Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2020-Jan-15 advisory.

  - Serialization (CVE-2020-2583, CVE-2020-2604)

  - Security (CVE-2020-2590, CVE-2020-2601)

  - Networking (CVE-2020-2593, CVE-2020-2659)

  - Libraries (CVE-2020-2654)

  - JSSE (CVE-2020-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 8 < 8.242.07.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2020-Jan-14 advisory.

  - OpenJFX (libxslt) (CVE-2019-13117, CVE-2019-13118)

  - OpenJFX (SQLite) (CVE-2019-16168)

  - Serialization (CVE-2020-2583, CVE-2020-2604)

  - OpenJFX (CVE-2020-2585)

  - Security (CVE-2020-2590, CVE-2020-2601)

  - Networking (CVE-2020-2593, CVE-2020-2659)

  - Libraries (CVE-2020-2654)

  - JSSE (CVE-2020-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u241 / 8 <= 8u232 / 11.0.0 <= 11.0.5 / 13.0.0 <= 13.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020-01-14 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and     Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2020-2604)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). (CVE-2020-2601)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8     (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2020-2655)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2593)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2654)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2659)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2583)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:0128 advisory.

  - OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)     (CVE-2020-2604)

  - OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780)     (CVE-2020-2655)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4257-1 advisory.

    It was discovered that OpenJDK incorrectly handled exceptions during deserialization in     BeanContextSupport. An attacker could possibly use this issue to cause a denial of service or other     unspecified impact. (CVE-2020-2583)

    It was discovered that OpenJDK incorrectly validated properties of SASL messages included in Kerberos     GSSAPI. An unauthenticated remote attacker with network access via Kerberos could possibly use this issue     to insert, modify or obtain sensitive information. (CVE-2020-2590)

    It was discovered that OpenJDK incorrectly validated URLs. An attacker could possibly use this issue to     insert, edit or obtain sensitive information. (CVE-2020-2593)

    It was discovered that OpenJDK Security component still used MD5 algorithm. A remote attacker could     possibly use this issue to obtain sensitive information. (CVE-2020-2601)

    It was discovered that OpenJDK incorrectly handled the application of serialization filters. An attacker     could possibly use this issue to bypass the intended filter during serialization. (CVE-2020-2604)

    Bo Zhang and Long Kuan discovered that OpenJDK incorrectly handled X.509 certificates. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-2654)

    Bengt Jonsson, Juraj Somorovsky, Kostis Sagonas, Paul Fiterau Brostean and Robert Merget discovered that     OpenJDK incorrectly handled CertificateVerify TLS handshake messages. A remote attacker could possibly use     this issue to insert, edit or obtain sensitive information. This issue only affected OpenJDK 11.
    (CVE-2020-2655)

    It was discovered that OpenJDK incorrectly enforced the limit of datagram sockets that can be created by a     code running within a Java sandbox. An attacker could possibly use this issue to bypass the sandbox     restrictions causing a denial of service. This issue only affected OpenJDK 8. (CVE-2020-2659)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk fixes the following issues :

Update to version jdk-11.0.6-10 (January 2020 CPU, bsc#1160968)

Fixing these security related issues :

  - CVE-2020-2583: Unlink Set of LinkedHashSets

  - CVE-2020-2590: Improve Kerberos interop capabilities

  - CVE-2020-2593: Normalize normalization for all

  - CVE-2020-2601: Better Ticket Granting Services

  - CVE-2020-2604: Better serial filter handling

  - CVE-2020-2655: Better TLS messaging support

  - CVE-2020-2654: Improve Object Identifier Processing

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0232 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780)     (CVE-2020-2655)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk fixes the following issues :

Update to version jdk-11.0.6-10 (January 2020 CPU, bsc#1160968)

Fixing these security related issues :

CVE-2020-2583: Unlink Set of LinkedHashSets

CVE-2020-2590: Improve Kerberos interop capabilities

CVE-2020-2593: Normalize normalization for all

CVE-2020-2601: Better Ticket Granting Services

CVE-2020-2604: Better serial filter handling

CVE-2020-2655: Better TLS messaging support

CVE-2020-2654: Improve Object Identifier Processing

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0128 advisory.

    [1:11.0.6.10-1]
    - Update to shenandoah-jdk-11.0.6+10 (GA)
    - Switch to GA mode for final release.
    - Add JDK-8236039 backport to resolve OpenShift blocker
    - Resolves: rhbz#1785753

    [1:11.0.6.1-0.0.ea]
    - Update to shenandoah-jdk-11.0.6+1 (EA)
    - Switch to EA mode for 11.0.6 pre-release builds.
    - Add support for jfr binary.
    - Drop JDK-8230923 now applied upstream.
    - Resolves: rhbz#1785753

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, incorrect implementation of Kerberos GSSAPI and TGS requests or incorrect TLS handshakes.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0122 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2601)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. (CVE-2020-2604)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are     affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the     specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as     through a web service. (CVE-2020-2654)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Java SE accessible data as well as     unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. (CVE-2020-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). ( CVE-2020-2590 )

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data. ( CVE-2019-13118 )

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle GraalVM (component: Java). The supported version that is affected is 19.3.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM Enterprise Edition. Note: GraalVM Enterprise 19.3 and above includes both Java SE 8 and Java SE 11. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). (CVE-2020-2604)

Vulnerability in the Java SE product of Oracle Java SE (component:
JavaFX). The supported version that is affected is Java SE: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE.
Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2020-2585)

Vulnerability in the Java SE product of Oracle Java SE (component:
Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
(CVE-2020-2654)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 6.8 (Confidentiality impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). (CVE-2020-2601)

Vulnerability in the Java SE product of Oracle Java SE (component:
JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE.
Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2655)

In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a 'severe division by zero in the query planner.' (CVE-2019-16168)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and 8u231; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded.
Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2659)

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character. (CVE-2019-13117)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2583)

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
(CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2593)

Security Fix(es) :

  - OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS     (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via     jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

  - OpenJDK: Improper checks of SASL message properties in     GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler causing URL     normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Excessive memory usage in OID processing in     X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect handling of unexpected     CertificateVerify TLS handshake messages (JSSE, 8231780)     (CVE-2020-2655)

  - OpenJDK: Incorrect exception processing during     deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0128 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780)     (CVE-2020-2655)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0122 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

    * OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

    * OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

    * OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548)     (CVE-2020-2593)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780)     (CVE-2020-2655)

    * OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0122 advisory.

    [1:11.0.6.10-1.0.1]
    - link atomic for ix86 build

    [1:11.0.6.10-1]
    - Add JDK-8236039 backport to resolve OpenShift blocker
    - Resolves: rhbz#1785753

    [1:11.0.6.10-0]
    - Update to shenandoah-jdk-11.0.6+10 (GA)
    - Switch to GA mode for final release.
    - Resolves: rhbz#1785753

    [1:11.0.6.1-0.1.ea]
    - Update to shenandoah-jdk-11.0.6+1 (EA)
    - Switch to EA mode for 11.0.6 pre-release builds.
    - Add support for jfr binary.
    - Resolves: rhbz#1785753

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol.
    This issue affects the 'SQLite' component.(CVE-2019-16168)

  - Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read     uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
    (CVE-2019-13117, CVE-2019-13118)

  - Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
    (CVE-2020-2601, CVE-2020-2590)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization' component.
    (CVE-2020-2604, CVE-2020-2583)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated     remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
    (CVE-2020-2593, CVE-2020-2659)

  - Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit     this over 'HTTPS' protocols. This issue affects the 'JSSE' component. (CVE-2020-2655)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
159409	Amazon Corretto Java 11.x < 11.0.6.10.1 Multiple Vulnerabilities	Nessus	Misc.	high
159402	Amazon Corretto Java 8.x < 8.242.07.1 Multiple Vulnerabilities	Nessus	Misc.	high
151210	OpenJDK 7 <= 7u241 / 8 <= 8u232 / 11.0.0 <= 11.0.5 / 13.0.0 <= 13.0.1 Multiple Vulnerabilities (2020-01-14)	Nessus	Misc.	high
146041	CentOS 8 : java-11-openjdk (CESA-2020:0128)	Nessus	CentOS Local Security Checks	high
136333	Photon OS 2.0: Openjdk11 PHSA-2020-2.0-0235	Nessus	PhotonOS Local Security Checks	high
136109	Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	critical
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	critical
133353	Ubuntu 16.04 LTS / 18.04 LTS : OpenJDK vulnerabilities (USN-4257-1)	Nessus	Ubuntu Local Security Checks	high
133288	openSUSE Security Update : java-11-openjdk (openSUSE-2020-113)	Nessus	SuSE Local Security Checks	high
133285	RHEL 8 : java-11-openjdk (RHSA-2020:0232)	Nessus	Red Hat Local Security Checks	high
133203	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2020:0213-1)	Nessus	SuSE Local Security Checks	high
133140	SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2020:0140-1)	Nessus	SuSE Local Security Checks	high
133122	Oracle Linux 8 : java-11-openjdk (ELSA-2020-0128)	Nessus	Oracle Linux Local Security Checks	high
133108	Debian DSA-4605-1 : openjdk-11 - security update	Nessus	Debian Local Security Checks	high
133098	CentOS 7 : java-11-openjdk (RHSA-2020:0122)	Nessus	CentOS Local Security Checks	high
133096	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1387)	Nessus	Amazon Linux Local Security Checks	high
133030	Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20200116)	Nessus	Scientific Linux Local Security Checks	high
133027	RHEL 8 : java-11-openjdk (RHSA-2020:0128)	Nessus	Red Hat Local Security Checks	high
133023	RHEL 7 : java-11-openjdk (RHSA-2020:0122)	Nessus	Red Hat Local Security Checks	high
133020	Oracle Linux 7 : java-11-openjdk (ELSA-2020-0122)	Nessus	Oracle Linux Local Security Checks	high
132992	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Windows	high
132960	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU) (Unix)	Nessus	Misc.	high

Detections

Analytics

CVE-2020-2655

medium

Tenable Plugins

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high