PT-2020-2594 · Oracle+5 · Java Se Embedded+7
Julien Ahrens
·
Published
2020-04-14
·
Updated
2026-05-08
·
CVE-2020-2773
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Java SE versions 7u251, 8u241, 11.0.6, and 14
Java SE Embedded version 8u241
Description
The issue is related to the Security component of Oracle Java SE and Java SE Embedded, allowing an unauthenticated attacker with network access via multiple protocols to compromise the system. This can result in a partial denial of service (partial DOS) of Java SE and Java SE Embedded. The vulnerability can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component. It affects both client and server deployments of Java.
Recommendations
For Java SE versions 7u251, 8u241, 11.0.6, and 14, consider disabling the use of sandboxed Java Web Start applications and sandboxed Java applets until a patch is available.
For Java SE Embedded version 8u241, restrict access to APIs in the Security component to minimize the risk of exploitation.
As a temporary workaround, consider limiting network access to the affected systems to reduce the risk of unauthorized compromise.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Ibm Aix
Java Platform
Java Se
Java Se Embedded
Red Hat
Suse
Ubuntu