CVE-2020-14562: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2020-14562 is a vulnerability discovered in Java SE's ImageIO TIFF plugin component that affects multiple versions including Java SE (JDK and JRE) versions through 7u261, 8u251, 11.0.7, 14.0.1 and Java SE Embedded version 8u251. The vulnerability was disclosed in July 2020 and patched in the July 2020 Critical Patch Update (Oracle CPU, Red Hat Advisory).

The vulnerability stems from incorrect handling of memory allocation when reading TIFF image files in Java's ImageIO component. The vulnerability has a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NetApp Advisory).

Successful exploitation of this vulnerability could allow an unauthenticated attacker to cause excessive memory consumption leading to a denial of service condition when processing TIFF images (Ubuntu Notice).

The vulnerability is easily exploitable by an unauthenticated attacker with network access via multiple protocols. The attack requires no user interaction to exploit (NVD).

The vulnerability has been fixed in Java SE versions 7u261, 8u251, 11.0.8, and 14.0.1. Users are strongly recommended to upgrade to these or later versions. For systems that cannot be immediately upgraded, no workaround is available other than restricting network access to trusted sources (Red Hat Advisory).