CISA-2020-2604
Reported by oracle · Published January 15, 2020
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oracle Corporation | Java | Java SE: 7u241, 8u231, 11.0.5, 13.0.1, Java SE Embedded: 8u231 |
| Oracle Corporation | Java | Java SE Embedded: 8u231, Java SE: 7u241, 8u231, 11.0.5, 13.0.1, Java SE Embedded: 8u231 |
Timeline
- Jan 15, 2020 CVE Published
- Sep 30, 2024 CVE Updated
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
- Apr 26, 2026 Distribution Patch
References
- RHSA-2020:0128 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0122 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0196 vendor-advisoryx_refsource_REDHAT
- openSUSE-SU-2020:0113 vendor-advisoryx_refsource_SUSE
- openSUSE-SU-2020:0147 vendor-advisoryx_refsource_SUSE
- RHSA-2020:0232 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0231 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0202 vendor-advisoryx_refsource_REDHAT
- USN-4257-1 vendor-advisoryx_refsource_UBUNTU
- RHSA-2020:0465 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0470 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0467 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0469 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0468 vendor-advisoryx_refsource_REDHAT
- DSA-4621 vendor-advisoryx_refsource_DEBIAN
- 20200216 [SECURITY] [DSA 4621-1] openjdk-8 security update mailing-listx_refsource_BUGTRAQ
- RHSA-2020:0541 vendor-advisoryx_refsource_REDHAT
- RHSA-2020:0632 vendor-advisoryx_refsource_REDHAT
- [debian-lts-announce] 20200229 [SECURITY] [DLA 2128-1] openjdk-7 security update mailing-listx_refsource_MLIST
- x_refsource_MISC
…and 4 more