# CVE-2020-2803: java-1.8.0-openjdk: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Develo...

CVE-2020-2803 is fixed in 38 products on 1 platform, first by openjdk-11-demo 11.0.7+10-2ubuntu2~18.04, released April 15, 2020. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2020-2803
- Priority: High
- CVSS: 8.3 (Important)
- EPSS: 0.0623
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 15, 2020

## Description

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.  Security Fix(es):  * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)  * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)  * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773)  * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)  * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800)  * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)  * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898) (CVE-2020-2754)  * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904) (CVE-2020-2755)  * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization (Serialization, 8224541) (CVE-2020-2756)  * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549) (CVE-2020-2757)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | java-1.8.0-ibm RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-demo RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-devel RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-headless RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-jdbc RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-plugin RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-src RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-ibm-webstart RHEL 8 | 1:1.8.0.6.10-1.el8_2 | [RHSA-2020:2241](https://patchblox.com/security/data/fix/linux/rhsa-2020-2241.md) | May 20, 2020 |
| Linux | java-1.8.0-openjdk RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-accessibility RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-accessibility ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-demo RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-demo ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-devel RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-devel ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-headless RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-headless ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-javadoc RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-javadoc ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-javadoc-zip RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-javadoc-zip ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-src RHEL 8 | 1:1.8.0.252.b09-2.el8_1 | [RHSA-2020:1515](https://patchblox.com/security/data/fix/linux/rhsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-1.8.0-openjdk-src ol 8 | 1:1.8.0.252.b09-2.el8_1 | [ELSA-2020-1515](https://patchblox.com/security/data/fix/linux/elsa-2020-1515.md) | Apr 22, 2020 |
| Linux | java-11-openjdk RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-demo RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-demo ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-devel RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-devel ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-headless RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-headless ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-javadoc RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-javadoc ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-javadoc-zip RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-javadoc-zip ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-jmods RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-jmods ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-src RHEL 8 | 1:11.0.7.10-1.el8_1 | [RHSA-2020:1514](https://patchblox.com/security/data/fix/linux/rhsa-2020-1514.md) | Apr 21, 2020 |
| Linux | java-11-openjdk-src ol 8 | 1:11.0.7.10-1.el8_1 | [ELSA-2020-1514](https://patchblox.com/security/data/fix/linux/elsa-2020-1514.md) | Apr 21, 2020 |
| Linux | openjdk-11-demo Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-demo 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-demo-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-demo Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-demo 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-demo-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-jdk Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-jdk 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jdk-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-jdk Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-jdk 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jdk-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-jdk-headless Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-jdk-headless 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jdk-headless-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-jdk-headless Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-jdk-headless 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jdk-headless-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-jre 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-jre 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre-headless Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-jre-headless 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-headless-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre-headless Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-jre-headless 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-headless-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre-zero Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-jre-zero 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-jre-zero-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-jre-zero Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-jre-zero 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-jre-zero-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-11-source Ubuntu 18.04.6 LTS (bionic) | 11.0.7+10-2ubuntu2~18.04 | [openjdk-11-source 11.0.7+10-2ubuntu2~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-11-source-11.0.7-10-2ubuntu2-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-11-source Ubuntu 20.04 LTS (focal) | 11.0.7+10-2ubuntu1 | [openjdk-11-source 11.0.7+10-2ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openjdk-11-source-11.0.7-10-2ubuntu1.md) | Apr 15, 2020 |
| Linux | openjdk-8-demo Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-demo 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-demo-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-jdk Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-jdk 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jdk-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-jdk-headless Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-jdk-headless 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jdk-headless-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-jre Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-jre 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-jre-headless Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-jre-headless 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-headless-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-jre-zero Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-jre-zero 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-jre-zero-8u252-b09-1-18.04.md) | Apr 15, 2020 |
| Linux | openjdk-8-source Ubuntu 18.04.6 LTS (bionic) | 8u252-b09-1~18.04 | [openjdk-8-source 8u252-b09-1~18.04](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openjdk-8-source-8u252-b09-1-18.04.md) | Apr 15, 2020 |

---

Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.