REDHAT-BUG-1790944
First published: Tue Jan 14 2020(Updated: )
A flaw was found in the Serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenJDK 17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.oracle.com/technetwork/java/javase/13-0-2-relnotes-5812268.html
- https://www.oracle.com/technetwork/java/javase/11-0-6-oracle-relnotes-5813175.html
- https://www.oracle.com/technetwork/java/javase/8u241-relnotes-5813177.html
- https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_251
- https://www.oracle.com/security-alerts/cpujan2020.html#AppendixJAVA
- https://access.redhat.com/errata/RHSA-2020:0128
- https://access.redhat.com/errata/RHSA-2020:0122
- https://access.redhat.com/errata/RHSA-2020:0157
- https://access.redhat.com/errata/RHSA-2020:0196
- https://access.redhat.com/errata/RHSA-2020:0202
- https://access.redhat.com/errata/RHSA-2020:0231
- https://access.redhat.com/errata/RHSA-2020:0232
- https://access.redhat.com/errata/RHSA-2020:0465
- https://access.redhat.com/errata/RHSA-2020:0467
- https://access.redhat.com/errata/RHSA-2020:0469
- https://access.redhat.com/errata/RHSA-2020:0468
- https://access.redhat.com/errata/RHSA-2020:0470
- https://access.redhat.com/errata/RHSA-2020:0541
- http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/bd2168874bbd
- http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/decb51098c77
- http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/4c2769189ed5
- https://access.redhat.com/errata/RHSA-2020:0632
- https://access.redhat.com/security/cve/cve-2020-2604
- https://access.redhat.com/errata/RHSA-2020:0856
- https://bugzilla.redhat.com/show_bug.cgi?id=1790944
Frequently Asked Questions
What is the severity of REDHAT-BUG-1790944?
The severity of REDHAT-BUG-1790944 is currently rated as high due to the potential for deserialization attacks.
How do I fix REDHAT-BUG-1790944?
To fix REDHAT-BUG-1790944, ensure you are using a patched version of OpenJDK that resolves the serialization filter issue.
What versions of OpenJDK are affected by REDHAT-BUG-1790944?
OpenJDK versions including and prior to version 17 are affected by REDHAT-BUG-1790944.
What is the impact of REDHAT-BUG-1790944?
The impact of REDHAT-BUG-1790944 could allow an attacker to bypass the intended serialization filter during deserialization, leading to potential security breaches.
Is REDHAT-BUG-1790944 a known vulnerability?
Yes, REDHAT-BUG-1790944 is a known vulnerability reported in the serialization component of OpenJDK.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-2604
- agent/source
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/oracle
- canonical/openjdk 17