CVE-2020-2830: Medium severity IBM Engineering Requirements Quality Assistant On-Premises vulnerability
A regular expression denial of service flaw was found in the Concurrency component of OpenJDK. The use of overly complex regular expressions in java.utils.Scanner could cause a high CPU usage when Scanner was used on parse certain inputs.
Other sources
An unspecified vulnerability in Java SE related to the Java SE Concurrency component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-openjdk-1:1.7.0.261-2.6.22.1.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.0-openjdk-1:1.7.0.261-2.6.22.2.el7_8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.7.10-4.el7_8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.252.b09-2.el7_8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.7.10-1.el8_1 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_1 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-ibm-1:1.8.0.6.10-1.el8_2 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1:1.8.0.252.b09-2.el8_0 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 11-openjdk-1:11.0.7.10-1.el8_0 - Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.24+8-2~deb11u1Fixed in 11.0.30+7-1~deb11u1Fixed in 11.0.30+7-1 - Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u472-ga-1 - Configuration
Reduce exposure by ensuring attacker-controlled input is not supplied to affected Java SE Concurrency component APIs without proper validation/sanitization.
Java SE / Java SE Embedded (client and server deployment) Avoid providing untrusted data to Java SE Concurrency-related APIs = Apply application-level input validation/sanitization so attacker-controlled input is not passed directly to affected APIs (e.g., as used by web services). - Compensating control
Mitigate the partial denial of service by avoiding overly complex regular expressions in java.utils.Scanner when parsing untrusted inputs.
- Compensating control
If possible, restrict use of network-accessible endpoints/protocols that could supply attacker-controlled data to the affected Java SE Concurrency component (e.g., APIs exposed via web services), since the issue is exploitable remotely (CVSS AV:N, PR:N).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2830?
CVE-2020-2830 is rated as a moderate severity vulnerability.
How do I fix CVE-2020-2830?
To fix CVE-2020-2830, update to the recommended versions of OpenJDK as specified in the vulnerability details.
Which software is affected by CVE-2020-2830?
CVE-2020-2830 affects multiple versions of OpenJDK and IBM's JDK products.
What types of applications are vulnerable due to CVE-2020-2830?
Applications that utilize the java.utils.Scanner class with complex regular expressions are vulnerable due to CVE-2020-2830.
Can I safely use OpenJDK without updating for CVE-2020-2830?
Using unpatched versions of OpenJDK poses a risk, and it is recommended to update to mitigate vulnerability.