VulnerabilityModified

CVE-2020-2816

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE).

HIGH 7.5EPSS 2.77%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 2.77% probability · 85th percentile
CISA KEV: Not listed
Affected: oracle/jdk · oracle/jre · oracle/openjdk · netapp/7-mode transition tool · netapp/active iq unified manager · netapp/cloud backup · netapp/e-series performance analyzer · netapp/e-series santricity os controller · netapp/e-series santricity web services · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/plug-in for symantec netbackup · netapp/santricity unified manager · netapp/snapmanager · netapp/steelstore cloud integrated storage · netapp/storagegrid · canonical/ubuntu linux · debian/debian linux · opensuse/leap
Source: secalert_us@oracle.com

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
https://usn.ubuntu.com/4337-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4662Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlThird Party Advisory
https://security.netapp.com/advisory/ntap-20200416-0004/Third Party Advisory
https://usn.ubuntu.com/4337-1/Third Party Advisory
https://www.debian.org/security/2020/dsa-4662Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.