CVE-2020-2654

Published: Jan 15, 2020Modified: Jun 17, 2026

3.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 2.2 / Impact: 1.4

Source: NVD

Description

Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected (75)

Products: Oracle: Jdk, Jre, Openjdk · Redhat: Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Enterprise Linux Workstation · Debian: Debian Linux · +4 more

Show all products

3 products

6 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

1 product

1 product

10 products

Active Iq Unified Manager

E Series Performance Analyzer

E Series Santricity Management Plug Ins

E Series Santricity Os Controller

E Series Santricity Storage Manager

E Series Santricity Web Services Proxy

Oncommand Insight

Oncommand Workflow Automation

Santricity Unified Manager

Steelstore Cloud Integrated Storage

1 product

1 product

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Oracle Jdk	Version 1.7.0 update241
Oracle Jdk	Version 1.8.0 update231
Oracle Jdk	Version 11.0.5
Oracle Jdk	Version 13.0.1
Oracle Jre	Version 1.7.0 update_241
Oracle Jre	Version 1.8.0 update_231
Oracle Jre	Version 11.0.5
Oracle Jre	Version 13.0.1

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Eus	Version 7.7
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration C

29 vulnerable

Vulnerable Software	Affected Versions
Oracle Openjdk	Version 11.0.1
Oracle Openjdk	Version 11.0.2
Oracle Openjdk	Version 11.0.3
Oracle Openjdk	Version 11.0.4
Oracle Openjdk	Version 11.0.5
Oracle Openjdk	Version 11
Oracle Openjdk	Version 13.0.1
Oracle Openjdk	Version 13
Oracle Openjdk	Version 7
Oracle Openjdk	Version 7 update241
Oracle Openjdk	Version 7 update80
Oracle Openjdk	Version 7 update85
Oracle Openjdk	Version 8
Oracle Openjdk	Version 8 update102
Oracle Openjdk	Version 8 update112
Oracle Openjdk	Version 8 update152
Oracle Openjdk	Version 8 update162
Oracle Openjdk	Version 8 update172
Oracle Openjdk	Version 8 update192
Oracle Openjdk	Version 8 update202
Oracle Openjdk	Version 8 update20
Oracle Openjdk	Version 8 update212
Oracle Openjdk	Version 8 update222
Oracle Openjdk	Version 8 update232
Oracle Openjdk	Version 8 update40
Oracle Openjdk	Version 8 update60
Oracle Openjdk	Version 8 update66
Oracle Openjdk	Version 8 update72
Oracle Openjdk	Version 8 update92

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10

Configuration F

11 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	From 9.5
Netapp Active Iq Unified Manager	From 7.3
Netapp E Series Performance Analyzer	All versions
Netapp E Series Santricity Management Plug Ins	All versions
Netapp E Series Santricity Os Controller	From 11.0.0 to 11.60.1
Netapp E Series Santricity Storage Manager	All versions
Netapp E Series Santricity Web Services Proxy	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Santricity Unified Manager	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration G

9 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Version 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0 update_1
Mcafee Epolicy Orchestrator	Version 5.10.0 update_2
Mcafee Epolicy Orchestrator	Version 5.10.0 update_3
Mcafee Epolicy Orchestrator	Version 5.10.0 update_4
Mcafee Epolicy Orchestrator	Version 5.10.0 update_5
Mcafee Epolicy Orchestrator	Version 5.10.0 update_6
Mcafee Epolicy Orchestrator	Version 5.9.0
Mcafee Epolicy Orchestrator	Version 5.9.1

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

References (42)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html

Source: secalert_us@oracle.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html

Source: secalert_us@oracle.com

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0122

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0128

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0157

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0196

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0202

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0231

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0232

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0541

Source: secalert_us@oracle.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0632

Source: secalert_us@oracle.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10315

Source: secalert_us@oracle.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html

Source: secalert_us@oracle.com

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Feb/22

Source: secalert_us@oracle.com

Issue TrackingMailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Jan/24

Source: secalert_us@oracle.com

Issue TrackingMailing ListThird Party Advisory

https://security.gentoo.org/glsa/202101-19

Source: secalert_us@oracle.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200122-0003/

Source: secalert_us@oracle.com

Third Party Advisory

https://usn.ubuntu.com/4257-1/

Source: secalert_us@oracle.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4605

Source: secalert_us@oracle.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4621

Source: secalert_us@oracle.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: secalert_us@oracle.com

PatchVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html