CVE-2020-14556: Medium severity Oracle JDK vulnerability
A flaw was found in the way the ForkJoinPool class in the Libraries component of OpenJDK handled its access control context. This could possibly lead to code being executed with incorrect permissions, possibly leading to bypass of certain intended restrictions defined by a SecurityManager.
Other sources
An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-14556?
CVE-2020-14556 has been assigned a medium severity rating due to its potential to allow code execution with incorrect permissions.
How do I fix CVE-2020-14556?
To fix CVE-2020-14556, upgrade to the recommended versions of OpenJDK listed for your platform.
What is the impact of CVE-2020-14556?
CVE-2020-14556 may lead to a bypass of intended restrictions defined by a SecurityManager, potentially compromising application security.
Which software versions are affected by CVE-2020-14556?
CVE-2020-14556 affects specific versions of OpenJDK, including versions up to 1.8.0-openjdk-1:1.8.0.262.b10-0 and 11-openjdk-1:11.0.8.10-0.
Is CVE-2020-14556 specific to certain operating systems?
Yes, CVE-2020-14556 is relevant to various operating systems that use vulnerable versions of OpenJDK, including multiple editions of Red Hat, Debian, and Ubuntu.