CVE-2020-2654

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

The updated packages fix security vulnerabilities:

Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)

This update for java-11-openjdk fixes the following issues:

Update to version jdk-11.0.6-10 (January 2020 CPU, bsc#1160968)

Fixing these security related issues:

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2655: Better TLS messaging support
• CVE-2020-2654: Improve Object Identifier Processing

This update was imported from the SUSE:SLE-15:Update update project.

This update for java-1_8_0-openjdk fixes the following issues:

Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968):

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2659: Enhance datagram socket support
• CVE-2020-2654: Improve Object Identifier Processing

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the java-11-openjdk-11.0.12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-13-openjdk-13.0.8.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.302-2.2 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk fixes the following issues:

Update to version jdk-11.0.6-10 (January 2020 CPU, bsc#1160968)

Fixing these security related issues:

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2655: Better TLS messaging support
• CVE-2020-2654: Improve Object Identifier Processing

This update for java-11-openjdk fixes the following issues:

Update to version jdk-11.0.6-10 (January 2020 CPU, bsc#1160968)

Fixing these security related issues:

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2655: Better TLS messaging support
• CVE-2020-2654: Improve Object Identifier Processing

This update for java-1_8_0-openjdk fixes the following issues:

Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968):

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2659: Enhance datagram socket support
• CVE-2020-2654: Improve Object Identifier Processing

This update for java-1_8_0-openjdk fixes the following issues:

Update java-1_8_0-openjdk to version jdk8u242 (icedtea 3.15.0) (January 2020 CPU, bsc#1160968):

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2659: Enhance datagram socket support
• CVE-2020-2654: Improve Object Identifier Processing

This update for java-1_7_0-openjdk fixes the following issues:

Update java-1_7_0-openjdk to version jdk7u251 (January 2020 CPU, bsc#1160968):

• CVE-2020-2583: Unlink Set of LinkedHashSets
• CVE-2020-2590: Improve Kerberos interop capabilities
• CVE-2020-2593: Normalize normalization for all
• CVE-2020-2601: Better Ticket Granting Services
• CVE-2020-2604: Better serial filter handling
• CVE-2020-2659: Enhance datagram socket support
• CVE-2020-2654: Improve Object Identifier Processing

This update for java-1_7_0-ibm fixes the following issues:

java-1_7_1-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 (bsc#1172277 and bsc#1169511)

• CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service
• CVE-2020-2756: Improved mapping of serial ENUMs
• CVE-2020-2757: Less Blocking Array Queues
• CVE-2020-2781: Improved TLS session handling
• CVE-2020-2800: Improved Headings for HTTP Servers
• CVE-2020-2803: Enhanced buffering of byte buffers
• CVE-2020-2805: Enhanced typing of methods
• CVE-2020-2830: Improved Scanner conversions

This update for java-1_7_1-ibm fixes the following issues:

java-1_7_1-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 (bsc#1172277 and bsc#1169511)

• CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service
• CVE-2020-2756: Improved mapping of serial ENUMs
• CVE-2020-2757: Less Blocking Array Queues
• CVE-2020-2781: Improved TLS session handling
• CVE-2020-2800: Improved Headings for HTTP Servers
• CVE-2020-2803: Enhanced buffering of byte buffers
• CVE-2020-2805: Enhanced typing of methods
• CVE-2020-2830: Improved Scanner conversions

This update for java-1_7_1-ibm fixes the following issues:

java-1_7_1-ibm was updated to Java 7.1 Service Refresh 4 Fix Pack 65 (bsc#1172277 and bsc#1169511)

• CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service
• CVE-2020-2756: Improved mapping of serial ENUMs
• CVE-2020-2757: Less Blocking Array Queues
• CVE-2020-2781: Improved TLS session handling
• CVE-2020-2800: Improved Headings for HTTP Servers
• CVE-2020-2803: Enhanced buffering of byte buffers
• CVE-2020-2805: Enhanced typing of methods
• CVE-2020-2830: Improved Scanner conversions

This update for java-1_8_0-ibm fixes the following issues:

java-1_8_0-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 (bsc#1172277,bsc#1169511,bsc#1160968)

• CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service
• CVE-2020-2754: Forwarded references to Nashorn
• CVE-2020-2755: Improved Nashorn matching
• CVE-2020-2756: Improved mapping of serial ENUMs
• CVE-2020-2757: Less Blocking Array Queues
• CVE-2020-2781: Improved TLS session handling
• CVE-2020-2800: Improved Headings for HTTP Servers
• CVE-2020-2803: Enhanced buffering of byte buffers
• CVE-2020-2805: Enhanced typing of methods
• CVE-2020-2830: Improved Scanner conversions
• CVE-2019-2949: Fixed an issue which could have resulted in unauthorized access to critical data
• Added RSA PSS SUPPORT TO IBMPKCS11IMPL
• The pack200 and unpack200 alternatives should be slaves of java (bsc#1171352).

This update for java-1_8_0-ibm fixes the following issues:

java-1_8_0-ibm was updated to Java 8.0 Service Refresh 6 Fix Pack 10 (bsc#1172277,bsc#1169511,bsc#1160968)

• CVE-2020-2654: Fixed an issue which could have resulted in unauthorized ability to cause a partial denial of service
• CVE-2020-2754: Forwarded references to Nashorn
• CVE-2020-2755: Improved Nashorn matching
• CVE-2020-2756: Improved mapping of serial ENUMs
• CVE-2020-2757: Less Blocking Array Queues
• CVE-2020-2781: Improved TLS session handling
• CVE-2020-2800: Improved Headings for HTTP Servers
• CVE-2020-2803: Enhanced buffering of byte buffers
• CVE-2020-2805: Enhanced typing of methods
• CVE-2020-2830: Improved Scanner conversions
• CVE-2019-2949: Fixed an issue which could have resulted in unauthorized access to critical data
• Added RSA PSS SUPPORT TO IBMPKCS11IMPL
• The pack200 and unpack200 alternatives should be slaves of java (bsc#1171352).

It was discovered that OpenJDK incorrectly handled exceptions during deserialization in BeanContextSupport. An attacker could possibly use this issue to cause a denial of service or other unspecified impact. (CVE-2020-2583)

It was discovered that OpenJDK incorrectly validated properties of SASL messages included in Kerberos GSSAPI. An unauthenticated remote attacker with network access via Kerberos could possibly use this issue to insert, modify or obtain sensitive information. (CVE-2020-2590)

It was discovered that OpenJDK incorrectly validated URLs. An attacker could possibly use this issue to insert, edit or obtain sensitive information. (CVE-2020-2593)

It was discovered that OpenJDK Security component still used MD5 algorithm. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2020-2601)

It was discovered that OpenJDK incorrectly handled the application of serialization filters. An attacker could possibly use this issue to bypass the intended filter during serialization. (CVE-2020-2604)

Bo Zhang and Long Kuan discovered that OpenJDK incorrectly handled X.509 certificates. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-2654)

Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and Robert Merget discovered that OpenJDK incorrectly handled CertificateVerify TLS handshake messages. A remote attacker could possibly use this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 11. (CVE-2020-2655)

It was discovered that OpenJDK incorrectly enforced the limit of datagram sockets that can be created by a code running within a Java sandbox. An attacker could possibly use this issue to bypass the sandbox restrictions causing a denial of service. This issue only affected OpenJDK 8. (CVE-2020-2659)