CVE-2020-14577: Low severity Oracle JDK vulnerability
A flaw was found in the way the JSSE component of OpenJDK performed TLS server name verification. The HostnameChecker class did not check if names stored in TLS server's X.509 certificate are in the normalized form, possibly leading to an incorrect name being matched.
Other sources
An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.262.b10-0.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.262.b10-0.el7_8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.8.10-0.el7_8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el7 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.8.10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-ibm-1:1.8.0.6.15-1.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.8.10-0.el8_0 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_0 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.8.10-0.el8_1 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_1 - Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.24+8-2~deb11u1Fixed in 11.0.30+7-1~deb11u1Fixed in 11.0.30+7-1 - Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u482-ga-1 - Upgrade
Upgrade
alpine/openjdk11to a version that resolves this vulnerability.Fixed in 11.0.8_p10-r0 - Upgrade
Upgrade
alpine/openjdk7to a version that resolves this vulnerability.Fixed in 7.281.2.6.24-r0 - Upgrade
Upgrade
alpine/openjdk7to a version that resolves this vulnerability.Fixed in 7.261.2.6.23-r0 - Upgrade
Upgrade
alpine/openjdk8to a version that resolves this vulnerability.Fixed in 8.272.10-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-14577?
CVE-2020-14577 is an unspecified vulnerability in Java SE related to the JSSE component that could allow an unauthenticated attacker with network access via TLS to compromise the affected system.
Which versions of Java SE are affected by CVE-2020-14577?
The affected versions of Java SE are 7u261, 8u251, 11.0.7, and 14.0.1.
Is CVE-2020-14577 difficult to exploit?
Yes, CVE-2020-14577 is considered a difficult vulnerability to exploit.
How can an attacker exploit CVE-2020-14577?
An attacker with network access via TLS can exploit CVE-2020-14577.
What is the severity of CVE-2020-14577?
CVE-2020-14577 has a severity level of low, with a score of 3.7.