CVE-2020-14779: Low severity IBM Cloud Pak for Automation vulnerability

Q: What is the severity of CVE-2020-14779?

The severity of CVE-2020-14779 is low with a severity value of 3.7.

Q: What is the affected software for CVE-2020-14779?

The affected software for CVE-2020-14779 is Java SE and Java SE Embedded.

Q: How can an attacker exploit CVE-2020-14779?

CVE-2020-14779 is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access.

Q: How do I fix CVE-2020-14779?

To fix CVE-2020-14779, update to the recommended versions of Java SE: 7u271, 8u261, 11.0.8, or 15.

Q: Where can I find more information about CVE-2020-14779?

You can find more information about CVE-2020-14779 on the Oracle website: [link1], [link2], [link3].

Published Oct 19, 2020

Updated

An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

Other sources

It was discovered that the implementation of the Proxy class in the Serialization component of OpenJDK could trigger an out-of-memory condition when deserializing Proxy class objects with many interfaces. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

The patch for this issue adds a new system property jdk.serialProxyInterfaceLimit that can be used to reduce the limit for Proxy interfaces from the default of 65535 and hence better protect against excessive memory usage.

— Red Hat

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected Software

129 affected componentsFixes available

redhat/java<1.8.0-openjdk-1:1.8.0.272.b10-0.el6_10

1.8.0-openjdk-1:1.8.0.272.b10-0.el6_10

redhat/java<11-openjdk-1:11.0.9.11-0.el7_9

11-openjdk-1:11.0.9.11-0.el7_9

redhat/java<1.8.0-openjdk-1:1.8.0.272.b10-1.el7_9

1.8.0-openjdk-1:1.8.0.272.b10-1.el7_9

redhat/java<1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7

1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7

redhat/java<1.7.1-ibm-1:1.7.1.4.75-1jpp.1.el7

1.7.1-ibm-1:1.7.1.4.75-1jpp.1.el7

redhat/java<11-openjdk-1:11.0.9.11-0.el8_2

11-openjdk-1:11.0.9.11-0.el8_2

redhat/java<1.8.0-openjdk-1:1.8.0.272.b10-1.el8_2

1.8.0-openjdk-1:1.8.0.272.b10-1.el8_2

redhat/java<1.8.0-ibm-1:1.8.0.6.20-1.el8_3

1.8.0-ibm-1:1.8.0.6.20-1.el8_3

redhat/java<11-openjdk-1:11.0.9.11-0.el8_0

11-openjdk-1:11.0.9.11-0.el8_0

redhat/java<1.8.0-openjdk-1:1.8.0.272.b10-0.el8_0

1.8.0-openjdk-1:1.8.0.272.b10-0.el8_0

redhat/java<11-openjdk-1:11.0.9.11-0.el8_1

11-openjdk-1:11.0.9.11-0.el8_1

redhat/java<1.8.0-openjdk-1:1.8.0.272.b10-0.el8_1

1.8.0-openjdk-1:1.8.0.272.b10-0.el8_1

debian/openjdk-11

11.0.16+8-1~deb10u111.0.20+8-1~deb10u111.0.20+8-1~deb11u111.0.21+9-1

debian/openjdk-8

8u382-ga-2

IBM Cloud Pak for Automation<=20.0.3-IF002

IBM Cloud Pak for Automation<=21.0.1

Oracle JDK=1.7.0-update271

Oracle JDK=1.8.0-update261

Oracle JDK=11.0.8

Oracle JDK=15

Oracle JRE=1.8.0-update261

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Fedoraproject Fedora=33

openSUSE Leap=15.2

NetApp 7-Mode Transition Tool

NetApp Active Iq Unified Manager Windows>=7.3

NetApp Active Iq Unified Manager Vmware Vsphere>=9.5

NetApp E-Series SANtricity OS Controller>=11.0.0<=11.60.3

NetApp E-series Santricity Storage Manager

NetApp E-series Santricity Web Services Web Services Proxy

NetApp Hci Management Node

NetApp OnCommand Insight

NetApp OnCommand Unified Manager Core Package

NetApp Santricity Cloud Connector

NetApp Santricity Unified Manager

NetApp Snapmanager Oracle

NetApp Snapmanager Sap

NetApp Solidfire

NetApp Hci Storage Node

Oracle OpenJDK=7

Oracle OpenJDK=7-update1

Oracle OpenJDK=7-update10

Oracle OpenJDK=7-update101

Oracle OpenJDK=7-update11

Oracle OpenJDK=7-update111

Oracle OpenJDK=7-update121

Oracle OpenJDK=7-update13

Oracle OpenJDK=7-update131

Oracle OpenJDK=7-update141

Oracle OpenJDK=7-update15

Oracle OpenJDK=7-update151

Oracle OpenJDK=7-update161

Oracle OpenJDK=7-update17

Oracle OpenJDK=7-update171

Oracle OpenJDK=7-update181

Oracle OpenJDK=7-update191

Oracle OpenJDK=7-update2

Oracle OpenJDK=7-update201

Oracle OpenJDK=7-update21

Oracle OpenJDK=7-update211

Oracle OpenJDK=7-update221

Oracle OpenJDK=7-update231

Oracle OpenJDK=7-update241

Oracle OpenJDK=7-update25

Oracle OpenJDK=7-update251

Oracle OpenJDK=7-update261

Oracle OpenJDK=7-update271

Oracle OpenJDK=8

Oracle OpenJDK=8-milestone1

Oracle OpenJDK=8-milestone2

Oracle OpenJDK=8-milestone3

Oracle OpenJDK=8-milestone4

Oracle OpenJDK=8-milestone5

Oracle OpenJDK=8-milestone6

Oracle OpenJDK=8-milestone7

Oracle OpenJDK=8-milestone8

Oracle OpenJDK=8-milestone9

Oracle OpenJDK=8-update101

Oracle OpenJDK=8-update102

Oracle OpenJDK=8-update11

Oracle OpenJDK=8-update111

Oracle OpenJDK=8-update112

Oracle OpenJDK=8-update121

Oracle OpenJDK=8-update131

Oracle OpenJDK=8-update141

Oracle OpenJDK=8-update151

Oracle OpenJDK=8-update152

Oracle OpenJDK=8-update161

Oracle OpenJDK=8-update162

Oracle OpenJDK=8-update171

Oracle OpenJDK=8-update172

Oracle OpenJDK=8-update181

Oracle OpenJDK=8-update191

Oracle OpenJDK=8-update192

Oracle OpenJDK=8-update20

Oracle OpenJDK=8-update201

Oracle OpenJDK=8-update202

Oracle OpenJDK=8-update211

Oracle OpenJDK=8-update212

Oracle OpenJDK=8-update221

Oracle OpenJDK=8-update222

Oracle OpenJDK=8-update231

Oracle OpenJDK=8-update232

Oracle OpenJDK=8-update241

Oracle OpenJDK=8-update242

Oracle OpenJDK=8-update25

Oracle OpenJDK=8-update252

Oracle OpenJDK=8-update262

Oracle OpenJDK=11

Oracle OpenJDK=11.0.1

Oracle OpenJDK=11.0.2

Oracle OpenJDK=11.0.3

Oracle OpenJDK=11.0.4

Oracle OpenJDK=11.0.5

Oracle OpenJDK=11.0.6

Oracle OpenJDK=11.0.7

Oracle OpenJDK=11.0.8

Oracle OpenJDK=13

Oracle OpenJDK=13.0.1

Oracle OpenJDK=13.0.2

Oracle OpenJDK=13.0.3

Oracle OpenJDK=13.0.4

Oracle OpenJDK=15

Oracle JRE=1.7.0-update271

Oracle JRE=11.0.8

Oracle JRE=15

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.272.b10-0.el6_10
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.9.11-0.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.272.b10-1.el7_9
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-ibm-1:1.8.0.6.20-1jpp.1.el7
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.7.1-ibm-1:1.7.1.4.75-1jpp.1.el7
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.9.11-0.el8_2
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.272.b10-1.el8_2
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-ibm-1:1.8.0.6.20-1.el8_3
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.9.11-0.el8_0
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.272.b10-0.el8_0
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 11-openjdk-1:11.0.9.11-0.el8_1
Upgrade
Upgrade redhat/java to a version that resolves this vulnerability.
Fixed in 1.8.0-openjdk-1:1.8.0.272.b10-0.el8_1
Upgrade
Upgrade debian/openjdk-11 to a version that resolves this vulnerability.
Fixed in 11.0.16+8-1~deb10u1Fixed in 11.0.20+8-1~deb10u1Fixed in 11.0.20+8-1~deb11u1Fixed in 11.0.21+9-1
Upgrade
Upgrade debian/openjdk-8 to a version that resolves this vulnerability.
Fixed in 8u382-ga-2
Upgrade
Upgrade Java SE to a version that resolves this vulnerability.
Fixed in 7u271
Upgrade
Upgrade Java SE to a version that resolves this vulnerability.
Fixed in 8u261
Upgrade
Upgrade Java SE to a version that resolves this vulnerability.
Fixed in 11.0.8
Upgrade
Upgrade Java SE to a version that resolves this vulnerability.
Fixed in 15
Upgrade
Upgrade Java SE Embedded to a version that resolves this vulnerability.
Fixed in 8u261
Configuration
Apply the patch’s new system property jdk.serialProxyInterfaceLimit to reduce the Proxy interface limit from the default of 65535, limiting the impact of out-of-memory conditions during deserialization of Proxy objects with many interfaces.
OpenJDK Serialization (Proxy class) jdk.serialProxyInterfaceLimit = (set to a lower value than default 65535)

Event History

Oct 19, 2020

Data Sourced

via Red Hat·08:41 AM

DescriptionSeverityAffected Software

Oct 20, 2020

CVE Published

12:00 AM

Oct 21, 2020

CVE Published

via MITRE·02:04 PM

Data Sourced

via MITRE·02:04 PM

DescriptionSeverityWeakness

Apr 10, 58623

Event

09:57 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2020-14779?