DBD0DA323202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E0085B-4748-4F79-BEF6-CD9C3D2E6FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C4DAA76-EAA9-4C85-A92A-181EA49F3270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "19FC2907-1712-4E81-AC35-E3A15BF27606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "140F8ECC-F5DB-474E-ADA4-99EC9FBA45EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD3A4AFB-8D76-4B16-A306-2A10F23E51EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1704C904-6E0A-4972-BC94-326D8BC6315A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35FA24D1-8BDA-4DD4-A74C-C041C44A1455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "790FD30A-CE27-4A1E-A753-BE0A6B17B262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "254B5086-305E-4A19-8845-02BF7B8AA3F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "65118341-0005-405D-B688-A3D98FD97A76",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3D07DCC8-4D24-4B8F-B72E-83DC311BD683",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "AAC508A2-CF8A-4037-87C8-B87E19ABC644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "41F90A96-7F92-4DB8-9B76-BA558FDF9BBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3917541-7ACF-4033-86EC-DB54938DBF41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update271:*:*:*:*:*:*",
              "matchCriteriaId": "CD023425-3457-4ABC-B1CF-9BA2F68924F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update261:*:*:*:*:*:*",
              "matchCriteriaId": "240E3859-040C-4E94-806C-E40E9E2C5EA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB90BAC0-EC64-48BF-9B22-41F5B540AB04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:15:*:*:*:*:*:*:*",
              "matchCriteriaId": "4806C163-0E76-49C3-BE42-F90E4B451051",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFA6AD29-34C2-4FEC-9585-C42C6615C6CC",
              "versionEndIncluding": "11.60.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "23F148EC-6D6D-4C4F-B57C-CFBCD3D32B41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C18CA4B5-28FD-4199-B1F0-B1E59E920370",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB15BCF1-1B1D-49D8-9B76-46DCB10044DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:sap:*:*",
              "matchCriteriaId": "C57D2B31-9696-4451-BA04-D093FFCF7E39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DEB4FB-A21D-4CB1-B522-EEE5093E8521",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEB90C24-D252-4099-A7A1-9F8754DFB4A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "106FDF5A-D377-4E5F-8BF9-09290019C98A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Hotspot).\u0026#xa0;Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u271, 8u261, 11.0.8 y 15;\u0026#xa0;Java SE Embedded: 8u261.\u0026#xa0;Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded.\u0026#xa0;Los ataques con \u00e9xito requieren la interacci\u00f3n humana de una persona diferente del atacante.\u0026#xa0;Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en la actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Java SE, Java SE Embedded, as\u00ed como acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE, Java SE Embedded.\u0026#xa0;Nota: Aplica a la implementaci\u00f3n de cliente y servidor de Java.\u0026#xa0;Esta vulnerabilidad puede ser explotada mediante aplicaciones Java Web Start en sandbox y applets de Java en sandbox.\u0026#xa0;Tambi\u00e9n puede ser explotada al suministrar datos a las API en el Componente especificado sin utilizar aplicaciones Java Web Start en sandbox o applets de Java en sandbox, como mediante un servicio web.\u0026#xa0;CVSS 3.1 Puntuaci\u00f3n Base 4.2 (Impactos de la Confidencialidad e Integridad).\u0026#xa0;Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)"
    }
  ],
  "id": "CVE-2020-14792",
  "lastModified": "2025-05-27T16:40:24.447",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.5,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-10-21T15:15:19.327",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4779"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00031.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20201023-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4779"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-07-15 18:15
Modified
2025-05-27 16:35
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202008-24Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200717-0005/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4433-1/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4453-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4734Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/08/msg00021.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202008-24Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200717-0005/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4433-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4453-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4734Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 11
oracle openjdk 11.0.1
oracle openjdk 11.0.2
oracle openjdk 11.0.3
oracle openjdk 11.0.4
oracle openjdk 11.0.5
oracle openjdk 11.0.6
oracle openjdk 11.0.7
oracle openjdk 13
oracle openjdk 13.0.1
oracle openjdk 13.0.2
oracle openjdk 13.0.3
oracle openjdk 14
oracle jdk 1.8.0
oracle jdk 11.0.7
oracle jdk 14.0.1
oracle jre 1.8.0
oracle jre 11.0.7
oracle jre 14.0.1
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.1
opensuse leap 15.2
debian debian_linux 9.0
debian debian_linux 10.0
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 20.04
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*",
              "matchCriteriaId": "465CFA59-8E94-415A-ACF0-E678826813BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BDC28A-484B-4D14-8D68-890450DCE3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "635DEFDD-4840-48C6-AB1C-ADAFF4A1E50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A221DB-1684-4C87-B576-0969FE13E1AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B86-3688-4A13-AB37-DBD0DA323202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E0085B-4748-4F79-BEF6-CD9C3D2E6FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C4DAA76-EAA9-4C85-A92A-181EA49F3270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "19FC2907-1712-4E81-AC35-E3A15BF27606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD3A4AFB-8D76-4B16-A306-2A10F23E51EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1704C904-6E0A-4972-BC94-326D8BC6315A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35FA24D1-8BDA-4DD4-A74C-C041C44A1455",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "790FD30A-CE27-4A1E-A753-BE0A6B17B262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "FF39F7B1-6571-4BF6-A58F-4A6801636217",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A0D065C-C4AB-4558-86C3-9A89C9CADBF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D034E25-195A-4926-9FEC-A2B9F01E0CFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "D2DD43D4-AF2E-41DF-90C0-F899C624430E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3D66586-1585-42B2-8734-40FE8C7E5597",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "3794CCBE-8A61-44F0-99FC-E7C0773A8744",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Libraries). Las versiones compatibles que est\u00e1n afectadas son Java SE: 8u251, 11.0.7 y 14.0.1; Java SE Embedded: 8u251. La vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso de red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a algunos de los datos accesibles de Java SE, Java SE Embedded, as\u00ed como el acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE, Java SE Embedded. Nota: Aplica a la implementaci\u00f3n del cliente y el servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start en sandbox y applets de Java en sandbox. Tambi\u00e9n puede ser explotada mediante el suministro de datos a las API en el Componente especificado sin utilizar aplicaciones de Java Web Start en sandbox o applets de Java en sandbox, como por medio de un servicio web. CVSS 3.1 Puntuaci\u00f3n Base 4.8 (Impactos de la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)"
    }
  ],
  "id": "CVE-2020-14556",
  "lastModified": "2025-05-27T16:35:16.017",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2020-07-15T18:15:20.037",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-24"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4433-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4453-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4734"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202008-24"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200717-0005/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4433-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4453-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4734"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2014-05-14 00:55
Modified
2025-04-12 10:46
Severity ?
Summary
Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405.
References
secalert_us@oracle.comhttp://secunia.com/advisories/58415Vendor Advisory
secalert_us@oracle.comhttp://www.debian.org/security/2014/dsa-2912
secalert_us@oracle.comhttp://www.ubuntu.com/usn/USN-2191-1
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58415Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2014/dsa-2912
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-2191-1
Impacted products
Vendor Product Version
oracle openjdk 1.6.0
canonical ubuntu_linux 10.04
canonical ubuntu_linux 12.04
debian debian_linux *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:1.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A6505E4-8E6A-4888-8B9C-2B2C10546CB6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "7118F616-25CA-4E34-AA13-4D14BB62419F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
              "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C8919F1-CD33-437E-9627-69352B276BA3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in OpenJDK 6 before 6b31 on Debian GNU/Linux and Ubuntu 12.04 LTS and 10.04 LTS has unknown impact and attack vectors, a different vulnerability than CVE-2014-2405."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en OpenJDK 6 anterior a 6b31 en Debian GNU/Linux y Ubuntu 12.04 LTS y 10.04 LTS tiene impacto y vectores de ataque desconocidos, una vulnerabilidad diferente a CVE-2014-2405."
    }
  ],
  "id": "CVE-2014-0462",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-05-14T00:55:07.820",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/58415"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.debian.org/security/2014/dsa-2912"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "http://www.ubuntu.com/usn/USN-2191-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/58415"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2014/dsa-2912"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2191-1"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-01-15 17:15
Modified
2024-11-21 05:25
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0122Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0128Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0157Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0196Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0202Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0231Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0232Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0541Third Party Advisory
secalert_us@oracle.comhttps://access.redhat.com/errata/RHSA-2020:0632Third Party Advisory
secalert_us@oracle.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10315Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://seclists.org/bugtraq/2020/Feb/22Issue Tracking, Mailing List, Third Party Advisory
secalert_us@oracle.comhttps://seclists.org/bugtraq/2020/Jan/24Issue Tracking, Mailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202101-19Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200122-0003/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4257-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4605Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4621Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0122Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0128Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0157Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0196Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0202Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0231Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0232Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0541Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0632Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10315Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/02/msg00034.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2020/Feb/22Issue Tracking, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2020/Jan/24Issue Tracking, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202101-19Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200122-0003/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4257-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4605Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4621Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.5
oracle jdk 13.0.1
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.5
oracle jre 13.0.1
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
redhat enterprise_linux_desktop 6.0
redhat enterprise_linux_desktop 7.0
redhat enterprise_linux_eus 7.7
redhat enterprise_linux_eus 8.1
redhat enterprise_linux_server_aus 7.7
redhat enterprise_linux_server_tus 7.7
redhat enterprise_linux_workstation 6.0
redhat enterprise_linux_workstation 7.0
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 11
oracle openjdk 11.0.1
oracle openjdk 11.0.2
oracle openjdk 11.0.3
oracle openjdk 11.0.4
oracle openjdk 11.0.5
oracle openjdk 13
oracle openjdk 13.0.1
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp e-series_performance_analyzer -
netapp e-series_santricity_management_plug-ins -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_storage_manager -
netapp e-series_santricity_web_services_proxy -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp steelstore_cloud_integrated_storage -
mcafee epolicy_orchestrator 5.9.0
mcafee epolicy_orchestrator 5.9.1
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
opensuse leap 15.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "01981FC7-F8D7-4268-9FF8-2F5968A8ECC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update231:*:*:*:*:*:*",
              "matchCriteriaId": "8836399B-AA1F-45DB-A423-B41A93A14281",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "89175649-A3CE-4A15-B875-C93D289F8307",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "665B33FE-52FE-4E17-8A80-D61656C49900",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update_241:*:*:*:*:*:*",
              "matchCriteriaId": "405536FF-8BB9-4926-97E3-61BAA3A75E08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update_231:*:*:*:*:*:*",
              "matchCriteriaId": "52496989-B639-4E8E-8319-D5D9FE5B30DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FB7666-E40E-45A6-9F87-A51B9D7E8EBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BF92693-510C-48A4-ABFC-AD975DB971CF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "83737173-E12E-4641-BC49-0BD84A6B29D0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "92BC9265-6959-4D37-BE5E-8C45E98992F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "7431ABC1-9252-419E-8CC1-311B41360078",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "17F256A9-D3B9-4C72-B013-4EFD878BFEA8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11:*:*:*:*:*:*:*",
              "matchCriteriaId": "465CFA59-8E94-415A-ACF0-E678826813BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "85BDC28A-484B-4D14-8D68-890450DCE3F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "635DEFDD-4840-48C6-AB1C-ADAFF4A1E50C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "40A221DB-1684-4C87-B576-0969FE13E1AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE6A1B86-3688-4A13-AB37-DBD0DA323202",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:11.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E0085B-4748-4F79-BEF6-CD9C3D2E6FE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13:*:*:*:*:*:*:*",
              "matchCriteriaId": "FD3A4AFB-8D76-4B16-A306-2A10F23E51EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:13.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1704C904-6E0A-4972-BC94-326D8BC6315A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "0CB28AF5-5AF0-4475-A7B6-12E1795FFDCB",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:vmware_vcenter:*:*",
              "matchCriteriaId": "280520BC-070C-4423-A633-E6FE45E53D57",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFA6AD29-34C2-4FEC-9585-C42C6615C6CC",
              "versionEndIncluding": "11.60.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D9CC59D-6182-4B5E-96B5-226FCD343916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services_proxy:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "23F148EC-6D6D-4C4F-B57C-CFBCD3D32B41",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEB90C24-D252-4099-A7A1-9F8754DFB4A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "106FDF5A-D377-4E5F-8BF9-09290019C98A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE de Oracle Java SE (componente: Libraries). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u241, 8u231, 11.0.5 y 13.0.1. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada para causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Java SE. Nota: Esta vulnerabilidad solo puede ser explotada proporcionando datos a las API en el Componente especificado sin utilizar aplicaciones Java Web Start no confiables o applets Java no confiables, as\u00ed como por medio de un servicio web. CVSS 3.0 Puntaje Base 3.7 (Impactos en la Disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    }
  ],
  "id": "CVE-2020-2654",
  "lastModified": "2024-11-21T05:25:54.230",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-01-15T17:15:24.050",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0122"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0128"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0157"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0196"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0202"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0231"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0232"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0541"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0632"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2020/Feb/22"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2020/Jan/24"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4257-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4605"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4621"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0122"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0128"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0157"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0196"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0202"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0231"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0232"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0541"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/errata/RHSA-2020:0632"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10315"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2020/Feb/22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/bugtraq/2020/Jan/24"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202101-19"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200122-0003/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4257-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4605"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4621"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202006-22Third Party Advisory
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-15Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4668Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://kc.mcafee.com/corporate/index?page=content&id=SB10332Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202006-22Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-15Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4668Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
fedoraproject fedora 30
fedoraproject fedora 31
fedoraproject fedora 32
opensuse leap 15.1
opensuse leap 15.2
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
debian debian_linux 8.0
debian debian_linux 9.0
debian debian_linux 10.0
mcafee epolicy_orchestrator *
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0
mcafee epolicy_orchestrator 5.10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "E3B8B378-3211-4E63-873D-A05574B39E14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "CEAD5DA3-6D7D-4127-8E58-E0ACA8A611D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update251:*:*:*:*:*:*",
              "matchCriteriaId": "221B755E-48C0-4530-AFBD-4B00CF6A696F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update241:*:*:*:*:*:*",
              "matchCriteriaId": "27495366-B260-4F56-9BC2-9B862E7DCABC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
              "matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E5302AA-9FB5-4F30-9E75-43796783E906",
              "versionEndExcluding": "5.10.0",
              "versionStartIncluding": "5.9.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
              "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
              "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE, Java SE Embedded de Oracle Java SE (componente: Serialization). Las versiones compatibles que est\u00e1n afectadas son Java SE: 7u251, 8u241, 11.0.6 y 14; Java SE Embedded: 8u241. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de m\u00faltiples protocolos comprometer a Java SE, Java SE Embedded. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una capacidad no autorizada de causar una denegaci\u00f3n de servicio parcial (DOS parcial) de Java SE, Java SE Embedded. Nota: Se aplica a la implementaci\u00f3n de cliente y servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start dentro del sandbox  y applets de Java dentro del sandbox . Tambi\u00e9n puede ser explotada al proporcionar datos a las API en el Componente especificado sin usar  aplicaciones de Java Web Start dentro del sandbox o applets de Java dentro del sandbox, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 3.7 (Impactos de la disponibilidad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)."
    }
  ],
  "id": "CVE-2020-2757",
  "lastModified": "2024-11-21T05:26:11.117",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:25.547",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "secalert_us@oracle.com",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10332"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202006-22"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.gentoo.org/glsa/202209-15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4668"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2024-01-16 22:15
Modified
2025-03-26 15:03
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2024/01/msg00023.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20240201-0002/Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpujan2024.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/01/msg00023.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240201-0002/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2024.htmlPatch, Vendor Advisory
Impacted products
Vendor Product Version
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle graalvm 20.3.12
oracle graalvm 21.3.8
oracle graalvm 22.3.4
oracle graalvm_for_jdk 17.0.9
oracle graalvm_for_jdk 21.0.1
oracle jdk 1.8.0
oracle jdk 1.8.0
oracle jdk 11.0.21
oracle jdk 17.0.9
oracle jdk 21.0.1
oracle jre 1.8.0
oracle jre 1.8.0
oracle jre 11.0.21
oracle jre 17.0.9
oracle jre 21.0.1
netapp cloud_insights_acquisition_unit -
netapp cloud_insights_storage_workload_security_agent -
netapp oncommand_insight -
debian debian_linux 10.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE2E2756-6ECC-4205-BED6-1A7DAB6D1C45",
              "versionEndExcluding": "11.0.24",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD9DA0F-9664-4C81-882F-68DBBC323F5E",
              "versionEndExcluding": "17.0.10",
              "versionStartIncluding": "17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "231952D6-6C9A-4C31-A338-1AA8C3D4F433",
              "versionEndExcluding": "21.0.2",
              "versionStartIncluding": "21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update322:*:*:*:*:*:*",
              "matchCriteriaId": "DAB4F663-BCAF-43DB-BCC3-24C060B0CBAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update332:*:*:*:*:*:*",
              "matchCriteriaId": "A8EF5BB8-7DAF-49B0-A11E-14E89EF7377A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update342:*:*:*:*:*:*",
              "matchCriteriaId": "383F0B07-59BF-4744-87F2-04C98BC183B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update352:*:*:*:*:*:*",
              "matchCriteriaId": "494C17C6-54A3-4BE6-A4FF-2D54DF2B38D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update362:*:*:*:*:*:*",
              "matchCriteriaId": "1058ABDC-D652-4E2D-964D-C9C98FD404F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update372:*:*:*:*:*:*",
              "matchCriteriaId": "DC62A8BB-6230-4D5A-B91C-DD1B222F9E5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update382:*:*:*:*:*:*",
              "matchCriteriaId": "333F58FD-5F4F-4F11-B1F8-8815C99AC61A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update392:*:*:*:*:*:*",
              "matchCriteriaId": "1CB4456E-18B0-4C5B-822E-2BFE7DE019D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b00:*:*:*:*:*:*",
              "matchCriteriaId": "3FCE7DD4-EF50-4F46-B5E1-F5F0B31C2A69",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b01:*:*:*:*:*:*",
              "matchCriteriaId": "60538D83-D9A2-4A8E-ADCA-25ACDE789D11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b02:*:*:*:*:*:*",
              "matchCriteriaId": "823D1593-CCB9-4172-85FE-3F7EC57E966A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b03:*:*:*:*:*:*",
              "matchCriteriaId": "3723D31F-21F3-4040-A59D-6F4FE4D38033",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b04:*:*:*:*:*:*",
              "matchCriteriaId": "60C2BD46-0BF0-4960-9070-41EF8BD86606",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update402-b05:*:*:*:*:*:*",
              "matchCriteriaId": "4B43831A-21CF-4A2D-AF1E-C909954E4713",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.12:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "D17D1EA4-A45F-4D8D-BA3E-4898EC6D48B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.8:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "CF534BA8-A2A5-4768-A480-CFB885308AF8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:22.3.4:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "876A5640-82A8-4BDC-8E0A-4D6340F5417D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C5055FD-0E19-4C42-9B1F-CBE222855156",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "04738DE7-2BFE-4C06-ABE0-FCA099B5FFEC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update391:*:*:-:*:*:*",
              "matchCriteriaId": "D667746E-7E7C-4326-9B70-3587C2B41BAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update391:*:*:enterprise_performance_pack:*:*:*",
              "matchCriteriaId": "F3EF33DE-2E3F-4D5A-BF06-AC3C75108089",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FFC5C12-7FF4-48E6-BC5A-F50EBC956BBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF6AA431-8965-4B53-AF0F-DB3AB7A9A3F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:21.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C5781C-4153-431D-991E-637E253EDC87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update391:*:*:-:*:*:*",
              "matchCriteriaId": "CA31F3A1-07E1-4685-8A24-7C7830EF7600",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update391:*:*:enterprise_performance_pack:*:*:*",
              "matchCriteriaId": "DB7CD545-5B56-47FC-803F-8F150C810534",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "568F994E-135F-486D-B57C-0245A1BC253B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF274813-F650-447C-A1A6-61D5F8FF71BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:21.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F76A51BB-6DAE-4506-B737-7A5854543F18",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B199052-5732-4726-B06B-A12C70DFB891",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and  22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM para JDK, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Seguridad). Las versiones compatibles que se ven afectadas son Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM para JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 y 22.3.4. Una vulnerabilidad dif\u00edcil de explotar permite que un atacante no autenticado con acceso a la red a trav\u00e9s de m\u00faltiples protocolos comprometa Oracle Java SE, Oracle GraalVM para JDK y Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a la creaci\u00f3n, eliminaci\u00f3n o modificaci\u00f3n de datos cr\u00edticos o a todos los datos accesibles de Oracle Java SE, Oracle GraalVM para JDK, Oracle GraalVM Enterprise Edition, as\u00ed como acceso no autorizado a datos cr\u00edticos o acceso completo a todo Oracle Java. SE, Oracle GraalVM para JDK, datos accesibles de Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, normalmente en clientes que ejecutan aplicaciones Java Web Start en sandbox o subprogramas de Java en sandbox, que cargan y ejecutan c\u00f3digo que no es de confianza (por ejemplo, c\u00f3digo que proviene de Internet) y dependen del entorno limitado de Java para su seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, normalmente en servidores, que cargan y ejecutan s\u00f3lo c\u00f3digo confiable (por ejemplo, c\u00f3digo instalado por un administrador). CVSS 3.1 Puntaje base 7.4 (Impactos en la confidencialidad y la integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."
    }
  ],
  "id": "CVE-2024-20952",
  "lastModified": "2025-03-26T15:03:47.983",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "secalert_us@oracle.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-01-16T22:15:42.477",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20240201-0002/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20240201-0002/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujan2024.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_backup -
netapp cloud_secure_agent -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp plug-in_for_symantec_netbackup -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
debian debian_linux 10.0
opensuse leap 15.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5DA53D-744B-4087-AEA9-257F18949E4D",
              "versionEndIncluding": "11.70.2",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE de Oracle Java SE (componente: JSSE). Las versiones compatibles que est\u00e1n afectadas son Java SE: 11.0.6 y 14. Una vulnerabilidad dif\u00edcil de explotar permite a un atacante no autenticado con acceso a la red por medio de HTTPS comprometer a Java SE. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en un acceso de lectura no autorizado a un subconjunto de datos accesibles de Java SE. Nota: Se aplica a la implementaci\u00f3n de cliente y servidor de Java. Esta vulnerabilidad puede ser explotada por medio de aplicaciones Java Web Start dentro del sandbox y applets de Java dentro del sandbox. Tambi\u00e9n puede ser explotada al proporcionar datos hacia las API en el Componente especificado sin usar aplicaciones de Java Web Start dentro del sandbox o applets de Java dentro del sandbox, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 3.7 (Impactos de la confidencialidad). Vector CVSS: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."
    }
  ],
  "id": "CVE-2020-2778",
  "lastModified": "2024-11-21T05:26:14.757",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:26.843",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2022-07-19 18:15
Modified
2024-11-21 07:08
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.
References
security@apache.orghttp://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/11/04/8Mailing List, Third Party Advisory
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/11/07/2Mailing List, Third Party Advisory
security@apache.orghttps://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue Tracking, Mailing List, Vendor Advisory
security@apache.orghttps://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue Tracking, Mailing List, Vendor Advisory
security@apache.orghttps://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing List, Third Party Advisory
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
security@apache.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
security@apache.orghttps://security.gentoo.org/glsa/202401-25
security@apache.orghttps://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
security@apache.orghttps://security.netapp.com/advisory/ntap-20240621-0006/
security@apache.orghttps://www.debian.org/security/2022/dsa-5188Third Party Advisory
security@apache.orghttps://www.debian.org/security/2022/dsa-5192Third Party Advisory
security@apache.orghttps://www.debian.org/security/2022/dsa-5256Third Party Advisory
security@apache.orghttps://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.htmlThird Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/19/5Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/19/6Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/20/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/07/20/3Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/10/18/2Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/11/04/8Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/11/07/2Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kywIssue Tracking, Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8Issue Tracking, Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/10/msg00024.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202401-25
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220729-0009/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5188Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5192Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5256Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
apache xalan-java *
debian debian_linux 10.0
debian debian_linux 11.0
oracle graalvm 20.3.6
oracle graalvm 21.3.2
oracle graalvm 22.1.0
oracle jdk 1.7.0
oracle jdk 1.8.0
oracle jdk 11.0.15.1
oracle jdk 17.0.3.1
oracle jdk 18.0.1.1
oracle jre 1.7.0
oracle jre 1.8.0
oracle jre 11.0.15.1
oracle jre 17.0.3.1
oracle jre 18.0.1.1
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 18
fedoraproject fedora 35
fedoraproject fedora 36
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_insights_acquisition_unit -
netapp cloud_secure_agent -
netapp hci_management_node -
netapp oncommand_insight -
netapp solidfire -
netapp hci_compute_node -
azul zulu 6.47
azul zulu 7.54
azul zulu 8.62
azul zulu 11.56
azul zulu 13.48
azul zulu 15.40
azul zulu 17.34
azul zulu 18.30


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:xalan-java:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E406791B-F9FD-4E3F-831C-296D8F8FF9BE",
              "versionEndIncluding": "2.7.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:20.3.6:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "7D961E24-EA18-4217-B5F5-F847726D84E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:21.3.2:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "601D92C4-F71F-47E2-9041-5C286D2137F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:graalvm:22.1.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B18FE85D-C53D-44E9-8992-715820D1264B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.7.0:update343:*:*:*:*:*:*",
              "matchCriteriaId": "6E3C0BA3-FCD3-4CB8-B8C7-F931090A7DBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update333:*:*:*:*:*:*",
              "matchCriteriaId": "EB2A5440-7FA7-4A86-AA19-E2ABBD809B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C0485FC-E4B2-464E-8228-1387AC5F353B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:17.0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AF3539B-0434-4310-AE88-F46864C7C20F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:18.0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5CC9398-71B6-4480-95ED-EDCE838D157E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.7.0:update343:*:*:*:*:*:*",
              "matchCriteriaId": "60614E43-090E-44D7-94AD-FFAE38FF111F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:1.8.0:update333:*:*:*:*:*:*",
              "matchCriteriaId": "131E1C9E-721C-4176-B78B-69C01F90A9A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD4BFA12-588A-4D8D-B45F-648A55EC674C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:17.0.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DF70EEA-EC9D-4FFC-B7BE-76F50C34D999",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:18.0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EF9CFB1-CEC9-483E-BECF-618190C03944",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD2ADA66-DCD0-4D28-80B2-77A0265CE7B9",
              "versionEndIncluding": "11.0.15",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CA6BC07-2BDA-4913-AF2B-FD2146B0E539",
              "versionEndIncluding": "13.0.11",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A2E366B-549D-48C5-B3FB-AD0E8C75AE08",
              "versionEndIncluding": "15.0.7",
              "versionStartIncluding": "15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "15FD6A0B-BB1A-4875-926C-AB1B6EC1A053",
              "versionEndIncluding": "17.0.3",
              "versionStartIncluding": "17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update261:*:*:*:*:*:*",
              "matchCriteriaId": "02C55E2E-AEDE-455C-B128-168C918B5D97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update271:*:*:*:*:*:*",
              "matchCriteriaId": "81831D37-6597-441B-87DE-38F7191BEA42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update281:*:*:*:*:*:*",
              "matchCriteriaId": "EEA1594D-0AB5-436D-9E60-C26EE2175753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update291:*:*:*:*:*:*",
              "matchCriteriaId": "B868FA41-C71B-491C-880B-484740B30C72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update301:*:*:*:*:*:*",
              "matchCriteriaId": "95954182-9541-4181-9647-B17FA5A79F9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update311:*:*:*:*:*:*",
              "matchCriteriaId": "9F6F0137-F91F-4028-BED2-C29640D52C23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update321:*:*:*:*:*:*",
              "matchCriteriaId": "EAFB6B15-4AE6-47FC-8847-9DFADB7AE253",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone1:*:*:*:*:*:*",
              "matchCriteriaId": "7A165D71-71CC-4E6A-AA4F-FF8DB5B9A5AB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone2:*:*:*:*:*:*",
              "matchCriteriaId": "7417B2BB-9AC2-4AF4-A828-C89A0735AD92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone3:*:*:*:*:*:*",
              "matchCriteriaId": "6A0A57B5-6F88-4288-9CDE-F6613FE068D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone4:*:*:*:*:*:*",
              "matchCriteriaId": "67ED8559-C348-4932-B7CE-CB96976A30EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone5:*:*:*:*:*:*",
              "matchCriteriaId": "40AC3D91-263F-4345-9FAA-0E573EA64590",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone6:*:*:*:*:*:*",
              "matchCriteriaId": "DD92AFA9-81F8-48D4-B79A-E7F066F69A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone7:*:*:*:*:*:*",
              "matchCriteriaId": "2C4B2F24-A730-4818-90C8-A2D90C081F03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone8:*:*:*:*:*:*",
              "matchCriteriaId": "464087F2-C285-4574-957E-CE0663F07DE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:milestone9:*:*:*:*:*:*",
              "matchCriteriaId": "3E9BB880-A4F6-4887-8BB9-47AA298753D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update222:*:*:*:*:*:*",
              "matchCriteriaId": "435CF189-0BD8-40DF-A0DC-99862CDEAF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update232:*:*:*:*:*:*",
              "matchCriteriaId": "A18F994F-72CA-4AF5-A7D1-9F5AEA286D85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update242:*:*:*:*:*:*",
              "matchCriteriaId": "9BD90D3D-9B3A-4101-9A8A-5090F0A9719F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update252:*:*:*:*:*:*",
              "matchCriteriaId": "F5A40B8A-D428-4008-9F21-AF21394C51D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update262:*:*:*:*:*:*",
              "matchCriteriaId": "FEC5B777-01E1-45EE-AF95-C3BD1F098B2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update271:*:*:*:*:*:*",
              "matchCriteriaId": "3B504718-5DCE-43B4-B19A-C6B6E7444BD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update281:*:*:*:*:*:*",
              "matchCriteriaId": "3102AA10-99A8-49A9-867E-7EEC56865680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update282:*:*:*:*:*:*",
              "matchCriteriaId": "5A55CBC7-A7B2-4B89-8AB5-ED30DBE6814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update291:*:*:*:*:*:*",
              "matchCriteriaId": "15BA8A26-2CDA-442B-A549-6BE92DCCD205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update301:*:*:*:*:*:*",
              "matchCriteriaId": "56F2883B-6A1B-4081-8877-07AF3A73F6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update302:*:*:*:*:*:*",
              "matchCriteriaId": "98C0742E-ACDD-4DB4-8A4C-B96702C8976C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update312:*:*:*:*:*:*",
              "matchCriteriaId": "1716A5CD-1C32-4F19-9DDE-F9C7CCB6B420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update322:*:*:*:*:*:*",
              "matchCriteriaId": "DAB4F663-BCAF-43DB-BCC3-24C060B0CBAB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update332:*:*:*:*:*:*",
              "matchCriteriaId": "A8EF5BB8-7DAF-49B0-A11E-14E89EF7377A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:18:*:*:*:*:*:*:*",
              "matchCriteriaId": "56CBFC1F-C120-44F2-877A-C1C880AA89C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
              "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
              "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
              "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_insights_acquisition_unit:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCAA4004-9319-478C-9D55-0E8307F872F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:azul:zulu:6.47:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E4633C4-E552-439D-8FE4-139E3A7956CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:7.54:*:*:*:*:*:*:*",
              "matchCriteriaId": "50C77346-8893-44F0-B0D1-5D4D30A9CA3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:8.62:*:*:*:*:*:*:*",
              "matchCriteriaId": "63E58DE0-A96A-452E-986F-3BD2FEA7C723",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:11.56:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3FB1BF4-3FCF-4007-A9E3-97C35483D6A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:13.48:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD7A33EC-DE03-424F-9796-E5EA071FF6CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:15.40:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCDAFFA9-0AA4-4C70-9154-8DA4BB255FD2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:17.34:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6302149-28AA-481E-BC6C-87D05E73768A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:azul:zulu:18.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "20DFD9D8-8648-40F7-81B8-04F852A337FA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan."
    },
    {
      "lang": "es",
      "value": "La biblioteca Apache Xalan Java XSLT es vulnerable a un problema de truncamiento de enteros cuando procesa hojas de estilo XSLT maliciosas. Esto puede usarse para corromper los archivos de clase Java generados por el compilador interno XSLTC y ejecutar c\u00f3digo de bytes Java arbitrario. El proyecto Apache Xalan Java est\u00e1 inactivo y en proceso de ser retirado. No son esperadas futuras versiones de Apache Xalan Java que abordan este problema. Nota: Los tiempos de ejecuci\u00f3n de Java (como OpenJDK) incluyen copias reempaquetadas de Xalan."
    }
  ],
  "id": "CVE-2022-34169",
  "lastModified": "2024-11-21T07:08:59.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-07-19T18:15:11.740",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
    },
    {
      "source": "security@apache.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
    },
    {
      "source": "security@apache.org",
      "url": "https://security.gentoo.org/glsa/202401-25"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
    },
    {
      "source": "security@apache.org",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5188"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5192"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5256"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/19/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/10/18/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/11/04/8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2022/11/07/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202401-25"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20220729-0009/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5188"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5192"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2022/dsa-5256"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-681"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2020-04-15 14:15
Modified
2024-11-21 05:26
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
References
secalert_us@oracle.comhttp://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
secalert_us@oracle.comhttps://usn.ubuntu.com/4337-1/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2020/dsa-4662Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4337-1/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4662Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
Impacted products
Vendor Product Version
oracle jdk 11.0.6
oracle jdk 14.0.0
oracle jre 11.0.6
oracle jre 14.0.0
oracle openjdk *
oracle openjdk *
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 7
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 8
oracle openjdk 14
netapp 7-mode_transition_tool -
netapp active_iq_unified_manager *
netapp active_iq_unified_manager *
netapp cloud_backup -
netapp e-series_performance_analyzer -
netapp e-series_santricity_os_controller *
netapp e-series_santricity_web_services -
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp plug-in_for_symantec_netbackup -
netapp santricity_unified_manager -
netapp snapmanager -
netapp snapmanager -
netapp steelstore_cloud_integrated_storage -
netapp storagegrid *
netapp storagegrid -
canonical ubuntu_linux 16.04
canonical ubuntu_linux 18.04
canonical ubuntu_linux 19.10
debian debian_linux 10.0
opensuse leap 15.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "441D7EFC-92F3-4F5B-ADDB-A4BF241F546E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "84457AF5-BF82-449E-8576-F34DD338BBE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:11.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E5E08E5-823D-4F57-BA0A-603F8E680419",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:jre:14.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "89D95157-3487-4421-A5E3-801B987625B5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A8ADAA7A-7951-40D7-B1B1-78944D954209",
              "versionEndIncluding": "11.0.6",
              "versionStartIncluding": "11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ECA4E3C8-0E29-47F3-8FE6-5EB7AB469AAA",
              "versionEndIncluding": "13.0.2",
              "versionStartIncluding": "13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:-:*:*:*:*:*:*",
              "matchCriteriaId": "E78B7C5A-FA51-41E4-AAB0-C6DED2EFCF4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update1:*:*:*:*:*:*",
              "matchCriteriaId": "02011EDC-20A7-4A16-A592-7C76E0037997",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update10:*:*:*:*:*:*",
              "matchCriteriaId": "AC6D4652-1226-4C60-BEDF-01EBF8AC0849",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update101:*:*:*:*:*:*",
              "matchCriteriaId": "3C1F9ED7-7D93-41F4-9130-15BA734420AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update11:*:*:*:*:*:*",
              "matchCriteriaId": "1CF9CDF1-95D3-4125-A73F-396D2280FC4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update111:*:*:*:*:*:*",
              "matchCriteriaId": "A13266DC-F8D9-4F30-987F-65BBEAF8D3A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update121:*:*:*:*:*:*",
              "matchCriteriaId": "C28388AB-CFC9-4749-A90F-383F5B905EA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update13:*:*:*:*:*:*",
              "matchCriteriaId": "DA1B00F9-A81C-48B7-8DAA-F394DDF323F3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update131:*:*:*:*:*:*",
              "matchCriteriaId": "CA7AD457-6CE6-4925-8D94-A907B40233D9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update141:*:*:*:*:*:*",
              "matchCriteriaId": "A6F3FDD1-7CAC-4B84-ABB7-64E9D3FBD708",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update15:*:*:*:*:*:*",
              "matchCriteriaId": "5480E5AD-DB46-474A-9B57-84ED088A75FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update151:*:*:*:*:*:*",
              "matchCriteriaId": "881A4AE9-6012-4E91-98BE-0A352CC20703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update161:*:*:*:*:*:*",
              "matchCriteriaId": "7E1E1079-57D9-473B-A017-964F4745F329",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update17:*:*:*:*:*:*",
              "matchCriteriaId": "B8D6446E-2915-4F12-87BE-E7420BC2626E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update171:*:*:*:*:*:*",
              "matchCriteriaId": "564EDCE3-16E6-401D-8A43-032D1F8875E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update181:*:*:*:*:*:*",
              "matchCriteriaId": "08278802-D31B-488A-BA6A-EBC816DF883A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update191:*:*:*:*:*:*",
              "matchCriteriaId": "72BDA05A-C8BD-472E-8465-EE1F3E5D8CF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update2:*:*:*:*:*:*",
              "matchCriteriaId": "7BBB0969-565E-43E2-B067-A10AAA5F1958",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update201:*:*:*:*:*:*",
              "matchCriteriaId": "D78BE95D-6270-469A-8035-FCDDB398F952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update21:*:*:*:*:*:*",
              "matchCriteriaId": "88C24F40-3150-4584-93D9-8307DE04EEE9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update211:*:*:*:*:*:*",
              "matchCriteriaId": "E0FC5A03-FF11-4787-BBF1-3ACF93A21F2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update221:*:*:*:*:*:*",
              "matchCriteriaId": "19626B36-62FC-4497-A2E1-7D6CD9839B19",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update231:*:*:*:*:*:*",
              "matchCriteriaId": "5713AEBD-35F6-44E8-A0CC-A42830D7AE20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update241:*:*:*:*:*:*",
              "matchCriteriaId": "8BE0C04B-440E-4B35-ACC8-6264514F764C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update25:*:*:*:*:*:*",
              "matchCriteriaId": "555EC2A6-0475-48ED-AE0C-B306714A9333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update251:*:*:*:*:*:*",
              "matchCriteriaId": "EC1CF2AD-3F7A-4EF3-BD41-117A21553A9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update3:*:*:*:*:*:*",
              "matchCriteriaId": "C242D3BE-9114-4A9E-BB78-45754C7CC450",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update4:*:*:*:*:*:*",
              "matchCriteriaId": "D61068FE-18EE-4ADB-BC69-A3ECE8724575",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update40:*:*:*:*:*:*",
              "matchCriteriaId": "EFB59E80-4EC4-4399-BF40-6733E4E475A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update45:*:*:*:*:*:*",
              "matchCriteriaId": "84E31265-22E1-4E91-BFCB-D2AFF445926A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update5:*:*:*:*:*:*",
              "matchCriteriaId": "AB3A58C3-94BB-4120-BE1D-AAF8BBF7F22B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update51:*:*:*:*:*:*",
              "matchCriteriaId": "50319E52-8739-47C5-B61E-3CA9B6A9A48F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update55:*:*:*:*:*:*",
              "matchCriteriaId": "7ED515B9-DC74-4DC5-B98A-08D87D85E11E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update6:*:*:*:*:*:*",
              "matchCriteriaId": "6D1D4868-1F9F-43F7-968C-6469B67D3F1B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update60:*:*:*:*:*:*",
              "matchCriteriaId": "568F1AC4-B0D7-4438-82E5-0E61500F2240",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F5E99B4A-EDAD-4471-81C4-7E9C775C9D9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update67:*:*:*:*:*:*",
              "matchCriteriaId": "14E9133E-9FF3-40DB-9A11-7469EF5FD265",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update7:*:*:*:*:*:*",
              "matchCriteriaId": "94834710-3FA9-49D9-8600-B514CBCA4270",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update72:*:*:*:*:*:*",
              "matchCriteriaId": "4228D9E1-7D82-4B49-9669-9CDAD7187432",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update76:*:*:*:*:*:*",
              "matchCriteriaId": "F6231F48-2936-4F7D-96D5-4BA11F78EBE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update80:*:*:*:*:*:*",
              "matchCriteriaId": "D96D5061-4A81-497E-9AD6-A8381B3B454C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update85:*:*:*:*:*:*",
              "matchCriteriaId": "5345C21E-A01B-43B9-9A20-F2783D921C60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update9:*:*:*:*:*:*",
              "matchCriteriaId": "B219F360-83BD-4111-AB59-C9D4F55AF4C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update91:*:*:*:*:*:*",
              "matchCriteriaId": "D25377EA-8E8F-4C76-8EA9-3BBDFB352815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update95:*:*:*:*:*:*",
              "matchCriteriaId": "59FEFE05-269A-4EAF-A80F-E4C2107B1197",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update97:*:*:*:*:*:*",
              "matchCriteriaId": "E7E2AA7C-F602-4DB7-9EC1-0708C46C253C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:7:update99:*:*:*:*:*:*",
              "matchCriteriaId": "FB70E154-A304-429E-80F5-8D87B00E32D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:-:*:*:*:*:*:*",
              "matchCriteriaId": "70892D06-6E75-4425-BBF0-4B684EC62A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update101:*:*:*:*:*:*",
              "matchCriteriaId": "18DCFF53-B298-4534-AB5C-8A5EF59C616F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update102:*:*:*:*:*:*",
              "matchCriteriaId": "083419F8-FDDF-4E36-88F8-857DB317C1D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update11:*:*:*:*:*:*",
              "matchCriteriaId": "D7A74F65-57E8-4C9A-BA96-5EF401504F13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update111:*:*:*:*:*:*",
              "matchCriteriaId": "0D0B90FC-57B6-4315-9B29-3C36E58B2CF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update112:*:*:*:*:*:*",
              "matchCriteriaId": "07812576-3C35-404C-A7D7-9BE9E3D76E00",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update121:*:*:*:*:*:*",
              "matchCriteriaId": "00C52B1C-5447-4282-9667-9EBE0720B423",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update131:*:*:*:*:*:*",
              "matchCriteriaId": "92BB9EB0-0C12-4E77-89EE-FB77097841B8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update141:*:*:*:*:*:*",
              "matchCriteriaId": "FF9D5DCE-2E8F-42B9-9038-AEA7E8C8CFFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update151:*:*:*:*:*:*",
              "matchCriteriaId": "ABC0E7BB-F8B7-4369-9910-71240E4073A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update152:*:*:*:*:*:*",
              "matchCriteriaId": "551B2640-8CEC-4C24-AF8B-7A7CEF864D9D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update161:*:*:*:*:*:*",
              "matchCriteriaId": "0AE30779-48FB-451E-8CE1-F469F93B8772",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update162:*:*:*:*:*:*",
              "matchCriteriaId": "60590FDE-7156-4314-A012-AA38BD2ADDC9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update171:*:*:*:*:*:*",
              "matchCriteriaId": "BE51AD3A-8331-4E8F-9DB1-7A0051731DFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update172:*:*:*:*:*:*",
              "matchCriteriaId": "F24F6122-2256-41B6-9033-794C6424ED99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update181:*:*:*:*:*:*",
              "matchCriteriaId": "0EAFA79E-8C7A-48CF-8868-11378FE4B26F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update191:*:*:*:*:*:*",
              "matchCriteriaId": "D1D6F19F-59B5-4BB6-AD35-013384025970",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update192:*:*:*:*:*:*",
              "matchCriteriaId": "E7BA97BC-3ADA-465A-835B-6C3C5F416B56",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update20:*:*:*:*:*:*",
              "matchCriteriaId": "B71F77A4-B7EB-47A1-AAFD-431A7D040B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update201:*:*:*:*:*:*",
              "matchCriteriaId": "91D6BEA9-5943-44A4-946D-CEAA9BA99376",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update202:*:*:*:*:*:*",
              "matchCriteriaId": "C079A3E0-44EB-4B9C-B4FC-B7621D165C3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update211:*:*:*:*:*:*",
              "matchCriteriaId": "2CB74086-14B8-4237-8357-E0C6B5BB8313",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update212:*:*:*:*:*:*",
              "matchCriteriaId": "3ABED20A-7C34-4E86-9AFB-F4DC9ECBB3A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update221:*:*:*:*:*:*",
              "matchCriteriaId": "00C2B9C9-1177-4DA6-96CE-55F37F383F99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update231:*:*:*:*:*:*",
              "matchCriteriaId": "12A3F367-33AD-47C3-BFDC-871A17E72C94",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update241:*:*:*:*:*:*",
              "matchCriteriaId": "78261932-7373-4F16-91E0-1A72ADBEBC3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update25:*:*:*:*:*:*",
              "matchCriteriaId": "B38C0276-0EBD-4E0B-BFCF-4DDECACE04E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update31:*:*:*:*:*:*",
              "matchCriteriaId": "F8483034-DD5A-445D-892F-CDE90A7D58EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update40:*:*:*:*:*:*",
              "matchCriteriaId": "8279718F-878F-4868-8859-1728D13CD0D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update45:*:*:*:*:*:*",
              "matchCriteriaId": "2C024E1A-FD2C-42E8-B227-C2AFD3040436",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update5:*:*:*:*:*:*",
              "matchCriteriaId": "4F24389D-DDD0-4204-AA24-31C920A4F47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update51:*:*:*:*:*:*",
              "matchCriteriaId": "966979BE-1F21-4729-B6B8-610F74648344",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update60:*:*:*:*:*:*",
              "matchCriteriaId": "F8534265-33BF-460D-BF74-5F55FDE50F29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update65:*:*:*:*:*:*",
              "matchCriteriaId": "F77AFC25-1466-4E56-9D5F-6988F3288E16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update66:*:*:*:*:*:*",
              "matchCriteriaId": "A650BEB8-E56F-4E42-9361-8D2DB083F0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update71:*:*:*:*:*:*",
              "matchCriteriaId": "799FFECD-E80A-44B3-953D-CDB5E195F3AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update72:*:*:*:*:*:*",
              "matchCriteriaId": "A7047507-7CAF-4A14-AA9A-5CEF806EDE98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update73:*:*:*:*:*:*",
              "matchCriteriaId": "CFC7B179-95D3-4F94-84F6-73F1034A1AF2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update74:*:*:*:*:*:*",
              "matchCriteriaId": "9FB28526-9385-44CA-AF08-1899E6C3AE4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update77:*:*:*:*:*:*",
              "matchCriteriaId": "E26B69E4-0B43-415F-A82B-52FDCB262B3E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update91:*:*:*:*:*:*",
              "matchCriteriaId": "27BC4150-70EC-462B-8FC5-20B3442CBB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:8:update92:*:*:*:*:*:*",
              "matchCriteriaId": "02646989-ECD9-40AE-A83E-EFF4080C69B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:oracle:openjdk:14:*:*:*:*:*:*:*",
              "matchCriteriaId": "F46E15B6-86D8-4B16-B3E9-B1CAAA354E7F",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:netapp:7-mode_transition_tool:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7EF6650C-558D-45C8-AE7D-136EE70CB6D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*",
              "matchCriteriaId": "BD075607-09B7-493E-8611-66D041FFDA62",
              "versionStartIncluding": "7.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*",
              "matchCriteriaId": "B64FC591-5854-4480-A6E2-5E953C2415B3",
              "versionStartIncluding": "9.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C2089EE-5D7F-47EC-8EA5-0F69790564C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "24B8DB06-590A-4008-B0AB-FCD1401C77C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AFA6AD29-34C2-4FEC-9585-C42C6615C6CC",
              "versionEndIncluding": "11.60.1",
              "versionStartIncluding": "11.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*",
              "matchCriteriaId": "1AEFF829-A8F2-4041-8DDF-E705DB3ADED2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:santricity_unified_manager:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A372B177-F740-4655-865C-31777A6E140B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*",
              "matchCriteriaId": "64DE38C8-94F1-4860-B045-F33928F676A8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:snapmanager:-:-:*:*:*:oracle:*:*",
              "matchCriteriaId": "25BBBC1A-228F-45A6-AE95-DB915EDF84BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E94F7F59-1785-493F-91A7-5F5EA5E87E4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D239B58A-9386-443D-B579-B56AE2A500BC",
              "versionEndIncluding": "9.0.4",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*",
              "matchCriteriaId": "7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
              "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A31C8344-3E02-4EB8-8BD8-4C84B7959624",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en el producto Java SE de Oracle Java SE (componente: JSSE). Las versiones compatibles que est\u00e1n afectadas son Java SE: 11.0.6 y 14. Una vulnerabilidad explotable f\u00e1cilmente permite a un atacante no autenticado con acceso a la red por medio de HTTPS comprometer a Java SE. Los ataques con \u00e9xito de esta vulnerabilidad pueden resultar en una actualizaci\u00f3n no autorizada, insertar o eliminar el acceso a datos cr\u00edticos o a todos los datos accesibles de Java SE. Nota: Esta vulnerabilidad solo puede ser explotada al proporcionar datos a las API en el Componente especificado sin utilizar aplicaciones Java Web Start No Confiables o applets Java No Confiables, tal y como por medio de un servicio web. CVSS 3.0 Puntuaci\u00f3n Base 7.5 (Impactos de la integridad). Vector CVSS: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)."
    }
  ],
  "id": "CVE-2020-2816",
  "lastModified": "2024-11-21T05:26:21.210",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "secalert_us@oracle.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T14:15:29.157",
  "references": [
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "secalert_us@oracle.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20200416-0004/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://usn.ubuntu.com/4337-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.debian.org/security/2020/dsa-4662"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
    }
  ],
  "sourceIdentifier": "secalert_us@oracle.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-10-20 11:16
Modified
2024-11-21 06:12
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
References
secalert_us@oracle.comhttps://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
secalert_us@oracle.comhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
secalert_us@oracle.comhttps://security.gentoo.org/glsa/202209-05Third Party Advisory
secalert_us@oracle.comhttps://security.netapp.com/advisory/ntap-20211022-0004/Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5000Third Party Advisory
secalert_us@oracle.comhttps://www.debian.org/security/2021/dsa-5012Third Party Advisory
secalert_us@oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/11/msg00008.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6EUURAQOIJYFZHQ7DFZCO6IKDPIAWTNK/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WTVCIVHTX3XONYOEGUMLKCM4QEC6INT/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJILEHYV2U37HKMGFEQ7CAVOV4DUWW2O/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTYZWIXDFUV2H57YQZJWPOD3BC3I3EIQ/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXTUWAWXVU37GRNIG4TPMA47THO6VAE6/
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V362B2BWTH5IJDL45QPQGMBKIQOG7JX5/
af854a3a-2127-422b-91ae-364da2661108https: