CVE-2020-2655

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-2655 has a selected CVSS score of 4.8 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 11.0.5 and 13.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 30, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Java

Browse Oracle Corporation / Java
CVE ListJava SE: 11.0.5, 13.0.1affected

Proofs of concept

1

Repository PoCs

GitHubRUB-NDS/CVE-2020-2655-DemoServerRepository PoCby RUB-NDS4Not analyzed20 files

88.1 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

Repository root

RUB-NDS/CVE-2020-2655-DemoServerCreated Vuln labCVE-2020-2655Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile builds a Java server from a pre-built JAR and a Java KeyStore, exposing ports 4433 and 4434/udp. The repository name and README associate it with CVE-2020-2655, suggesting a demonstration or proof-of-concept server for that vulnerability.

Dockerfile:1-7README.md:1

Lab assessment

Vulnerability lab

The repository is named 'CVE-2020-2655-DemoServer', the README states '# CVE-2020-2655-DemoServer', and the Dockerfile builds a 'cve-2020-2655poc' stage. The artifact ID in pom.xml is 'CVE-2020-2655-PoC-Server'. These explicit references to a CVE and 'Demo'/'PoC' indicate a vulnerability research or demonstration environment.

README.md:1Dockerfile:1pom.xml:5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

openjdk base image

Java runtime

Provides the Java runtime environment for the PoC server. The image is pinned by digest.

Dockerfile:1

PoC-Server.jar

Vulnerability demonstration server

A pre-built executable JAR that is the entrypoint of the container. It is a binary file and its behavior is uninspected. The pom.xml indicates the main class is de.rub.nds.tls.server.Main.

Dockerfile:2Dockerfile:6pom.xml:33

server.jks

TLS key material

A Java KeyStore file added to the container root. It is a binary file and its contents are uninspected. Likely provides the server certificate and private key for the TLS/DTLS server.

Dockerfile:3

target/ directory contents

Compiled classes and metadata

The entire target/ directory from the build context is copied into the container. It includes compiled .class files (e.g., DtlsServer.class, Main.class) and Maven metadata. The classes implement a DTLS server and a main entry point.

Dockerfile:2target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst:1-4
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2020-2655

Insufficient evidence

The packet associates the environment with CVE-2020-2655 through repository name, README, Dockerfile stage name, and artifact ID. However, no CVE description, vulnerable library version, or exploit code is visible in the supplied text. The server JAR and key store are binary and uninspected. The evidence is limited to naming conventions, which is insufficient to confirm or refute the CVE association.

README.md:1Dockerfile:1pom.xml:5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build the image from the Dockerfile.Dockerfile:1-7
  • The pre-built target/PoC-Server.jar and server.jks must be present in the build context.Dockerfile:2-3
  • A client capable of connecting to the exposed ports (4433/TCP, 4434/UDP) is needed to interact with the server.Dockerfile:4-5

Evidence-described exercise path

  1. Build the Docker image using the provided Dockerfile.Dockerfile:1-7
  2. Run a container from the image, ensuring ports 4433 and 4434/udp are published.Dockerfile:4-5
  3. Connect a client to the server on the exposed ports to trigger or observe the vulnerability behavior.Dockerfile:4-5
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The Dockerfile only builds a container, copies local files, exposes ports, and runs a Java JAR. No commands download external resources, modify the host, or establish persistence. However, the JAR and key store are binary and uninspected; their runtime behavior is unknown. Without inspecting the binaries, it is impossible to determine whether the server performs any harmful actions beyond the intended lab target.

Dockerfile:1-7
Review boundaries

What the analysis did not establish

  • The packet contains 6 binary files (PoC-Server.jar, server.jks, and compiled .class files) that are uninspected. Their runtime behavior cannot be assessed.
  • No CVE description, exploit code, or vulnerable dependency version is present in the text evidence. The CVE association relies solely on naming conventions.
  • The Dockerfile does not include a CMD or ENTRYPOINT that reveals arguments; the server's exact network behavior is unknown.
  • No client or test script is provided to demonstrate the exercise path.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 6 binary files not inspected

References

10