Security Fix(es) :

  - OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS     (Security, 8229951) (CVE-2020-2601)

  - OpenJDK: Serialization filter changes via     jdk.serialFilter property modification (Serialization,     8231422) (CVE-2020-2604)

  - OpenJDK: Improper checks of SASL message properties in     GssKrb5Base (Security, 8226352) (CVE-2020-2590)

  - OpenJDK: Incorrect isBuiltinStreamHandler causing URL     normalization issues (Networking, 8228548)     (CVE-2020-2593)

  - OpenJDK: Excessive memory usage in OID processing in     X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Incorrect exception processing during     deserialization in BeanContextSupport (Serialization,     8224909) (CVE-2020-2583)

  - OpenJDK: Incomplete enforcement of maxDatagramSockets     limit in DatagramChannelImpl (Networking, 8231795)     (CVE-2020-2659)

An update of the openjdk11 package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2241 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP10.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.6.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2020-Jan-15 advisory.

  - Serialization (CVE-2020-2583, CVE-2020-2604)

  - Security (CVE-2020-2590, CVE-2020-2601)

  - Networking (CVE-2020-2593, CVE-2020-2659)

  - Libraries (CVE-2020-2654)

  - JSSE (CVE-2020-2655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 251, 8 Update 241, 11 Update 6, or 13 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol.
    This issue affects the 'SQLite' component.(CVE-2019-16168)

  - Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read     uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
    (CVE-2019-13117, CVE-2019-13118)

  - Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
    (CVE-2020-2601, CVE-2020-2590)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated     remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization' component.
    (CVE-2020-2604, CVE-2020-2583)

  - Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated     remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
    (CVE-2020-2593, CVE-2020-2659)

  - Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit     this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)

  - Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit     this over 'HTTPS' protocols. This issue affects the 'JSSE' component. (CVE-2020-2655)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752246531 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client     and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14556)

  - Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are     affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2020-14562)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are     affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible     data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14573)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14577)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code     installed by an administrator). (CVE-2020-14583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is 7 prior to 7u241 / 8 prior to 8u232 / 11.0.0 prior to 11.0.5 / 13.0.0 prior to 13.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020-01-14 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. (CVE-2020-2604)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2583)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2590)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking).
    Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded:
    8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2593)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Java SE, Java SE Embedded. While the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. (CVE-2020-2601)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
133169	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20200121)	Nessus	Scientific Linux Local Security Checks	1/22/2020	2/24/2020	high
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	4/29/2020	8/22/2025	critical
136738	RHEL 8 : java-1.8.0-ibm (RHSA-2020:2241)	Nessus	Red Hat Local Security Checks	5/20/2020	11/7/2024	high
159409	Amazon Corretto Java 11.x < 11.0.6.10.1 Multiple Vulnerabilities	Nessus	Misc.	4/1/2022	11/3/2023	high
132992	Oracle Java SE 1.7.0_251 / 1.8.0_241 / 1.11.0_6 / 1.13.0_2 Multiple Vulnerabilities (Jan 2020 CPU)	Nessus	Windows	1/16/2020	12/20/2024	high
360784	AlmaLinux 9.2 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752246531)	Nessus	Alma Linux Local Security Checks	10/1/2026	10/2/2026	high
151210	OpenJDK 7 <= 7u241 / 8 <= 8u232 / 11.0.0 <= 11.0.5 / 13.0.0 <= 13.0.1 Multiple Vulnerabilities (2020-01-14)	Nessus	Misc.	7/6/2021	10/13/2026	high
134409	NewStart CGSL MAIN 4.05 : java-1.8.0-openjdk Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	3/11/2020	1/14/2021	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high