8.1

CVE-2020-2604

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Oracle ≫ Commerce Experience Manager Version 11.3.2
Oracle ≫ Commerce Guided Search Version 11.3.2
Oracle ≫ Graalvm Version 19.3.0.2 SwEdition enterprise
Oracle ≫ Jdk Version 1.7.0 Update update241
Oracle ≫ Jdk Version 1.8.0 Update update231
Oracle ≫ Jdk Version 11.0.5
Oracle ≫ Jdk Version 13.0.1
Oracle ≫ Jre Version 1.8.0 Update update231
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Eus Version 7.7
Redhat ≫ Enterprise Linux Eus Version 8.1
Oracle ≫ Openjdk Version >= 11 <= 11.0.5
Oracle ≫ Openjdk Version >= 13 <= 13.0.1
Oracle ≫ Openjdk Version 7 Update -
Oracle ≫ Openjdk Version 7 Update update241
Oracle ≫ Openjdk Version 7 Update update80
Oracle ≫ Openjdk Version 7 Update update85
Oracle ≫ Openjdk Version 8 Update -
Oracle ≫ Openjdk Version 8 Update update102
Oracle ≫ Openjdk Version 8 Update update112
Oracle ≫ Openjdk Version 8 Update update152
Oracle ≫ Openjdk Version 8 Update update162
Oracle ≫ Openjdk Version 8 Update update172
Oracle ≫ Openjdk Version 8 Update update192
Oracle ≫ Openjdk Version 8 Update update20
Oracle ≫ Openjdk Version 8 Update update202
Oracle ≫ Openjdk Version 8 Update update212
Oracle ≫ Openjdk Version 8 Update update222
Oracle ≫ Openjdk Version 8 Update update232
Oracle ≫ Openjdk Version 8 Update update40
Oracle ≫ Openjdk Version 8 Update update60
Oracle ≫ Openjdk Version 8 Update update66
Oracle ≫ Openjdk Version 8 Update update72
Oracle ≫ Openjdk Version 8 Update update92
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 19.10
Opensuse ≫ Leap Version 15.1
Netapp ≫ Active Iq Unified Manager SwPlatform windows Version >= 7.3
Netapp ≫ Active Iq Unified Manager SwPlatform vmware_vsphere Version >= 9.5
Netapp ≫ E-series Santricity Management Plug-ins Version - SwPlatform vmware_vcenter
Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.60.1
Netapp ≫ Oncommand Insight Version -
Mcafee ≫ Epolicy Orchestrator Version 5.9.0
Mcafee ≫ Epolicy Orchestrator Version 5.9.1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update -
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_2
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_3
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_4
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_5
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.9% 0.91
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Oracle 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Vendor Advisory
https://www.oracle.com/security-alerts/cpujul2021.html
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200122-0003/
Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10315
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2020:0122
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0128
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0196
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0202
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0231
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0232
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0465
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0467
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0468
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0469
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0470
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0541
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0632
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html
Third Party Advisory
Mailing List
https://seclists.org/bugtraq/2020/Feb/22
Third Party Advisory
Mailing List
Issue Tracking
https://security.gentoo.org/glsa/202101-19
Third Party Advisory
https://usn.ubuntu.com/4257-1/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4621
Third Party Advisory