CVE-2020-2800: CRLF Injection
A CRLF injection flaw was found in the Lightweight HTTP Server component of OpenJDK. The HttpServer implementation did not restrict the use of CR and LF characters in values for HTTP headers, possibly allowing HTTP response splitting attacks.
Other sources
An unspecified vulnerability in Java SE related to the Java SE Lightweight HTTP Server component could allow an unauthenticated attacker to cause low confidentiality impact, low integrity impact, and no availability impact.
— IBM
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2800?
The CVE-2020-2800 vulnerability has a severity rating of medium.
How do I fix CVE-2020-2800?
To fix CVE-2020-2800, update to the latest versions of OpenJDK as recommended in the security advisories.
What is the impact of CVE-2020-2800?
CVE-2020-2800 can lead to HTTP response splitting attacks due to CRLF injection in HTTP header values.
Which versions of OpenJDK are affected by CVE-2020-2800?
OpenJDK versions prior to the patched releases listed in the advisories are affected by CVE-2020-2800.
Is CVE-2020-2800 exploitable remotely?
Yes, CVE-2020-2800 can be exploited remotely under certain conditions that involve manipulating HTTP headers.