Improper input validation in Java SE Embedded - CVE-2020-14798

Vulnerability identifier: #VU47782

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14798

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Java SE Embedded
Engineering Lifecycle Management
Oracle Java SE
Debian Linux
Gentoo Linux
IBM AIX
Opensuse
Ubuntu
Fedora
IBM Cloud Transformation Advisor
IBM Cloud Application Business Insights
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Tivoli Monitoring
IBM CICS TX on Cloud
IBM VIOS
openjdk7 (Alpine package)
openjdk8 (Alpine package)
openjdk11 (Alpine package)
java-1.8.0-openjdk
openjdk-8-jre-zero (Ubuntu package)
openjdk-8-jre-headless (Ubuntu package)
openjdk-8-jre (Ubuntu package)
openjdk-8-jdk (Ubuntu package)
openjdk-11-jre-zero (Ubuntu package)
openjdk-11-jre-headless (Ubuntu package)
openjdk-11-jre (Ubuntu package)
openjdk-11-jdk (Ubuntu package)
java-11-openjdk
openjdk-11 (Debian package)
IBM Security Directory Suite
Dell EMC NetWorker Runtime Environment (NRE)
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
IBM Security Guardium
Solutions Enabler Virtual Appliance

Install updates from vendor's website.

Engineering Lifecycle Management - addressed in versions 6.0.6, 7.0.2
IBM Security Directory Suite - update to 8.0.1.16
openjdk8 (Alpine package) - update to 8.272.10-r0
openjdk11 (Alpine package) - update to 11.0.9_p11-r0
IBM Cloud Application Business Insights - addressed in versions 1.1.3.2, 1.1.4.3, 1.1.5.2
java-1.8.0-openjdk - addressed in versions 1.8.0.272.b10-0.fc31, 1.8.0.272.b10-0.fc32, 1.8.0.272.b10-0.fc33
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.0.0
IBM Tivoli Monitoring - update to 6.3.0.7 Service Pack 7
openjdk-8-jre-zero (Ubuntu package) - addressed in versions 8u272-b10-0ubuntu1~16.04, 8u272-b10-0ubuntu1~18.04, 8u272-b10-0ubuntu1~20.04, 8u272-b10-0ubuntu1~20.10, 8u275-b01-0ubuntu1~16.04, 8u275-b01-0ubuntu1~18.04, 8u275-b01-0ubuntu1~20.04, 8u275-b01-0ubuntu1~20.10
openjdk-8-jre-headless (Ubuntu package) - addressed in versions 8u272-b10-0ubuntu1~16.04, 8u272-b10-0ubuntu1~18.04, 8u272-b10-0ubuntu1~20.04, 8u272-b10-0ubuntu1~20.10, 8u275-b01-0ubuntu1~16.04, 8u275-b01-0ubuntu1~18.04, 8u275-b01-0ubuntu1~20.04, 8u275-b01-0ubuntu1~20.10
openjdk-8-jre (Ubuntu package) - addressed in versions 8u272-b10-0ubuntu1~16.04, 8u272-b10-0ubuntu1~18.04, 8u272-b10-0ubuntu1~20.04, 8u272-b10-0ubuntu1~20.10, 8u275-b01-0ubuntu1~16.04, 8u275-b01-0ubuntu1~18.04, 8u275-b01-0ubuntu1~20.04, 8u275-b01-0ubuntu1~20.10
openjdk-8-jdk (Ubuntu package) - addressed in versions 8u272-b10-0ubuntu1~16.04, 8u272-b10-0ubuntu1~18.04, 8u272-b10-0ubuntu1~20.04, 8u272-b10-0ubuntu1~20.10, 8u275-b01-0ubuntu1~16.04, 8u275-b01-0ubuntu1~18.04, 8u275-b01-0ubuntu1~20.04, 8u275-b01-0ubuntu1~20.10
Dell EMC NetWorker Runtime Environment (NRE) - update to 8.0.7
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.12, 9.2.0.1
Solutions Enabler - addressed in versions 9.1.0.12, 9.2.0.1
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.24, 9.2.0.6
Unisphere for PowerMax - addressed in versions 9.1.0.24, 9.2.0.6
IBM CICS TX on Cloud - update to 10.1.0.0 SpecialFIX Java 042021
openjdk-11-jre-zero (Ubuntu package) - addressed in versions 11.0.9.1+1-0ubuntu1~18.04, 11.0.9.1+1-0ubuntu1~20.04, 11.0.9.1+1-0ubuntu1~20.10, 11.0.9+11-0ubuntu1~18.04.1, 11.0.9+11-0ubuntu1~20.04
openjdk-11-jre-headless (Ubuntu package) - addressed in versions 11.0.9.1+1-0ubuntu1~18.04, 11.0.9.1+1-0ubuntu1~20.04, 11.0.9.1+1-0ubuntu1~20.10, 11.0.9+11-0ubuntu1~18.04.1, 11.0.9+11-0ubuntu1~20.04
openjdk-11-jre (Ubuntu package) - addressed in versions 11.0.9.1+1-0ubuntu1~18.04, 11.0.9.1+1-0ubuntu1~20.04, 11.0.9.1+1-0ubuntu1~20.10, 11.0.9+11-0ubuntu1~18.04.1, 11.0.9+11-0ubuntu1~20.04
openjdk-11-jdk (Ubuntu package) - addressed in versions 11.0.9.1+1-0ubuntu1~18.04, 11.0.9.1+1-0ubuntu1~20.04, 11.0.9.1+1-0ubuntu1~20.10, 11.0.9+11-0ubuntu1~18.04.1, 11.0.9+11-0ubuntu1~20.04
java-11-openjdk - addressed in versions 11.0.9.11-0.fc31, 11.0.9.11-0.fc32, 11.0.9.11-0.fc33
openjdk-11 (Debian package) - update to 11.0.9+11-1~deb10u1

• https://www.oracle.com/security-alerts/cpuoct2020.html

• Multiple vulnerabilities in Java SE Embedded
• Multiple vulnerabilities in Java SE
• Improper input validation in openjdk11 (Alpine package)
• OpenSUSE Linux update for java-1_8_0-openj9
• Improper input validation in openjdk8 (Alpine package)
• Improper input validation in openjdk7 (Alpine package)
• Gentoo update for OpenJDK
• IBM AIX update for Java SDK
• Multiple vulnerabilities in IBM Engineering Lifecycle Management
• Debian update for openjdk-11
• Multiple vulnerabilities in IBM Security Directory Suite
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• Multiple vulnerabilities in Dell EMC NetWorker Runtime Environment (NRE)
• IBM Tivoli Monitoring update for IBM Java
• IBM Cloud Application Business Insights update for Java
• Multiple vulnerabilities in IBM CICS TX on Cloud
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Gentoo update for IcedTea
• Ubuntu update for openjdk-8
• Ubuntu update for openjdk-8
• Fedora 33 update for java-11-openjdk
• Fedora 32 update for java-11-openjdk
• Fedora 31 update for java-11-openjdk
• Fedora 33 update for java-1.8.0-openjdk
• Fedora 32 update for java-1.8.0-openjdk
• Fedora 31 update for java-1.8.0-openjdk