CVE-2020-2604: High severity Oracle Commerce Experience Manager vulnerability
A flaw was found in the Serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.
Other sources
An unspecified vulnerability in Java SE could allow an unauthenticated attacker to take control of the system.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2604?
CVE-2020-2604 has a medium severity level that allows potential deserialization issues.
How do I fix CVE-2020-2604?
To mitigate CVE-2020-2604, update OpenJDK to the latest patched version that addresses this vulnerability.
What types of software are affected by CVE-2020-2604?
CVE-2020-2604 affects various versions of OpenJDK and Oracle JDK, specifically those prior to the fixed releases.
What could happen if CVE-2020-2604 is exploited?
Exploitation of CVE-2020-2604 could lead to unauthorized access and manipulation of serialized data during deserialization.
When was CVE-2020-2604 disclosed?
CVE-2020-2604 was disclosed in January 2020 as part of Oracle's security updates.