CVE-2020-14577: Medium severity IBM Cognos Controller 10.4.2 vulnerability
A flaw was found in the way the JSSE component of OpenJDK performed TLS server name verification. The HostnameChecker class did not check if names stored in TLS server's X.509 certificate are in the normalized form, possibly leading to an incorrect name being matched.
Other sources
An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-14577?
CVE-2020-14577 is an unspecified vulnerability in Java SE related to the JSSE component that could allow an unauthenticated attacker with network access via TLS to compromise the affected system.
Which versions of Java SE are affected by CVE-2020-14577?
The affected versions of Java SE are 7u261, 8u251, 11.0.7, and 14.0.1.
Is CVE-2020-14577 difficult to exploit?
Yes, CVE-2020-14577 is considered a difficult vulnerability to exploit.
How can an attacker exploit CVE-2020-14577?
An attacker with network access via TLS can exploit CVE-2020-14577.
What is the severity of CVE-2020-14577?
CVE-2020-14577 has a severity level of low, with a score of 3.7.