CVE-2020-2755: Medium severity oracle jdk 6 vulnerability
A flaw was found in the Nashorn JavaScript engine in the Scripting component of OpenJDK. The state machine of the regular expression Parser did not correctly handle empty string nodes in certain cases, which could cause an unexpected exception to be raised when processing a specially crafted regular expression.
Other sources
An unspecified vulnerability in Java SE related to the Java SE Scripting component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2755?
CVE-2020-2755 is considered a medium severity vulnerability due to the potential for unexpected exceptions during regex processing in the Nashorn JavaScript engine.
How do I fix CVE-2020-2755?
You can fix CVE-2020-2755 by updating to the patched versions: 1.8.0-openjdk-1:1.8.0.252.b09-2.el6_10 or newer for OpenJDK.
What software is affected by CVE-2020-2755?
CVE-2020-2755 affects various versions of OpenJDK and Oracle JDK including 1.8.0 and 11.0.x as well as IBM JDK.
What type of vulnerability is CVE-2020-2755?
CVE-2020-2755 is a flaw in the parsing of regular expressions in the Nashorn JavaScript engine.
Can CVE-2020-2755 lead to denial of service?
Yes, CVE-2020-2755 could lead to denial of service due to unexpected exceptions during the processing of specially crafted regular expressions.