CVE-2020-2830: canonical ubuntu_linux
CVSS: 5.3v3.0MediumModified
AliasesUBUNTU-CVE-2020-2830DEBIAN-CVE-2020-2830CGA-582c-cpg6-9fjfCGA-7wvv-7v5m-x29gCGA-gv7h-622v-jrf4CGA-ph7g-66jj-xxhpCGA-w683-g274-mp65CGA-x39h-pppj-4grhCGA-3gfw-3fw4-x4h5CGA-499j-22pw-5cwfCGA-56jc-mjhf-8xfvCGA-5r4m-h29j-4wmhCGA-8ff8-r765-969pCGA-92r4-48q7-pgjwCGA-9cv3-v68q-4pjjCGA-c2rq-2v5r-r6jhCGA-c8r5-fh5w-h85wCGA-cgjm-2vgg-pw3pCGA-cgw9-r6rx-9h85CGA-cqrh-c6jf-5v4pCGA-fcgv-p2vc-vjq4CGA-fx4v-6v56-9fr5CGA-g56q-jjfg-g4j2CGA-g9q3-g5hm-cr89CGA-hf45-cq9g-46p9CGA-hp7p-34rj-x67hCGA-j3hx-3m52-2mpqCGA-jfj8-79gc-3m7fCGA-jgwx-92h9-p72pCGA-jvg7-j6vx-2g5gCGA-p4r4-337w-2wjpCGA-pm2p-p677-h9hrCGA-pv55-95g8-365fCGA-pvg5-5mcp-p5c6CGA-qj9m-c6c4-mxp2CGA-rh8p-4gfw-3fmhCGA-vc3f-2gqw-5x29CGA-wpv7-j64h-fww6CGA-wr37-8x3x-hxphCGA-xprr-89mx-w9cr
Published 15-04-2020Last modified 27-09-2024
Vulnerability summary
CVE-2020-2830 is a medium (CVSS 5.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.95% chance of exploitation in the next 30 days, higher than 92% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.0 (CVE.org)EPSS score
4.95%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 36 · Related 23DLA-2193-1DSA-4662-1DSA-4668-1MGASA-2020-0182OPENSUSE-SU-2020:0757-1OPENSUSE-SU-2020:0800-1OPENSUSE-SU-2024:10871-1OPENSUSE-SU-2024:10872-1OPENSUSE-SU-2024:10876-1RHSA-2020:1506RHSA-2020:1507RHSA-2020:1508RHSA-2020:1509RHSA-2020:1512RHSA-2020:1514RHSA-2020:1515RHSA-2020:1516RHSA-2020:1517RHSA-2020:2236RHSA-2020:2237RHSA-2020:2238RHSA-2020:2239RHSA-2020:2241SUSE-SU-2020:14391-1SUSE-SU-2020:14398-1SUSE-SU-2020:1511-1SUSE-SU-2020:1511-2SUSE-SU-2020:1569-1SUSE-SU-2020:1569-2SUSE-SU-2020:1571-1SUSE-SU-2020:1572-1SUSE-SU-2020:1683-1SUSE-SU-2020:1684-1SUSE-SU-2020:1685-1SUSE-SU-2020:1686-1USN-4337-1CGA-523P-FJ67-FRF8CGA-GV2J-C4G6-H4MXCGA-P8RW-677V-JP85CGA-XC3V-42VV-WJ6QCGA-XP73-HHJQ-V7FG
Timeline
- 15-04-2020PublishedVulnerability first disclosed.
- 27-09-2024Last modifiedVulnerability information updated.
Description
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVSS metrics
9 scores · 6 sources · 3 versionsMedium 5.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 5 agree
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Medium 5.3Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.95%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.95% on 18-09-2026
18-09-202618-10-2026
EPSS score4.95%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard19 products
- openjdk-10All versions (No fix recorded)
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-13-jre-baseAll versions (No fix recorded)
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
Netapp13 products
- 7-mode_transition_toolna
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- cloud_backupna
- e-series_performance_analyzerna
- e-series_santricity_os_controller≥ 11.0.0, ≤ 11.60.1
Oracle3 products
- jdkEOL1.7.0:update251 | 1.8.0:update241 | 11.0.6 | 14.0.0
- jreEOL1.7.0:update_251 | 1.8.0:update_241 | 11.0.6 | 14.0.0
- openjdkEOL≥ 11, ≤ 11.0.6 | ≥ 13, ≤ 13.0.2 | 7 | 7:update1 | 7:update10 | 7:update101 | 7:update11 | 7:update111 | 7:update121 | 7:update13 | 7:update131 | 7:update141 | 7:update15 | 7:update151 | 7:update161 | 7:update17 | 7:update171 | 7:update181 | 7:update191 | 7:update2 | 7:update201 | 7:update21 | 7:update211 | 7:update221 | 7:update231 | 7:update241 | 7:update25 | 7:update251 | 7:update3 | 7:update4 | 7:update40 | 7:update45 | 7:update5 | 7:update51 | 7:update55 | 7:update6 | 7:update60 | 7:update65 | 7:update67 | 7:update7 | 7:update72 | 7:update76 | 7:update80 | 7:update85 | 7:update9 | 7:update91 | 7:update95 | 7:update97 | 7:update99 | 8 | 8:update101 | 8:update102 | 8:update11 | 8:update111 | 8:update112 | 8:update121 | 8:update131 | 8:update141 | 8:update151 | 8:update152 | 8:update161 | 8:update162 | 8:update171 | 8:update172 | 8:update181 | 8:update191 | 8:update192 | 8:update20 | 8:update201 | 8:update202 | 8:update211 | 8:update212 | 8:update221 | 8:update231 | 8:update241 | 8:update25 | 8:update31 | 8:update40 | 8:update45 | 8:update5 | 8:update51 | 8:update60 | 8:update65 | 8:update66 | 8:update71 | 8:update72 | 8:update73 | 8:update74 | 8:update77 | 8:update91 | 8:update92 | 14
Wolfi3 products
- openjdk-10All versions (No fix recorded)
- openjdk-13-jre-baseAll versions (No fix recorded)
- openjdk-9-jreAll versions (No fix recorded)
Debian2 products
- openjdk-11< 11.0.7+10-1
- debian_linuxEOL8.0 | 10.0
Ubuntu2 products
- openjdk-8< 8u252-b09-1~16.04 | < 8u252-b09-1~18.04
- openjdk-lts< 11.0.7+10-2ubuntu2~18.04 | < 11.0.7+10-2ubuntu1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.10
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
Mcafee1 product
- threat_intelligence_exchange_server≥ 2.0.0, < 2.3.1 | 2.3.1 | 2.3.1:hotfix1 | 2.3.1:hotfix2 | 3.0.0
Opensuse1 product
- leapEOL15.1 | 15.2
Oracle corporation1 product
- javaJava SE: 7u251, 8u241, 11.0.6, 14 | Java SE Embedded: 8u241
11 vendors · 47 products
References
17 links
- lists.debian.org/debian-lts-announce/2020/04/msg00024.htmlMailing ListX Refsource MLISTAdvisoryThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.htmlVendor AdvisoryX Refsource SUSEAdvisoryThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.htmlVendor AdvisoryX Refsource SUSEAdvisoryThird Party Advisory
Show all 17 references
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.htmlVendor AdvisoryX Refsource SUSEAdvisoryThird Party Advisory
- kc.mcafee.com/corporate/index?page=content&id=SB10318X Refsource CONFIRMFIXPatchThird Party Advisory