It was discovered that the implementation of the Proxy class in the Serialization component of OpenJDK could trigger an out-of-memory condition when deserializing Proxy class objects with many interfaces. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized. The patch for this issue adds a new system property jdk.serialProxyInterfaceLimit that can be used to reduce the limit for Proxy interfaces from the default of 65535 and hence better protect against excessive memory usage.
Public now via Oracle CPU October 2020: https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixJAVA Fixed in Oracle Java SE 15.0.1, 11.0.9, 8u271, and 7u281.
Related note in the Oracle Java SE release notes: core-libs/java.io:serialization ➜ Enhanced Support of Proxy Class The deserialization of java.lang.reflect.Proxy objects can be limited by setting the system property jdk.serialProxyInterfaceLimit. The limit is the maximum number of interfaces allowed per Proxy in the stream. Setting the limit to zero prevents any Proxies from being deserialized including Annotations, a limit of less than 2 might interfere with RMI operations. JDK-8236862 (not public) https://www.oracle.com/java/technologies/javase/15-0-1-relnotes.html https://www.oracle.com/java/technologies/javase/11-0-9-relnotes.html https://www.oracle.com/java/technologies/javase/8u271-relnotes.html https://www.oracle.com/java/technologies/javase/7-support-relnotes.html#R170_281
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:4306 https://access.redhat.com/errata/RHSA-2020:4306
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4305 https://access.redhat.com/errata/RHSA-2020:4305
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-14779
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4307 https://access.redhat.com/errata/RHSA-2020:4307
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:4316 https://access.redhat.com/errata/RHSA-2020:4316
OpenJDK-11 upstream commit: http://hg.openjdk.java.net/jdk-updates/jdk11u/rev/2a2df11c0684 OpenJDK-8 upstream commit: http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/0da7153533e6
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions Via RHSA-2020:4349 https://access.redhat.com/errata/RHSA-2020:4349
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4347 https://access.redhat.com/errata/RHSA-2020:4347
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:4352 https://access.redhat.com/errata/RHSA-2020:4352
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2020:4348 https://access.redhat.com/errata/RHSA-2020:4348
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4350 https://access.redhat.com/errata/RHSA-2020:4350
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2020:5586 https://access.redhat.com/errata/RHSA-2020:5586
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Supplementary Via RHSA-2020:5585 https://access.redhat.com/errata/RHSA-2020:5585
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:0530 https://access.redhat.com/errata/RHSA-2021:0530