Skip to content
OpenAdvisories
Low · 3.7 CVE-2020-14573 EUVD-2020-6709GHSA-cpcx-4qmw-3fj8

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 1…

Published Jul 15, 2020 · Updated Sep 27, 2024 · Assigned by oracle

Vendor: Oracle Product: Java Package: openjdk-10 Package: openjdk-11 Package: openjdk-13 Package: openjdk-13-jre-base Package: openjdk-9-jre Package: openjdk-lts Package: openjdk11 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java Java SE: 11.0.7, 14.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 openjdk-11 11.0.8+10-1 —
Debian 10 openjdk-11 11.0.8+10-1~deb10u1 DSA-4734-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS openjdk-13 No fix yet —
Ubuntu 20.04 LTS openjdk-lts 11.0.8+10-0ubuntu1~20.04 USN-4433-1
Ubuntu 18.04 LTS openjdk-lts 11.0.8+10-0ubuntu1~18.04.1 USN-4433-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 java-11-openjdk +8 1:11.0.8.10-0.el8_2 RHSA-2020:2970
RHEL 7 java-11-openjdk +7 1:11.0.8.10-0.el7_8 RHSA-2020:2969
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.1 EUS java-11-openjdk +7 1:11.0.8.10-0.el8_1 RHSA-2020:3099
RHEL 8.0 E4S java-11-openjdk +7 1:11.0.8.10-0.el8_0 RHSA-2020:3098

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 java-11-openjdk 11.0.8.0-3.45.1 SUSE-SU-2020:2143-1
SLES 15 SP1 java-11-openjdk 11.0.8.0-3.45.1 SUSE-SU-2020:2143-1
SLES 15 java-11-openjdk 11.0.8.0-3.45.1 SUSE-SU-2020:2143-1
SLES 12 SP5 java-11-openjdk 11.0.8.0-3.12.1 SUSE-SU-2020:2008-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 java-11-openjdk 11.0.8.0-3.45.1 SUSE-SU-2020:2143-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.8.0-3.12.1 SUSE-SU-2020:2008-1
SLE HPC 15 java-11-openjdk 11.0.8.0-3.45.1 SUSE-SU-2020:2143-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openjdk 11.0.12.0-3.1 openSUSE-SU-2024:10871-1
openSUSE Tumbleweed java-13-openjdk 13.0.8.0-3.1 openSUSE-SU-2024:10872-1
openSUSE Tumbleweed java-15-openjdk 15.0.4.0-2.1 openSUSE-SU-2024:10873-1
openSUSE Leap 15.2 java-11-openjdk 11.0.8.0-lp152.2.3.1 openSUSE-SU-2020:1191-1
openSUSE Leap 15.1 java-11-openjdk 11.0.8.0-lp151.3.19.1 openSUSE-SU-2020:1175-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.8_p10-r0 —
Alpine v3.23 openjdk11 11.0.8_p10-r0 —
Alpine v3.22 openjdk11 11.0.8_p10-r0 —
Alpine v3.21 openjdk11 11.0.8_p10-r0 —
Alpine v3.20 openjdk11 11.0.8_p10-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openjdk11 11.0.8_p10-r0 —
Alpine v3.18 openjdk11 11.0.8_p10-r0 —
Alpine v3.17 openjdk11 11.0.8_p10-r0 —
Alpine v3.16 openjdk11 11.0.8_p10-r0 —
Alpine v3.15 openjdk11 11.0.8_p10-r0 —
Alpine v3.14 openjdk11 11.0.8_p10-r0 —
Alpine v3.13 openjdk11 11.0.8_p10-r0 —
Alpine v3.12 openjdk11 11.0.8_p10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-11-amazon-corretto +4 1:11.0.18+10-1.amzn2023 ALAS2023-2025-1252
Amazon Linux 2 java-11-amazon-corretto +2 1:11.0.8+10-1.amzn2 ALAS2-2020-1464

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 java-11-openjdk +8 1:11.0.8.10-0.el8_2 ELSA-2020-2970
Oracle Linux 7 java-11-openjdk +7 1:11.0.8.10-0.0.1.el7_8 ELSA-2020-2969

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-10 +2 No fix yet —

Advisories 18

References