First published: Sun Apr 12 2020(Updated: )
A flaw was found in the Serialization component of OpenJDK. A reference to an uninitialized class descriptor encountered during object stream deserialization could cause an unexpected exception to be raised when processing an untrusted serialized input.
Credit: secalert_us@oracle.com secalert_us@oracle.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 |
redhat/java | <1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 | 1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 |
redhat/java | <11-openjdk-1:11.0.7.10-4.el7_8 | 11-openjdk-1:11.0.7.10-4.el7_8 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 |
redhat/java | <1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 | 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_1 | 11-openjdk-1:11.0.7.10-1.el8_1 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 |
redhat/java | <1.8.0-ibm-1:1.8.0.6.10-1.el8_2 | 1.8.0-ibm-1:1.8.0.6.10-1.el8_2 |
redhat/java | <1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 | 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 |
redhat/java | <11-openjdk-1:11.0.7.10-1.el8_0 | 11-openjdk-1:11.0.7.10-1.el8_0 |
Oracle JDK | =1.7.0-update251 | |
Oracle JDK | =1.8.0-update241 | |
Oracle JDK | =11.0.6 | |
Oracle JDK | =14.0.0 | |
Oracle JRE | =1.7.0-update251 | |
Oracle JRE | =1.8.0-update241 | |
Oracle JRE | =11.0.6 | |
Oracle JRE | =14.0.0 | |
Oracle OpenJDK | >=11<=11.0.6 | |
Oracle OpenJDK | >=13<=13.0.2 | |
Oracle OpenJDK | =7 | |
Oracle OpenJDK | =7-update1 | |
Oracle OpenJDK | =7-update10 | |
Oracle OpenJDK | =7-update101 | |
Oracle OpenJDK | =7-update11 | |
Oracle OpenJDK | =7-update111 | |
Oracle OpenJDK | =7-update121 | |
Oracle OpenJDK | =7-update13 | |
Oracle OpenJDK | =7-update131 | |
Oracle OpenJDK | =7-update141 | |
Oracle OpenJDK | =7-update15 | |
Oracle OpenJDK | =7-update151 | |
Oracle OpenJDK | =7-update161 | |
Oracle OpenJDK | =7-update17 | |
Oracle OpenJDK | =7-update171 | |
Oracle OpenJDK | =7-update181 | |
Oracle OpenJDK | =7-update191 | |
Oracle OpenJDK | =7-update2 | |
Oracle OpenJDK | =7-update201 | |
Oracle OpenJDK | =7-update21 | |
Oracle OpenJDK | =7-update211 | |
Oracle OpenJDK | =7-update221 | |
Oracle OpenJDK | =7-update231 | |
Oracle OpenJDK | =7-update241 | |
Oracle OpenJDK | =7-update25 | |
Oracle OpenJDK | =7-update251 | |
Oracle OpenJDK | =7-update3 | |
Oracle OpenJDK | =7-update4 | |
Oracle OpenJDK | =7-update40 | |
Oracle OpenJDK | =7-update45 | |
Oracle OpenJDK | =7-update5 | |
Oracle OpenJDK | =7-update51 | |
Oracle OpenJDK | =7-update55 | |
Oracle OpenJDK | =7-update6 | |
Oracle OpenJDK | =7-update60 | |
Oracle OpenJDK | =7-update65 | |
Oracle OpenJDK | =7-update67 | |
Oracle OpenJDK | =7-update7 | |
Oracle OpenJDK | =7-update72 | |
Oracle OpenJDK | =7-update76 | |
Oracle OpenJDK | =7-update80 | |
Oracle OpenJDK | =7-update85 | |
Oracle OpenJDK | =7-update9 | |
Oracle OpenJDK | =7-update91 | |
Oracle OpenJDK | =7-update95 | |
Oracle OpenJDK | =7-update97 | |
Oracle OpenJDK | =7-update99 | |
Oracle OpenJDK | =8 | |
Oracle OpenJDK | =8-update101 | |
Oracle OpenJDK | =8-update102 | |
Oracle OpenJDK | =8-update11 | |
Oracle OpenJDK | =8-update111 | |
Oracle OpenJDK | =8-update112 | |
Oracle OpenJDK | =8-update121 | |
Oracle OpenJDK | =8-update131 | |
Oracle OpenJDK | =8-update141 | |
Oracle OpenJDK | =8-update151 | |
Oracle OpenJDK | =8-update152 | |
Oracle OpenJDK | =8-update161 | |
Oracle OpenJDK | =8-update162 | |
Oracle OpenJDK | =8-update171 | |
Oracle OpenJDK | =8-update172 | |
Oracle OpenJDK | =8-update181 | |
Oracle OpenJDK | =8-update191 | |
Oracle OpenJDK | =8-update192 | |
Oracle OpenJDK | =8-update20 | |
Oracle OpenJDK | =8-update201 | |
Oracle OpenJDK | =8-update202 | |
Oracle OpenJDK | =8-update211 | |
Oracle OpenJDK | =8-update212 | |
Oracle OpenJDK | =8-update221 | |
Oracle OpenJDK | =8-update231 | |
Oracle OpenJDK | =8-update241 | |
Oracle OpenJDK | =8-update25 | |
Oracle OpenJDK | =8-update31 | |
Oracle OpenJDK | =8-update40 | |
Oracle OpenJDK | =8-update45 | |
Oracle OpenJDK | =8-update5 | |
Oracle OpenJDK | =8-update51 | |
Oracle OpenJDK | =8-update60 | |
Oracle OpenJDK | =8-update65 | |
Oracle OpenJDK | =8-update66 | |
Oracle OpenJDK | =8-update71 | |
Oracle OpenJDK | =8-update72 | |
Oracle OpenJDK | =8-update73 | |
Oracle OpenJDK | =8-update74 | |
Oracle OpenJDK | =8-update77 | |
Oracle OpenJDK | =8-update91 | |
Oracle OpenJDK | =8-update92 | |
Oracle OpenJDK | =14 | |
NetApp 7-Mode Transition Tool | ||
Netapp Active Iq Unified Manager Windows | >=7.3 | |
Netapp Active Iq Unified Manager Vsphere | >=9.5 | |
Netapp Cloud Backup | ||
Netapp Cloud Secure Agent | ||
Netapp E-series Performance Analyzer | ||
NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.70.2 | |
Netapp E-series Santricity Web Services Web Services Proxy | ||
NetApp OnCommand Insight | ||
Netapp Santricity Unified Manager | ||
Netapp Snapmanager Sap | ||
Netapp Snapmanager Oracle | ||
Netapp Steelstore Cloud Integrated Storage | ||
Netapp Storagegrid | >=9.0.0<=9.0.4 | |
Netapp Storagegrid | ||
Fedoraproject Fedora | =30 | |
Fedoraproject Fedora | =31 | |
Fedoraproject Fedora | =32 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
Debian Debian Linux | =10.0 | |
Canonical Ubuntu Linux | =16.04 | |
Canonical Ubuntu Linux | =18.04 | |
Canonical Ubuntu Linux | =19.10 | |
openSUSE Leap | =15.1 | |
openSUSE Leap | =15.2 | |
McAfee ePolicy Orchestrator | >=5.9.0<5.10.0 | |
McAfee ePolicy Orchestrator | =5.10.0-update_1 | |
McAfee ePolicy Orchestrator | =5.10.0-update_2 | |
McAfee ePolicy Orchestrator | =5.10.0-update_3 | |
McAfee ePolicy Orchestrator | =5.10.0-update_4 | |
McAfee ePolicy Orchestrator | =5.10.0-update_5 | |
McAfee ePolicy Orchestrator | =5.10.0-update_6 | |
McAfee ePolicy Orchestrator | =5.10.0-update_7 | |
McAfee ePolicy Orchestrator | =5.10.0-update_8 | |
IBM Engineering Requirements Quality Assistant On-Premises | <=All | |
debian/openjdk-11 | 11.0.24+8-2~deb11u1 11.0.25~5ea-1 | |
debian/openjdk-8 | 8u422-b05-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
The vulnerability ID for this vulnerability is CVE-2020-2756.
The severity level of CVE-2020-2756 is low with a severity value of 3.7.
The affected versions of Java SE are 7u251, 8u241, 11.0.6, and 14.
An unauthenticated attacker with network access can exploit CVE-2020-2756.
You can find more information about CVE-2020-2756 at the following references: [Link1](https://www.oracle.com/security-alerts/cpuapr2020.html#AppendixJAVA) [Link2](https://access.redhat.com/errata/RHSA-2020:1508) [Link3](https://access.redhat.com/errata/RHSA-2020:1507)