{"id":"CVE-2020-2583","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","cvssScore":3.7,"cvssVersion":"3.1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvssMetrics":[{"version":"3.1","score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"},{"version":"3.0","score":3.7,"severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"secalert_us@oracle.com","type":"Secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","source":"nvd@nist.gov","sourceName":"NVD","type":"Primary"}],"cwes":["CWE-755"],"resolved":"MITIGATED-BY-RASP","published":"2020-01-15","lastModified":"2026-06-17","affectedProducts":[{"vendor":"oracle","product":"jdk","version":"1.7.0","update":"update241"},{"vendor":"oracle","product":"jdk","version":"1.8.0","update":"update231"},{"vendor":"oracle","product":"jdk","version":"11.0.5"},{"vendor":"oracle","product":"jdk","version":"13.0.1"},{"vendor":"oracle","product":"jre","version":"1.7.0","update":"update_241"},{"vendor":"oracle","product":"jre","version":"1.8.0","update":"update_231"},{"vendor":"oracle","product":"jre","version":"11.0.5"},{"vendor":"oracle","product":"jre","version":"13.0.1"},{"vendor":"redhat","product":"enterprise linux","version":"8.0"},{"vendor":"redhat","product":"enterprise linux desktop","version":"6.0"},{"vendor":"redhat","product":"enterprise linux desktop","version":"7.0"},{"vendor":"redhat","product":"enterprise linux eus","version":"7.7"},{"vendor":"redhat","product":"enterprise linux eus","version":"8.1"},{"vendor":"redhat","product":"enterprise linux server","version":"6.0"},{"vendor":"redhat","product":"enterprise linux server","version":"7.0"},{"vendor":"redhat","product":"enterprise linux server aus","version":"7.7"},{"vendor":"redhat","product":"enterprise linux server tus","version":"7.7"},{"vendor":"redhat","product":"enterprise linux workstation","version":"6.0"},{"vendor":"redhat","product":"enterprise linux workstation","version":"7.0"},{"vendor":"oracle","product":"openjdk","version":"7"}],"totalAffectedProducts":24,"references":[{"url":"https://access.redhat.com/errata/RHSA-2020:0122","source":"redhat","tags":["ADVISORY","RHSA-2020:0122"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-2583","source":"redhat","tags":["REPORT","RHSA-2020:0122"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0128","source":"redhat","tags":["ADVISORY","RHSA-2020:0128"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0157","source":"redhat","tags":["ADVISORY","RHSA-2020:0157"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0196","source":"redhat","tags":["ADVISORY","RHSA-2020:0196"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0202","source":"redhat","tags":["ADVISORY","RHSA-2020:0202"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0231","source":"redhat","tags":["ADVISORY","RHSA-2020:0231"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0232","source":"redhat","tags":["ADVISORY","RHSA-2020:0232"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0465","source":"redhat","tags":["ADVISORY","RHSA-2020:0465"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0469","source":"redhat","tags":["ADVISORY","RHSA-2020:0469"]}],"reasoning":{"decidingSource":"armr-patch-file","decidingReason":"CVE has an ARMR patch rule that provides mitigation","verdicts":[{"rule":"rejected","stage":"identity","outcome":"no-match"},{"rule":"armr-patch-file","stage":"scope","outcome":"matched","status":"MITIGATED-BY-RASP","detail":"ARMR patch file exists for this CVE","decisive":true}]},"relatedFiles":{"patchFiles":[{"path":"vcpu/2020/Q1-January/CVE-2020-2583/patch/2.6/CVE-2020-2583.armr","url":"https://github.com/waratek/java-patches/blob/develop/vcpu/2020/Q1-January/CVE-2020-2583/patch/2.6/CVE-2020-2583.armr","created":"2020-06-28T13:37:49Z","updated":"2026-03-04T16:48:46Z","content":"YXBwKCIyMDIwIEpBTlVBUlkgQ1BVIik6CiAgICByZXF1aXJlcyh2ZXJzaW9uOiAiQVJNUi8yLjYiKQoKICAgIC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioKICAgICAgICBDVkUtMjAyMC0yNTgzICgyMDIwIEpBTlVBUlkgQ1BVKQoKICAgICAgICBDVlNTIDMuMCBTdW1tYXJ5OgogICAgICAgICAgICBCYXNlIFNjb3JlICAgICAgICAgICAgICB8IDMuNyBMT1cKICAgICAgICAgICAgQXR0YWNrIFZlY3RvciAgICAgICAgICAgfCBOZXR3b3JrCiAgICAgICAgICAgIEF0dGFjayBDb21wbGV4aXR5ICAgICAgIHwgSGlnaAogICAgICAgICAgICBQcml2aWxlZ2VzIFJlcXVpcmVkICAgICB8IE5vbmUKICAgICAgICAgICAgVXNlciBJbnRlcmFjdGlvbiAgICAgICAgfCBOb25lCiAgICAgICAgICAgIFNjb3BlICAgICAgICAgICAgICAgICAgIHwgVW5jaGFuZ2VkCiAgICAgICAgICAgIENvbmZpZGVudGlhbGl0eSBJbXBhY3QgIHwgTm9uZQogICAgICAgICAgICBJbnRlZ3JpdHkgSW1wYWN0ICAgICAgICB8IE5vbmUKICAgICAgICAgICAgQXZhaWxhYmlsaXR5IEltcGFjdCAgICAgfCBMb3cKCiAgICAgICAgRGVzY3JpcHRpb246CiAgICAgICAgICAgIEEgZmxhdyB3YXMgZm91bmQgaW4gdGhlIHdoYXQgdGhlIEJlYW5Db250ZXh0U3VwcG9ydCBjbGFzcyBpbiB0aGUKICAgICAgICAgICAgU2VyaWFsaXphdGlvbiBjb21wb25lbnQgb2YgT3BlbkpESyBoYW5kbGVkIGV4Y2VwdGlvbnMgZHVyaW5nCiAgICAgICAgICAgIGRlc2VyaWFsaXphdGlvbi4gQSBzcGVjaWFsbHktY3JhZnRlZCBpbnB1dCBjb3VsZCBjYXVzZSBhIEphdmEKICAgICAgICAgICAgYXBwbGljYXRpb24gdG8gdXNlIGFuIGV4Y2Vzc2l2ZSBhbW91bnQgb2YgcmVzb3VyY2VzIHdoZW4KICAgICAgICAgICAgZGVzZXJpYWxpemVkLgoKICAgICAgICBSZXNvdXJjZXM6CiAgICAgICAgICAgIGh0dHBzOi8vYnVnemlsbGEucmVkaGF0LmNvbS9zaG93X2J1Zy5jZ2k/aWQ9Q1ZFLTIwMjAtMjU4MwogICAgICAgICAgICBodHRwOi8vaGcub3Blbmpkay5qYXZhLm5ldC9qZGs4dS9qZGs4dS9qZGsvcmV2L2I3NmUxMzQ4YzUzNQoKICAgICAgICBBZmZlY3RlZCBPcGVyYXRpbmcgU3lzdGVtOgogICAgICAgICAgICBBbnkKCiAgICAgICAgQWZmZWN0ZWQgVmVyc2lvbnM6CiAgICAgICAgICAgIDd1MjQxLCA4dTIzMSwgMTF1NSwgMTN1MQoKICAgICAgICBGaXhlZCBWZXJzaW9uOgogICAgICAgICAgICA3dTI1MSwgOHUyNDEsIDExdTYsIDEzdTIKCiAgICAgICAgVGVzdGVkIFZlcnNpb25zOgogICAgICAgICAgICA2dTAgLSA2dTIxMQogICAgICAgICAgICA3dTAgLSA3dTI0MQogICAgICAgICAgICA4dTAgLSA4dTIzMQoKICAgICAgICBQcm90ZWN0aW9uIFByb3ZpZGVkOgogICAgICAgICAgICBGdW5jdGlvbmFsCgogICAgICAgIFBhdGNoIFZlcnNpb246CiAgICAgICAgICAgIDEuMAogICAgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLwoKICAgIHBhdGNoKCJDVkUtMjAyMC0yNTgzIDowMSIpOgogICAgICAgIGZ1bmN0aW9uKCJqYXZhL2JlYW5zL2JlYW5jb250ZXh0L0JlYW5Db250ZXh0U3VwcG9ydC5yZWFkQ2hpbGRyZW4oTGphdmEvaW8vT2JqZWN0SW5wdXRTdHJlYW07KVYiLAogICAgICAgICAgICBjaGVja3N1bXM6IFsiZDM3NDRkYmMwMiJdKSAgLy8gNnUwIC0gNnUyMTEsIDd1MCAtIDd1MjQxLCA4dTAgLSA4dTIzMQogICAgICAgIGVudHJ5KCkKCiAgICAgICAgY29kZShsYW5ndWFnZTogamF2YSwgICBpbXBvcnQ6IFsiamF2YS5iZWFucy5Qcm9wZXJ0eUNoYW5nZUxpc3RlbmVyIiwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJqYXZhLmJlYW5zLlByb3BlcnR5VmV0b0V4Y2VwdGlvbiIsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiamF2YS5iZWFucy5WZXRvYWJsZUNoYW5nZUxpc3RlbmVyIiwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJqYXZhLmJlYW5zLmJlYW5jb250ZXh0LkJlYW5Db250ZXh0IiwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJqYXZhLmJlYW5zLmJlYW5jb250ZXh0LkJlYW5Db250ZXh0Q2hpbGQiLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImphdmEuYmVhbnMuYmVhbmNvbnRleHQuQmVhbkNvbnRleHRTdXBwb3J0IiwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJqYXZhLmlvLklPRXhjZXB0aW9uIiwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJqYXZhLmlvLk9iamVjdElucHV0U3RyZWFtIl0pOgogICAgICAgICAgICBwcml2YXRlIHN0YXRpYyBKYXZhRmllbGQgc2VyaWFsaXphYmxlRmllbGQ7CiAgICAgICAgICAgIHByaXZhdGUgc3RhdGljIEphdmFGaWVsZCBjaGlsZFBDTEZpZWxkOwogICAgICAgICAgICBwcml2YXRlIHN0YXRpYyBKYXZhRmllbGQgY2hpbGRWQ0xGaWVsZDsKICAgICAgICAgICAgcHJpdmF0ZSBzdGF0aWMgSmF2YU1ldGhvZCBjaGlsZERlc2VyaWFsaXplZEhvb2tNZXRob2Q7CiAgICAgICAgICAgIHByaXZhdGUgc3RhdGljIGJvb2xlYW4gc2hvdWxkSW5pdCA9IHRydWU7CgogICAgICAgICAgICBwdWJsaWMgdm9pZCBpbml0KCkgewogICAgICAgICAgICAgICAgc2VyaWFsaXphYmxlRmllbGQgPSBKYXZhRmllbGQubG9hZCgiamF2YS9iZWFucy9iZWFuY29udGV4dC9CZWFuQ29udGV4dFN1cHBvcnQuc2VyaWFsaXphYmxlIik7CiAgICAgICAgICAgICAgICBjaGlsZFBDTEZpZWxkID0gSmF2YUZpZWxkLmxvYWQoImphdmEvYmVhbnMvYmVhbmNvbnRleHQvQmVhbkNvbnRleHRTdXBwb3J0LmNoaWxkUENMIik7CiAgICAgICAgICAgICAgICBjaGlsZFZDTEZpZWxkID0gSmF2YUZpZWxkLmxvYWQoImphdmEvYmVhbnMvYmVhbmNvbnRleHQvQmVhbkNvbnRleHRTdXBwb3J0LmNoaWxkVkNMIik7CiAgICAgICAgICAgICAgICBjaGlsZERlc2VyaWFsaXplZEhvb2tNZXRob2QgPSBKYXZhTWV0aG9kLmxvYWQoImphdmEvYmVhbnMvYmVhbmNvbnRleHQvQmVhbkNvbnRleHRTdXBwb3J0LmNoaWxkRGVzZXJpYWxpemVkSG9vayhMamF2YS9sYW5nL09iamVjdDtMamF2YS9iZWFucy9iZWFuY29udGV4dC9CZWFuQ29udGV4dFN1cHBvcnQkQkNTQ2hpbGQ7KVYiKTsKICAgICAgICAgICAgICAgIHNob3VsZEluaXQgPSBmYWxzZTsKICAgICAgICAgICAgfQoKICAgICAgICAgICAgcHVibGljIHZvaWQgcGF0Y2goSmF2YUZyYW1lIGZyYW1lKSB7CiAgICAgICAgICAgICAgICBpZiAoc2hvdWxkSW5pdCkgewogICAgICAgICAgICAgICAgICAgIGluaXQoKTsKICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIEJlYW5Db250ZXh0U3VwcG9ydCBzZWxmID0gKEJlYW5Db250ZXh0U3VwcG9ydCkgZnJhbWUubG9hZFRoaXNWYXJpYWJsZSgpOwogICAgICAgICAgICAgICAgT2JqZWN0SW5wdXRTdHJlYW0gb2lzID0gKE9iamVjdElucHV0U3RyZWFtKSBmcmFtZS5sb2FkT2JqZWN0VmFyaWFibGUoMSk7CiAgICAgICAgICAgICAgICBpbnQgc2VyaWFsaXphYmxlID0gc2VyaWFsaXphYmxlRmllbGQucmVhZEludChzZWxmKTsKICAgICAgICAgICAgICAgIFByb3BlcnR5Q2hhbmdlTGlzdGVuZXIgY2hpbGRQQ0wgPSAoUHJvcGVydHlDaGFuZ2VMaXN0ZW5lcikgY2hpbGRQQ0xGaWVsZC5yZWFkT2JqZWN0KHNlbGYpOwogICAgICAgICAgICAgICAgVmV0b2FibGVDaGFuZ2VMaXN0ZW5lciBjaGlsZFZDTCA9IChWZXRvYWJsZUNoYW5nZUxpc3RlbmVyKSBjaGlsZFZDTEZpZWxkLnJlYWRPYmplY3Qoc2VsZik7CgogICAgICAgICAgICAgICAgdHJ5IHsKICAgICAgICAgICAgICAgICAgICByZWFkQ2hpbGRyZW4oc2VsZiwgb2lzLCBzZXJpYWxpemFibGUsIGNoaWxkUENMLCBjaGlsZFZDTCk7CiAgICAgICAgICAgICAgICB9IGNhdGNoIChJT0V4Y2VwdGlvbiBleCkgewogICAgICAgICAgICAgICAgICAgIGZyYW1lLnJhaXNlRXhjZXB0aW9uKGV4KTsKICAgICAgICAgICAgICAgIH0gY2F0Y2ggKENsYXNzTm90Rm91bmRFeGNlcHRpb24gZXgpIHsKICAgICAgICAgICAgICAgICAgICBmcmFtZS5yYWlzZUV4Y2VwdGlvbihleCk7CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICBmcmFtZS5yZXR1cm5Wb2lkKCk7CiAgICAgICAgICAgIH0KCiAgICAgICAgICAgIHByaXZhdGUgdm9pZCByZWFkQ2hpbGRyZW4oQmVhbkNvbnRleHRTdXBwb3J0IHNlbGYsIE9iamVjdElucHV0U3RyZWFtIG9pcywgaW50IHNlcmlhbGl6YWJsZSwKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQcm9wZXJ0eUNoYW5nZUxpc3RlbmVyIGNoaWxkUENMLCBWZXRvYWJsZUNoYW5nZUxpc3RlbmVyIGNoaWxkVkNMKQogICAgICAgICAgICAgICAgICAgIHRocm93cyBJT0V4Y2VwdGlvbiwgQ2xhc3NOb3RGb3VuZEV4Y2VwdGlvbiB7CgogICAgICAgICAgICAgICAgaW50IGNvdW50ID0gc2VyaWFsaXphYmxlOwogICAgICAgICAgICAgICAgd2hpbGUgKGNvdW50LS0gPiAwKSB7CiAgICAgICAgICAgICAgICAgICAgT2JqZWN0IGNoaWxkID0gb2lzLnJlYWRPYmplY3QoKTsKICAgICAgICAgICAgICAgICAgICBPYmplY3QgYnNjYyA9IG9pcy5yZWFkT2JqZWN0KCk7CgogICAgICAgICAgICAgICAgICAgIHN5bmNocm9uaXplZCAoY2hpbGQpIHsKICAgICAgICAgICAgICAgICAgICAgICAgQmVhbkNvbnRleHRDaGlsZCBiY2MgPSBudWxsOwogICAgICAgICAgICAgICAgICAgICAgICB0cnkgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgYmNjID0gKEJlYW5Db250ZXh0Q2hpbGQpIGNoaWxkOwogICAgICAgICAgICAgICAgICAgICAgICB9IGNhdGNoIChDbGFzc0Nhc3RFeGNlcHRpb24gY2NlKSB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBkbyBub3RoaW5nCiAgICAgICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICAgICAgICAgaWYgKGJjYyAhPSBudWxsKSB7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICB0cnkgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGJjYy5zZXRCZWFuQ29udGV4dChzZWxmLmdldEJlYW5Db250ZXh0UGVlcigpKTsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiY2MuYWRkUHJvcGVydHlDaGFuZ2VMaXN0ZW5lcigiYmVhbkNvbnRleHQiLCBjaGlsZFBDTCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmNjLmFkZFZldG9hYmxlQ2hhbmdlTGlzdGVuZXIoImJlYW5Db250ZXh0IiwgY2hpbGRWQ0wpOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgfSBjYXRjaCAoUHJvcGVydHlWZXRvRXhjZXB0aW9uIHB2ZSkgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbnRpbnVlOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgICAgIGNoaWxkRGVzZXJpYWxpemVkSG9va01ldGhvZC5jYWxsKHNlbGYsIGNoaWxkLCBic2NjKTsKICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0KICAgICAgICBlbmRjb2RlCiAgICBlbmRwYXRjaAoKZW5kYXBwCg=="}]},"oracleAdvisories":[{"advisory":"Oracle Critical Patch Update January 2020","releaseType":"CPU","quarter":"2020-Q1","url":"https://www.oracle.com/security-alerts/cpujan2020.html","products":[{"product":"Oracle Java SE","component":"Serialization","affectedVersions":"Java SE: 7u241, 8u231, 11.0.5, 13.0.1; Java SE Embedded: 8u231"}]}],"assessment":{"record":{"state":"active"},"protection":{"level":"full","mechanisms":["patch-rule"]},"action":{"state":"available","type":"patch-rule"},"review":{"state":"human","basis":"armr-file"}},"signals":{"hasPOC":false,"pocCount":0},"kev":{"inKEV":false},"epss":{"available":true,"score":0.0404,"percentile":0.9006},"ssvc":{"available":true,"exploitation":"none","automatable":"no","technicalImpact":"partial"},"lastActivity":"2026-03-04T16:48:46Z"}