CVE-2020-2816

Publication date 15 April 2020

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openjdk-14	20.04 LTS focal	Fixed 14.0.1+7-1ubuntu1
	19.10 eoan	Ignored end of life
	18.04 LTS bionic	Not in release
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release
openjdk-8	20.04 LTS focal	Not affected
	19.10 eoan	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not in release
openjdk-lts	20.04 LTS focal	Fixed 11.0.7+10-2ubuntu1
	19.10 eoan	Fixed 11.0.7+10-2ubuntu2~19.10
	18.04 LTS bionic	Fixed 11.0.7+10-2ubuntu2~18.04
	16.04 LTS xenial	Not in release
	14.04 LTS trusty	Not in release

Notes

sbeattie

only affects openjdk-11 and newer

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-4337-1
OpenJDK vulnerabilities
22 April 2020