CVE-2020-14621: Input Validation
First published: Tue Jul 14 2020(Updated: )
A flaw was found in the way the XMLSchemaValidator class in the JAXP component of OpenJDK enforced the "use-grammar-pool-only" feature. A specially-crafted XML file could possibly use this flaw to manipulate with the validation process in certain cases.
Credit: secalert_us@oracle.com secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el6_10 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el6_10 |
| redhat/java | <1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el6_10 | 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el6_10 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el7_8 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el7_8 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el7_8 | 11-openjdk-1:11.0.8.10-0.el7_8 |
| redhat/java | <1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.4.70-1jpp.1.el7 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_2 | 11-openjdk-1:11.0.8.10-0.el8_2 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_2 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_2 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.15-1.el8_2 | 1.8.0-ibm-1:1.8.0.6.15-1.el8_2 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_0 | 11-openjdk-1:11.0.8.10-0.el8_0 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_0 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_0 |
| redhat/java | <11-openjdk-1:11.0.8.10-0.el8_1 | 11-openjdk-1:11.0.8.10-0.el8_1 |
| redhat/java | <1.8.0-openjdk-1:1.8.0.262.b10-0.el8_1 | 1.8.0-openjdk-1:1.8.0.262.b10-0.el8_1 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-8 | <8 | 8 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1~18.04.1 | 11.0.8+10-0ubuntu1~18.04.1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1~20.04 | 11.0.8+10-0ubuntu1~20.04 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| ubuntu/openjdk-lts | <11.0.8+10-0ubuntu1 | 11.0.8+10-0ubuntu1 |
| debian/openjdk-11 | 11.0.16+8-1~deb10u1 11.0.23+9-1~deb10u1 11.0.22+7-1~deb11u1 11.0.23+9-1~deb11u1 11.0.23+9-1 | |
| debian/openjdk-8 | 8u412-ga-1 | |
| Oracle JDK | =1.7.0-update261 | |
| Oracle JDK | =1.8.0-update251 | |
| Oracle JDK | =11.0.7 | |
| Oracle JDK | =14.0.1 | |
| Oracle JRE | =1.8.0-update251 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| McAfee ePolicy Orchestrator | =5.9.0 | |
| McAfee ePolicy Orchestrator | =5.9.1 | |
| McAfee ePolicy Orchestrator | =5.10.0 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_1 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_2 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_3 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_4 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_5 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_6 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_7 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_8 | |
| openSUSE Leap | =15.1 | |
| openSUSE Leap | =15.2 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =20.04 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| NetApp 7-Mode Transition Tool | ||
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| Netapp Cloud Backup | ||
| Netapp Cloud Secure Agent | ||
| Netapp E-series Performance Analyzer | ||
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.2 | |
| Netapp E-series Santricity Storage Manager | ||
| Netapp E-series Santricity Web Services Web Services Proxy | ||
| NetApp OnCommand Insight | ||
| NetApp OnCommand Unified Manager Core Package | ||
| NetApp OnCommand Workflow Automation | ||
| Netapp Plug-in For Symantec Netbackup | ||
| Netapp Santricity Unified Manager | ||
| Netapp Snapmanager Oracle | ||
| Netapp Snapmanager Sap | ||
| Netapp Steelstore Cloud Integrated Storage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-14621 https://nvd.nist.gov/vuln/detail/CVE-2020-14621
- https://bugzilla.redhat.com/show_bug.cgi?id=1856885
- https://access.redhat.com/errata/RHSA-2020:2985
- https://access.redhat.com/errata/RHSA-2020:3387
- https://access.redhat.com/errata/RHSA-2020:2968
- https://access.redhat.com/errata/RHSA-2020:2969
- https://access.redhat.com/errata/RHSA-2020:3388
- https://access.redhat.com/errata/RHSA-2020:5585
- https://access.redhat.com/errata/RHSA-2020:2970
- https://access.redhat.com/errata/RHSA-2020:2972
- https://access.redhat.com/errata/RHSA-2020:3386
- https://access.redhat.com/errata/RHSA-2020:3098
- https://access.redhat.com/errata/RHSA-2020:3100
- https://access.redhat.com/errata/RHSA-2020:3099
- https://access.redhat.com/errata/RHSA-2020:3101
- https://access.redhat.com/security/cve/cve-2020-14621
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://security.netapp.com/advisory/ntap-20200717-0005/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
- https://www.debian.org/security/2020/dsa-4734
- https://usn.ubuntu.com/4433-1/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00019.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00027.html
- https://usn.ubuntu.com/4453-1/
- https://security.gentoo.org/glsa/202008-24
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332
- https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103@%3Cj-users.xerces.apache.org%3E
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00041.html
- https://security.gentoo.org/glsa/202209-15
- https://launchpad.net/bugs/cve/CVE-2020-14621
- https://exchange.xforce.ibmcloud.com/vulnerabilities/185099
- https://www.ibm.com/support/pages/node/6256562 (Advisory)
- https://kc.mcafee.com/corporate/index?page=content&id=SB10332
- https://lists.apache.org/thread.html/rf96c5afb26b596b4b97883aa90b6c0b0fc4c26aaeea7123c21912103%40%3Cj-users.xerces.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CFJPOYF3CWYEPCDOAOCNFJTQIKKWPHW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DFZ36XIW5ENQAW6BB7WHRFFTTJX7KGMR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEPHBZPNSLX43B26DWKB7OS6AROTS2BO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QQUMIAON2YEFRONMIUVHAKYCIOLICDBA/
- https://www.oracle.com/security-alerts/cpujul2020.html#AppendixJAVA
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/59f8565ee5e2
- http://hg.openjdk.java.net/jdk8u/jdk8u/jaxp/rev/63884b34cac1
- https://security-tracker.debian.org/tracker/CVE-2020-14621
- https://ubuntu.com/security/notices/USN-4433-1
- https://ubuntu.com/security/notices/USN-4453-1
- https://www.cve.org/CVERecord?id=CVE-2020-14621
- https://nvd.nist.gov/vuln/detail/CVE-2020-14621
- https://ubuntu.com/security/CVE-2020-14621
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2020-14621?
CVE-2020-14621 is an unspecified vulnerability in Java SE related to the JAXP component.
What versions of Java SE are affected by CVE-2020-14621?
Java SE versions 7u261, 8u251, 11.0.7, and 14.0.1 are affected by CVE-2020-14621.
How severe is CVE-2020-14621?
CVE-2020-14621 has a severity level of 5.3 (medium).
Is CVE-2020-14621 easily exploitable?
Yes, CVE-2020-14621 is an easily exploitable vulnerability.
How can I fix CVE-2020-14621?
To fix CVE-2020-14621, you should update to the patched versions of Java SE or Java SE Embedded provided by Oracle.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/ibm-support
- source/IBM
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-14621
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/references
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/redhat
- package-manager/ubuntu
- package-manager/debian
- vendor/oracle
- canonical/oracle jdk
- version/oracle jdk/1.7.0-update261
- version/oracle jdk/1.8.0-update251
- version/oracle jdk/11.0.7
- version/oracle jdk/14.0.1
- canonical/oracle jre
- version/oracle jre/1.8.0-update251
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/5.9.0
- version/mcafee epolicy orchestrator/5.9.1
- version/mcafee epolicy orchestrator/5.10.0
- version/mcafee epolicy orchestrator/5.10.0-update_1
- version/mcafee epolicy orchestrator/5.10.0-update_2
- version/mcafee epolicy orchestrator/5.10.0-update_3
- version/mcafee epolicy orchestrator/5.10.0-update_4
- version/mcafee epolicy orchestrator/5.10.0-update_5
- version/mcafee epolicy orchestrator/5.10.0-update_6
- version/mcafee epolicy orchestrator/5.10.0-update_7
- version/mcafee epolicy orchestrator/5.10.0-update_8
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1
- version/opensuse leap/15.2
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/20.04
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- vendor/netapp
- canonical/netapp 7-mode transition tool
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp cloud backup
- canonical/netapp cloud secure agent
- canonical/netapp e-series performance analyzer
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.70.2
- canonical/netapp e-series santricity storage manager
- canonical/netapp e-series santricity web services web services proxy
- canonical/netapp oncommand insight
- canonical/netapp oncommand unified manager core package
- canonical/netapp oncommand workflow automation
- canonical/netapp plug-in for symantec netbackup
- canonical/netapp santricity unified manager
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- canonical/netapp steelstore cloud integrated storage