PT-2020-2595 · Oracle+4 · Java Se+5

Peter Dettman · Published 2020-04-14 · Updated 2026-05-08 · CVE-2020-2778

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Java SE versions 11.0.6 and 14

Description The issue is related to insufficient access control in the JSSE component of Oracle Java SE, allowing a remote attacker to gain unauthorized access to protected information via the HTTPS protocol. This can result in unauthorized read access to a subset of Java SE accessible data. The vulnerability can be exploited through sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the specified component.

Recommendations For Java SE version 11.0.6, update to a version that includes the fix for this issue. For Java SE version 14, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the JSSE component until a patch is available. Avoid using the JSSE component for sensitive operations until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-02629

BIT-JAVA-2020-2778

BIT-JAVA-MIN-2020-2778

BIT-JRE-2020-2778

CESA-2020_1509

CESA-2020_1514

CVE-2020-2778

DSA-4662-1

OPENSUSE-SU-2020:0757-1

OPENSUSE-SU-2020_0757-1

OPENSUSE-SU-2024:10871-1

OPENSUSE-SU-2024:10872-1

RHSA-2020:1509

RHSA-2020:1514

RHSA-2020:1517

RHSA-2020_1509

RHSA-2020_1514

SUSE-SU-2020:1511-1

SUSE-SU-2020:1511-2

SUSE-SU-2020:1572-1

SUSE-SU-2020_1511-1

SUSE-SU-2020_1511-2

SUSE-SU-2020_1572-1

USN-4337-1

Affected Products

Centos

Java Platform

Java Se

Red Hat

Suse

Ubuntu

References · 142

• https://ubuntu.com/security/CVE-2020-2757 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2830 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1514.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1511-2 · Vendor Advisory
• https://oracle.com/security-alerts/cpuapr2020.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0757-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1509.html · Vendor Advisory
• https://debian.org/security/2020/dsa-4662 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2805 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-2020-2778 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10871-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4337-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02629 · Security Note
• https://ubuntu.com/security/CVE-2020-2756 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-2754 · Vendor Advisory