Lucene search

K
ubuntuUbuntuUSN-4257-1
HistoryJan 28, 2020 - 12:00 a.m.

OpenJDK vulnerabilities

2020-01-2800:00:00
ubuntu.com
76

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

69.4%

Releases

  • Ubuntu 19.10
  • Ubuntu 18.04 ESM
  • Ubuntu 16.04 ESM

Packages

  • openjdk-8 - Open Source Java implementation
  • openjdk-lts - Open Source Java implementation

Details

It was discovered that OpenJDK incorrectly handled exceptions during
deserialization in BeanContextSupport. An attacker could possibly use this
issue to cause a denial of service or other unspecified impact.
(CVE-2020-2583)

It was discovered that OpenJDK incorrectly validated properties of SASL
messages included in Kerberos GSSAPI. An unauthenticated remote attacker
with network access via Kerberos could possibly use this issue to insert,
modify or obtain sensitive information. (CVE-2020-2590)

It was discovered that OpenJDK incorrectly validated URLs. An attacker
could possibly use this issue to insert, edit or obtain sensitive
information. (CVE-2020-2593)

It was discovered that OpenJDK Security component still used MD5 algorithm.
A remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2020-2601)

It was discovered that OpenJDK incorrectly handled the application of
serialization filters. An attacker could possibly use this issue to bypass the
intended filter during serialization. (CVE-2020-2604)

Bo Zhang and Long Kuan discovered that OpenJDK incorrectly handled X.509
certificates. An attacker could possibly use this issue to cause a denial
of service. (CVE-2020-2654)

Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and
Robert Merget discovered that OpenJDK incorrectly handled CertificateVerify
TLS handshake messages. A remote attacker could possibly use this issue to
insert, edit or obtain sensitive information. This issue only affected
OpenJDK 11. (CVE-2020-2655)

It was discovered that OpenJDK incorrectly enforced the limit of datagram
sockets that can be created by a code running within a Java sandbox. An
attacker could possibly use this issue to bypass the sandbox restrictions
causing a denial of service. This issue only affected OpenJDK 8.
(CVE-2020-2659)

OSVersionArchitecturePackageVersionFilename
Ubuntu19.10noarchopenjdk-11-jdk< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-dbg< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-demo< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-doc< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-jdk-headless< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-jre< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-jre-headless< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-jre-zero< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-11-source< 11.0.6+10-1ubuntu1~19.10.1UNKNOWN
Ubuntu19.10noarchopenjdk-8-jdk< 8u242-b08-0ubuntu3~19.10UNKNOWN
Rows per page:
1-10 of 491

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

69.4%