CVE-2020-2654
Published Jan 14, 2020
·Updated
A flaw was discovered in the way the Libraries component of OpenJDK processed X.509 certificates. Values of Object Identifiers (OIDs) were "interned", possibly allowing a malicious X.509 certificate to trigger excessive memory usage in a Java application processing such certificate.
Affected Software
93 affected componentsFixes available
redhat/java<1.8.0-openjdk-1:1.8.0.242.b07-1.el6_10
1.8.0-openjdk-1:1.8.0.242.b07-1.el6_10
redhat/java<1.7.0-openjdk-1:1.7.0.251-2.6.21.0.el6_10
1.7.0-openjdk-1:1.7.0.251-2.6.21.0.el6_10
redhat/java<1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10
1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el6_10
redhat/java<1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10
1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el6_10
redhat/java<11-openjdk-1:11.0.6.10-1.el7_7
11-openjdk-1:11.0.6.10-1.el7_7
redhat/java<1.8.0-openjdk-1:1.8.0.242.b08-0.el7_7
1.8.0-openjdk-1:1.8.0.242.b08-0.el7_7
redhat/java<1.7.0-openjdk-1:1.7.0.251-2.6.21.0.el7_7
1.7.0-openjdk-1:1.7.0.251-2.6.21.0.el7_7
redhat/java<1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7
1.8.0-ibm-1:1.8.0.6.10-1jpp.1.el7
redhat/java<1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7
1.7.1-ibm-1:1.7.1.4.65-1jpp.1.el7
redhat/java<11-openjdk-1:11.0.6.10-0.el8_1
11-openjdk-1:11.0.6.10-0.el8_1
redhat/java<1.8.0-openjdk-1:1.8.0.242.b08-0.el8_1
1.8.0-openjdk-1:1.8.0.242.b08-0.el8_1
redhat/java<1.8.0-ibm-1:1.8.0.6.10-1.el8_2
1.8.0-ibm-1:1.8.0.6.10-1.el8_2
redhat/java<1.8.0-openjdk-1:1.8.0.242.b08-0.el8_0
1.8.0-openjdk-1:1.8.0.242.b08-0.el8_0
redhat/java<11-openjdk-1:11.0.6.10-0.el8_0
11-openjdk-1:11.0.6.10-0.el8_0
IBM Security Identity Manager Virtual Appliance<=7.0.2
IBM Security Identity Manager Virtual Appliance<=7.0.1
Oracle JDK=1.7.0-update241
Oracle JDK=1.8.0-update231
Oracle JDK=11.0.5
Oracle JDK=13.0.1
Oracle JRE=1.7.0-update_241
Oracle JRE=1.8.0-update_231
Oracle JRE=11.0.5
Oracle JRE=13.0.1
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux Desktop=6.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=7.7
redhat Enterprise Linux Eus=8.1
redhat Enterprise Linux Server Aus=7.7
redhat Enterprise Linux Server Tus=7.7
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
Oracle OpenJDK=7
Oracle OpenJDK=7-update241
Oracle OpenJDK=7-update80
Oracle OpenJDK=7-update85
Oracle OpenJDK=8
Oracle OpenJDK=8-update102
Oracle OpenJDK=8-update112
Oracle OpenJDK=8-update152
Oracle OpenJDK=8-update162
Oracle OpenJDK=8-update172
Oracle OpenJDK=8-update192
Oracle OpenJDK=8-update20
Oracle OpenJDK=8-update202
Oracle OpenJDK=8-update212
Oracle OpenJDK=8-update222
Oracle OpenJDK=8-update232
Oracle OpenJDK=8-update40
Oracle OpenJDK=8-update60
Oracle OpenJDK=8-update66
Oracle OpenJDK=8-update72
Oracle OpenJDK=8-update92
Oracle OpenJDK=11
Oracle OpenJDK=11.0.1
Oracle OpenJDK=11.0.2
Oracle OpenJDK=11.0.3
Oracle OpenJDK=11.0.4
Oracle OpenJDK=11.0.5
Oracle OpenJDK=13
Oracle OpenJDK=13.0.1
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.10
NetApp Active Iq Unified Manager Windows>=7.3
NetApp Active Iq Unified Manager Vmware Vsphere>=9.5
NetApp E-series Performance Analyzer
NetApp E-series Santricity Management Plug-ins Vmware Vcenter
NetApp E-Series SANtricity OS Controller>=11.0.0<=11.60.1
NetApp E-series Santricity Storage Manager
NetApp E-series Santricity Web Services Proxy
NetApp OnCommand Insight
NetApp OnCommand Workflow Automation
NetApp Santricity Unified Manager
NetApp Steelstore Cloud Integrated Storage
McAfee ePolicy Orchestrator=5.9.0
McAfee ePolicy Orchestrator=5.9.1
McAfee ePolicy Orchestrator=5.10.0
McAfee ePolicy Orchestrator=5.10.0-update_1
McAfee ePolicy Orchestrator=5.10.0-update_2
McAfee ePolicy Orchestrator=5.10.0-update_3
McAfee ePolicy Orchestrator=5.10.0-update_4
McAfee ePolicy Orchestrator=5.10.0-update_5
McAfee ePolicy Orchestrator=5.10.0-update_6
openSUSE Leap=15.1
debian/openjdk-11
11.0.24+8-2~deb11u111.0.30+7-1~deb11u111.0.30+7-1
debian/openjdk-8
8u472-ga-1
Remediation
Patch Available
Event History
Jan 14, 2020
CVE Published
12:00 AM
Jan 15, 2020
Data Sourced
via Red Hat·09:06 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·04:34 PM
Data Sourced
via MITRE·04:34 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityAffected Software
Feb 23, 2026
Data Sourced
via Ubuntu·10:36 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·10:37 PM
DescriptionAffected Software
Data Sourced
via Launchpad·10:37 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-2654?
CVE-2020-2654 has been assigned a medium severity rating, as it can lead to excessive memory usage in affected Java applications.
2
How do I fix CVE-2020-2654?
To fix CVE-2020-2654, update your Java installations to the advised patched versions provided by Red Hat or Oracle.
3
Which Java versions are affected by CVE-2020-2654?
CVE-2020-2654 affects several versions of OpenJDK and IBM JDK, including 1.7, 1.8, and 11 across various distributions.
4
What kind of attacks can exploit CVE-2020-2654?
CVE-2020-2654 can be exploited by maliciously crafted X.509 certificates that lead to denial of service through memory exhaustion.
5
Is there a workaround for CVE-2020-2654?
There are no recommended workarounds for CVE-2020-2654; updating to a secure version is the advised preventive measure.