Skip to content
OpenAdvisories
High ALAS2-2020-1410 13 CVEs

Important: java-11-amazon-corretto security update (Amazon Linux 2)

Published Apr 14, 2020 · Updated Apr 15, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-2830: No description is available for this CVE. 99999: CVE-2020-2830 OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) CVE-2020-2816: A flaw was found in the TLS/SSL implementation in the JSSE component of OpenJDK, where it did not properly handle application data packets received before the handshake completion. This flaw allowed unauthorized injection of data at the beginning of a TLS session. 99999: CVE-2020-2816 OpenJDK: Application data accepted before TLS handshake completion (JSSE, 8235691) CVE-2020-2805: No description is available for this CVE. 99999: CVE-2020-2805 OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) CVE-2020-2803: A flaw was found in the boundary checks in the java.nio buffer classes in the Libraries component of OpenJDK, where it is bypassed in certain cases. This flaw allows an untrusted Java application or applet o bypass Java sandbox restrictions. 99999: CVE-2020-2803 OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) CVE-2020-2800: No description is available for this CVE. 99999: CVE-2020-2800 OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) CVE-2020-2781: No description is available for this CVE. 99999: CVE-2020-2781 OpenJDK: Re-use of single TLS sessions for new connections (JSSE, 8234408) CVE-2020-2778: No description is available for this CVE. 99999: CVE-2020-2778 OpenJDK: Incomplete enforcement of algorithm restrictions for TLS (JSSE, 8232424) CVE-2020-2773: No description is available for this CVE. 99999: CVE-2020-2773 OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) CVE-2020-2767: No description is available for this CVE. 99999: CVE-2020-2767 OpenJDK: Incorrect handling of Certificate messages during TLS handshake (JSSE, 8232581) CVE-2020-2757: No description is available for this CVE. 99999: CVE-2020-2757 OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549) CVE-2020-2756: No description is available for this CVE. 99999: CVE-2020-2756 OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541) CVE-2020-2755: No description is available for this CVE. 99999: CVE-2020-2755 OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904) CVE-2020-2754: No description is available for this CVE. 99999: CVE-2020-2754 OpenJDK: Misplaced regex syntax error check in RegExpScanner (Scripting, 8223898)

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 java-11-amazon-corretto 1:11.0.7+10-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-headless 1:11.0.7+10-1.amzn2
Amazon Linux · 2 java-11-amazon-corretto-javadoc 1:11.0.7+10-1.amzn2

Vulnerabilities 13

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2754.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2755.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2756.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2757.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2767.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2773.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2778.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2781.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2800.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2803.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2805.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2816.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-2830.html