Amazon Linux AMI update for java-1.8.0-openjdk

1) Improper input validation

EUVDB-ID: #VU27227

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Scripting component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU27228

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Scripting component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU27230

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2756

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper input validation

EUVDB-ID: #VU27231

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2757

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper input validation

EUVDB-ID: #VU27229

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2773

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Security component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper input validation

EUVDB-ID: #VU27221

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2781

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JSSE component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU27224

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2800

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Lightweight HTTP Server component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper input validation

EUVDB-ID: #VU27212

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2803

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Java component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper input validation

EUVDB-ID: #VU27219

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2805

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Libraries component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper input validation

EUVDB-ID: #VU27222

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-2830

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Update the affected packages:

i686:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.i686
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.i686

noarch:
    java-1.8.0-openjdk-javadoc-zip-1.8.0.252.b09-2.51.amzn1.noarch
    java-1.8.0-openjdk-javadoc-1.8.0.252.b09-2.51.amzn1.noarch

src:
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.src

x86_64:
    java-1.8.0-openjdk-demo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-debuginfo-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-src-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-devel-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-1.8.0.252.b09-2.51.amzn1.x86_64
    java-1.8.0-openjdk-headless-1.8.0.252.b09-2.51.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3

cpe:2.3:o:amazon_web_services:amazon_linux_ami:*:*:*:*:*:*:*:

External links

http://alas.aws.amazon.com/ALAS-2023-1809.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Amazon Linux AMI Operating systems & Components / Operating system
Vendor	Amazon Web Services