Lucene search

K
osvGoogleOSV:USN-4607-1
HistoryOct 27, 2020 - 11:15 p.m.

openjdk-8, openjdk-lts vulnerabilities

2020-10-2723:15:43
Google
osv.dev
10
openjdk
vulnerabilities
deserialization
authentication
certificates
integer overflows
file system
permissions
uri paths
input string length
boundary checks
remote attacker
denial of service
sensitive information
unencrypted connection
bypass
java sandbox restrictions
software

AI Score

7.6

Confidence

Low

EPSS

0.005

Percentile

75.5%

It was discovered that OpenJDK incorrectly handled deserializing Proxy
class objects with many interfaces. A remote attacker could possibly use
this issue to cause a denial of service (memory consumption) via a
specially crafted input. (CVE-2020-14779)

Sergey Ostanin discovered that OpenJDK incorrectly restricted
authentication mechanisms. A remote attacker could possibly use this
issue to obtain sensitive information over an unencrypted connection.
(CVE-2020-14781)

It was discovered that OpenJDK incorrectly handled untrusted certificates.
An attacker could possibly use this issue to read or write sensitive
information. (CVE-2020-14782)

Zhiqiang Zang discovered that OpenJDK incorrectly checked for integer
overflows. An attacker could possibly use this issue to bypass certain
Java sandbox restrictions. (CVE-2020-14792)

Markus Loewe discovered that OpenJDK incorrectly checked permissions when
converting a file system path to an URI. An attacker could possibly use
this issue to bypass certain Java sandbox restrictions. (CVE-2020-14796)

Markus Loewe discovered that OpenJDK incorrectly checked for invalid
characters when converting an URI to a path. An attacker could possibly
use this issue to read or write sensitive information. (CVE-2020-14797)

Markus Loewe discovered that OpenJDK incorrectly checked the length of
input strings. An attacker could possibly use this issue to bypass certain
Java sandbox restrictions. (CVE-2020-14798)

It was discovered that OpenJDK incorrectly handled boundary checks. An
attacker could possibly use this issue to bypass certain Java sandbox
restrictions. (CVE-2020-14803)