Bug 1790944 (CVE-2020-2604) - CVE-2020-2604 OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422)
Summary: CVE-2020-2604 OpenJDK: Serialization filter changes via jdk.serialFilter prop...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-2604
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1785757 1785758 1785759 1785760 1785761 1785762 1785763 1785764 1785765 1785766 1785767 1789444 1789445 1789446 1796801 1796802 1796803 1796804 1796805 1796806 1796807 1796808 1799108 1803860 1803861
Blocks: 1785754
TreeView+ depends on / blocked
 
Reported: 2020-01-14 15:09 UTC by Tomas Hoger
Modified: 2020-03-17 13:11 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: No Doc Update
Doc Text:
A flaw was found in the serialization component of OpenJDK handled serialization filter. A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.
Clone Of:
Environment:
Last Closed: 2020-02-27 15:49:47 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:0212 None None None 2020-01-23 14:05:00 UTC
Red Hat Product Errata RHBA-2020:0213 None None None 2020-01-23 14:46:56 UTC
Red Hat Product Errata RHBA-2020:0220 None None None 2020-01-23 17:00:31 UTC
Red Hat Product Errata RHBA-2020:0225 None None None 2020-01-27 01:22:06 UTC
Red Hat Product Errata RHBA-2020:0226 None None None 2020-01-27 01:22:50 UTC
Red Hat Product Errata RHBA-2020:0237 None None None 2020-01-27 12:18:49 UTC
Red Hat Product Errata RHBA-2020:0238 None None None 2020-01-27 12:25:20 UTC
Red Hat Product Errata RHBA-2020:0239 None None None 2020-01-27 12:26:30 UTC
Red Hat Product Errata RHBA-2020:0240 None None None 2020-01-27 12:26:41 UTC
Red Hat Product Errata RHBA-2020:0241 None None None 2020-01-27 12:29:19 UTC
Red Hat Product Errata RHBA-2020:0242 None None None 2020-01-27 12:26:47 UTC
Red Hat Product Errata RHBA-2020:0311 None None None 2020-01-30 20:06:37 UTC
Red Hat Product Errata RHBA-2020:0318 None None None 2020-02-03 10:27:51 UTC
Red Hat Product Errata RHBA-2020:0489 None None None 2020-02-13 15:00:56 UTC
Red Hat Product Errata RHBA-2020:0558 None None None 2020-02-20 08:31:08 UTC
Red Hat Product Errata RHBA-2020:0639 None None None 2020-02-27 19:29:59 UTC
Red Hat Product Errata RHSA-2020:0122 None None None 2020-01-16 13:21:41 UTC
Red Hat Product Errata RHSA-2020:0128 None None None 2020-01-16 13:02:42 UTC
Red Hat Product Errata RHSA-2020:0157 None None None 2020-01-21 03:02:07 UTC
Red Hat Product Errata RHSA-2020:0196 None None None 2020-01-21 23:00:54 UTC
Red Hat Product Errata RHSA-2020:0202 None None None 2020-01-22 13:04:52 UTC
Red Hat Product Errata RHSA-2020:0231 None None None 2020-01-27 08:54:39 UTC
Red Hat Product Errata RHSA-2020:0232 None None None 2020-01-27 08:55:53 UTC
Red Hat Product Errata RHSA-2020:0465 None None None 2020-02-11 03:56:50 UTC
Red Hat Product Errata RHSA-2020:0467 None None None 2020-02-11 08:28:36 UTC
Red Hat Product Errata RHSA-2020:0468 None None None 2020-02-11 08:32:26 UTC
Red Hat Product Errata RHSA-2020:0469 None None None 2020-02-11 08:30:38 UTC
Red Hat Product Errata RHSA-2020:0470 None None None 2020-02-11 08:33:56 UTC
Red Hat Product Errata RHSA-2020:0541 None None None 2020-02-18 15:28:46 UTC
Red Hat Product Errata RHSA-2020:0632 None None None 2020-02-27 15:27:08 UTC
Red Hat Product Errata RHSA-2020:0856 None None None 2020-03-17 13:11:10 UTC

Description Tomas Hoger 2020-01-14 15:09:09 UTC
A flaw was found in the Serialization component of OpenJDK handled serialization filter.  A process-wide filter could have been modified by setting jdk.serialFilter system property at runtime, possibly leading to a bypass of the intended filter during deserialization.

Comment 1 Tomas Hoger 2020-01-15 09:53:45 UTC
This change is documented in the release notes for Oracle Java SE 13.0.2, 11.0.6, 8u241, and 7u251 as:

"""
core-libs/java.io:serialization
➜ Better Serial Filter Handling

The jdk.serialFilter system property can only be set on the command line. If the filter has not been set on the command line, it can be set can be set with java.io.ObjectInputFilter.Config.setSerialFilter. Setting the jdk.serialFilter with java.lang.System.setProperty has no effect.
"""

https://www.oracle.com/technetwork/java/javase/13-0-2-relnotes-5812268.html
https://www.oracle.com/technetwork/java/javase/11-0-6-oracle-relnotes-5813175.html
https://www.oracle.com/technetwork/java/javase/8u241-relnotes-5813177.html
https://www.oracle.com/technetwork/java/javaseproducts/documentation/javase7supportreleasenotes-1601161.html#R170_251

Comment 2 Tomas Hoger 2020-01-15 11:11:11 UTC
Public now via Oracle CPU January 2020:

https://www.oracle.com/security-alerts/cpujan2020.html#AppendixJAVA

Fixed in Oracle Java SE 13.0.2, 11.0.6, 8u241, and 7u251.

Comment 3 errata-xmlrpc 2020-01-16 13:02:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0128 https://access.redhat.com/errata/RHSA-2020:0128

Comment 4 errata-xmlrpc 2020-01-16 13:21:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0122 https://access.redhat.com/errata/RHSA-2020:0122

Comment 5 errata-xmlrpc 2020-01-21 03:02:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0157 https://access.redhat.com/errata/RHSA-2020:0157

Comment 6 errata-xmlrpc 2020-01-21 23:00:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0196 https://access.redhat.com/errata/RHSA-2020:0196

Comment 7 errata-xmlrpc 2020-01-22 13:04:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0202 https://access.redhat.com/errata/RHSA-2020:0202

Comment 8 errata-xmlrpc 2020-01-27 08:54:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0231 https://access.redhat.com/errata/RHSA-2020:0231

Comment 9 errata-xmlrpc 2020-01-27 08:55:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0232 https://access.redhat.com/errata/RHSA-2020:0232

Comment 14 errata-xmlrpc 2020-02-11 03:56:47 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0465 https://access.redhat.com/errata/RHSA-2020:0465

Comment 15 errata-xmlrpc 2020-02-11 08:28:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2020:0467 https://access.redhat.com/errata/RHSA-2020:0467

Comment 16 errata-xmlrpc 2020-02-11 08:30:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6 Supplementary

Via RHSA-2020:0469 https://access.redhat.com/errata/RHSA-2020:0469

Comment 17 errata-xmlrpc 2020-02-11 08:32:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2020:0468 https://access.redhat.com/errata/RHSA-2020:0468

Comment 18 errata-xmlrpc 2020-02-11 08:33:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Supplementary

Via RHSA-2020:0470 https://access.redhat.com/errata/RHSA-2020:0470

Comment 19 errata-xmlrpc 2020-02-18 15:28:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0541 https://access.redhat.com/errata/RHSA-2020:0541

Comment 21 errata-xmlrpc 2020-02-27 15:27:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0632 https://access.redhat.com/errata/RHSA-2020:0632

Comment 22 Product Security DevOps Team 2020-02-27 15:49:47 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-2604

Comment 26 errata-xmlrpc 2020-03-17 13:11:08 UTC
This issue has been addressed in the following products:

  Red Hat Satellite 5.8

Via RHSA-2020:0856 https://access.redhat.com/errata/RHSA-2020:0856


Note You need to log in before you can comment on or make changes to this bug.