^{CVE-2020-2604:}Deserialization vulnerability in Java SE, Java SE Embedded allowing remote code execution.

Overview

This vulnerability affects multiple versions of Java SE and Java SE Embedded, specifically:

• Java SE: 7u241, 8u231, 11.0.5, and 13.0.1
• Java SE Embedded: 8u231

The vulnerability exists in the Serialization component of Java SE. While it is considered difficult to exploit, successful attacks can lead to complete takeover of the affected Java environment. The vulnerability has a CVSS v3.0 Base Score of 8.1, indicating high impact on confidentiality, integrity, and availability.

The vulnerability is particularly concerning for environments where Java applications process untrusted serialized data, especially in client-side contexts where Java Web Start applications or applets are used. Server-side applications that deserialize untrusted data from network sources are also at risk.

Remediation

To address this vulnerability, the following actions are recommended:

1. Update to the latest Java SE versions:

   • Update Java SE 7 to version later than 7u241
   • Update Java SE 8 to version later than 8u231
   • Update Java SE 11 to version later than 11.0.5
   • Update Java SE 13 to version later than 13.0.1
   • Update Java SE Embedded 8 to version later than 8u231

2. If immediate patching is not possible, consider these mitigations:

   • Restrict network access to Java applications that process serialized data
   • Implement input validation for all serialized data
   • Consider using serialization filters to restrict which classes can be deserialized
   • Disable Java Web Start and Java applets if not needed in your environment

3. Review applications that use Java serialization and consider alternatives like JSON or XML for data exchange where possible.

References

• Oracle Security Advisory: https://www.oracle.com/security-alerts/cpujan2020.html
• Oracle Critical Patch Update: https://www.oracle.com/security-alerts/cpujul2021.html
• Red Hat Security Advisories:
  • https://access.redhat.com/errata/RHSA-2020:0122
  • https://access.redhat.com/errata/RHSA-2020:0128
• Debian Security Advisory: https://www.debian.org/security/2020/dsa-4621
• Ubuntu Security Notice: https://usn.ubuntu.com/4257-1/
• NetApp Security Advisory: https://security.netapp.com/advisory/ntap-20200122-0003/
• openSUSE Security Announcements:
  • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html
  • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html
• McAfee Security Bulletin: https://kc.mcafee.com/corporate/index?page=content&id=SB10315