CVE-2020-2655: Medium severity Oracle JDK vulnerability
It was discovered that the TLS implementation in the Security component of OpenJDK did not correctly handle CertificateVerify TLS handshake message received unexpectedly. A remote attacker attacker could use this flaw to affect confidentiality or integrity of a TLS connection.
Other sources
Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.24+8-2~deb11u1Fixed in 11.0.31+11-1~deb11u1Fixed in 11.0.32~8ea-1 - Upgrade
Upgrade
Oracle Java SE (JSSE / TLS implementation in Security component of OpenJDK)to a version that resolves this vulnerability.Fixed in 11.0.5 - Upgrade
Upgrade
Oracle Java SE (JSSE / TLS implementation in Security component of OpenJDK)to a version that resolves this vulnerability.Fixed in 13.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2655?
CVE-2020-2655 has a severity rating of high due to its potential impact on TLS connection confidentiality and integrity.
How do I fix CVE-2020-2655?
To fix CVE-2020-2655, upgrade to the latest version of OpenJDK or the respective Java Runtime Environment that is not affected by this vulnerability.
Which software is affected by CVE-2020-2655?
CVE-2020-2655 affects specific versions of OpenJDK and Oracle JDK and JRE such as 11.0.5 and 13.0.1.
What type of vulnerability is CVE-2020-2655?
CVE-2020-2655 is a TLS implementation vulnerability that can lead to potential attacks during the TLS handshake process.
Can CVE-2020-2655 be exploited remotely?
Yes, CVE-2020-2655 can be exploited by a remote attacker to affect the confidentiality or integrity of a TLS connection.