Skip to content
OpenAdvisories
Medium · 4.8 Public exploit CVE-2020-2655 EUVD-2020-22448GHSA-gf92-7rqx-hgfc

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0…

Published Jan 15, 2020 · Updated Sep 30, 2024 · Assigned by oracle

Vendor: Oracle Product: Java Package: openjdk-11 Package: openjdk-lts Package: openjdk11 Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Affected products

VendorProductAffectedFixed
Oracle Java Java SE: 11.0.5, 13.0.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 openjdk-11 11.0.6+10-1 —
Debian 10 openjdk-11 11.0.6+10-1~deb10u1 DSA-4605-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS openjdk-lts 11.0.6+10-1ubuntu1 —
Ubuntu 18.04 LTS openjdk-8 8u242-b08-0ubuntu3~18.04 USN-4257-1
Ubuntu 18.04 LTS openjdk-lts 11.0.6+10-1ubuntu1~18.04.1 USN-4257-1
Ubuntu 16.04 LTS openjdk-8 8u242-b08-0ubuntu3~16.04 USN-4257-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 java-11-openjdk +7 1:11.0.6.10-0.el8_1 RHSA-2020:0128
RHEL 7 java-11-openjdk +15 1:11.0.6.10-1.el7_7 RHSA-2020:0122
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.0 E4S java-11-openjdk +7 1:11.0.6.10-0.el8_0 RHSA-2020:0232

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 java-11-openjdk 11.0.6.0-3.39.2 SUSE-SU-2020:0213-1
SLES 15 java-11-openjdk 11.0.6.0-3.39.2 SUSE-SU-2020:0213-1
SLES 12 SP5 java-11-openjdk 11.0.6.0-3.6.1 SUSE-SU-2020:0140-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 java-11-openjdk 11.0.6.0-3.39.2 SUSE-SU-2020:0213-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.6.0-3.6.1 SUSE-SU-2020:0140-1
SLE HPC 15 java-11-openjdk 11.0.6.0-3.39.2 SUSE-SU-2020:0213-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openjdk 11.0.12.0-3.1 openSUSE-SU-2024:10871-1
openSUSE Tumbleweed java-13-openjdk 13.0.8.0-3.1 openSUSE-SU-2024:10872-1
openSUSE Leap 15.1 java-11-openjdk 11.0.6.0-lp151.3.12.1 openSUSE-SU-2020:0113-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.6_p10-r0 —
Alpine v3.23 openjdk11 11.0.6_p10-r0 —
Alpine v3.22 openjdk11 11.0.6_p10-r0 —
Alpine v3.21 openjdk11 11.0.6_p10-r0 —
Alpine v3.20 openjdk11 11.0.6_p10-r0 —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openjdk11 11.0.6_p10-r0 —
Alpine v3.18 openjdk11 11.0.6_p10-r0 —
Alpine v3.17 openjdk11 11.0.6_p10-r0 —
Alpine v3.16 openjdk11 11.0.6_p10-r0 —
Alpine v3.15 openjdk11 11.0.6_p10-r0 —
Alpine v3.14 openjdk11 11.0.6_p10-r0 —
Alpine v3.13 openjdk11 11.0.6_p10-r0 —
Alpine v3.12 openjdk11 11.0.6_p10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 java-11-amazon-corretto +2 1:11.0.6+10-1.amzn2 ALAS2-2020-1387

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 java-11-openjdk +7 1:11.0.6.10-0.el8_1 ELSA-2020-0128
Oracle Linux 7 java-11-openjdk +15 1:11.0.6.10-1.0.1.el7_7 ELSA-2020-0122

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 14

References