Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JSSE). Supported versions that are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.4.11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2019-Jul-16 advisory.

  - Security (CVE-2019-2745, CVE-2019-2786, CVE-2019-2818)

  - Utilities (CVE-2019-2762, CVE-2019-2769)

  - Networking (CVE-2019-2766, CVE-2019-2816)

  - JSSE (CVE-2019-2821)

  - AWT (libpng) (CVE-2019-7317)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u221 / 8 <= 8u212 / 11.0.0 <= 11.0.3 / 12.0.0 <= 12.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 2019-07-16 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function     is called under png_safe_execute. (CVE-2019-7317)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JSSE). Supported versions that are     affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via TLS to compromise Java SE. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). (CVE-2019-2821)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2762, CVE-2019-2769)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that     are affected are Java SE: 7u221, 8u212 and 11.0.3. Difficult to exploit vulnerability allows     unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.1 (Confidentiality impacts). CVSS     Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). (CVE-2019-2745)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2019-2816)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that     is affected is Java SE: 8u212. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2019-2842)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security).
    Supported versions that are affected are Java SE: 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. CVSS 3.0 Base Score 3.4 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N). (CVE-2019-2786)

  - Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that     are affected are Java SE: 11.0.3 and 12.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE. Successful attacks require     human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java SE accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2818)

  - Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking).
    Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded:
    8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read     access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets     (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the     Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1     (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2019-2766)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1817 advisory.

  - OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

  - OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

  - OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

An update of the openjdk8 package has been released.

An update of the openjdk package has been released.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues :

Security issues fixed :

  - CVE-2019-2745: Improved ECC Implementation     (bsc#1141784).

  - CVE-2019-2762: Exceptional throw cases (bsc#1141782).

  - CVE-2019-2766: Improve file protocol handling     (bsc#1141789).

  - CVE-2019-2769: Better copies of CopiesList     (bsc#1141783).

  - CVE-2019-2786: More limited privilege usage     (bsc#1141787).

  - CVE-2019-7317: Improve PNG support options     (bsc#1141780).

  - CVE-2019-2818: Better Poly1305 support (bsc#1141788).

  - CVE-2019-2816: Normalize normalization (bsc#1141785).

  - CVE-2019-2821: Improve TLS negotiation (bsc#1141781).

  - Certificate validation improvements

Non-security issues fixed :

  - Do not fail installation when the manpages are not     present (bsc#1115375)

  - Backport upstream fix for JDK-8208602: Cannot read PEM     X.509 cert if there is whitespace after the header or     footer (bsc#1140461)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4083-1 advisory.

    It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing     suppressed exceptions in some situations. An attacker could use this to specially craft an object that,     when deserialized, would cause a denial of service. (CVE-2019-2762)

    It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated     during object deserialization. An attacker could use this to specially craft an object that, when     deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

    It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker     could use this to specially construct an untrusted Java application or applet that could escape sandbox     restrictions. (CVE-2019-2786)

    Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some     situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

    It was discovered that the ChaCha20Cipher implementation in OpenJDK did not use constant time computations     in some situations. An attacker could use this to expose sensitive information. (CVE-2019-2818)

    It was discovered that the Java Secure Socket Extension (JSSE) component in OpenJDK did not properly     handle OCSP stapling messages during TLS handshake in some situations. An attacker could use this to     expose sensitive information. (CVE-2019-2821)

    It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated     system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to     cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-7317)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk to version jdk-11.0.4+11 fixes the following issues :

Security issues fixed :

CVE-2019-2745: Improved ECC Implementation (bsc#1141784).

CVE-2019-2762: Exceptional throw cases (bsc#1141782).

CVE-2019-2766: Improve file protocol handling (bsc#1141789).

CVE-2019-2769: Better copies of CopiesList (bsc#1141783).

CVE-2019-2786: More limited privilege usage (bsc#1141787).

CVE-2019-7317: Improve PNG support options (bsc#1141780).

CVE-2019-2818: Better Poly1305 support (bsc#1141788).

CVE-2019-2816: Normalize normalization (bsc#1141785).

CVE-2019-2821: Improve TLS negotiation (bsc#1141781).

Certificate validation improvements

Non-security issues fixed: Do not fail installation when the manpages are not present (bsc#1115375)

Backport upstream fix for JDK-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or footer (bsc#1140461)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1817 advisory.

    [1:11.0.4.11-0]
    - Update to shenandoah-jdk-11.0.4+11 (GA)
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:11.0.4.10-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+10 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.9-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+9 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.8-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+8 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.7-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+7 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.1.ea]
    - Debug packages should be called 'slowdebug' on RHEL 8
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+6 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.5-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+5 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.4-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+4 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.3-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+3 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+2 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Package jspawnhelper (see JDK-8220360).
    - Resolves: rhbz#1724452

    [1:11.0.3.7-4]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-4]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-3]
    - Don't build the test images needlessly.
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

* OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

* OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

* OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

* OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678) (CVE-2019-2821)

* OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

* OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in information disclosure, denial of service or bypass of sandbox restrictions. In addition the implementation of elliptic curve cryptography was modernised.

OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432) (CVE-2019-2769)

libpng: png_image_free in png.c in libpng has a use-after-free because png_image_free_function is called under png_safe_execute.
(CVE-2019-7317)

OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328) (CVE-2019-2762)

OpenJDK: Insufficient permission checks for file:// URLs on Windows (Networking, 8213431) (CVE-2019-2766)

OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (

CVE-2019-2818)

OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698) (CVE-2019-2745)

OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678) (CVE-2019-2821)

Security Fix(es) :

  - OpenJDK: Side-channel attack risks in Elliptic Curve     (EC) cryptography (Security, 8208698) (CVE-2019-2745)

  - OpenJDK: Insufficient checks of suppressed exceptions in     deserialization (Utilities, 8212328) (CVE-2019-2762)

  - OpenJDK: Unbounded memory allocation during     deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

  - OpenJDK: Missing URL format validation (Networking,     8221518) (CVE-2019-2816)

  - OpenJDK: Incorrect handling of certificate status     messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

  - OpenJDK: Insufficient restriction of privileges in     AccessController (Security, 8216381) (CVE-2019-2786)

  - OpenJDK: Non-constant time comparison in ChaCha20Cipher     (Security, 8221344) (CVE-2019-2818)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1817 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)

    * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

    * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

    * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

    * OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

    * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

    * OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1810 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Side-channel attack risks in Elliptic Curve (EC) cryptography (Security, 8208698)     (CVE-2019-2745)

    * OpenJDK: Insufficient checks of suppressed exceptions in deserialization (Utilities, 8212328)     (CVE-2019-2762)

    * OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)     (CVE-2019-2769)

    * OpenJDK: Missing URL format validation (Networking, 8221518) (CVE-2019-2816)

    * OpenJDK: Incorrect handling of certificate status messages during TLS handshake (JSSE, 8222678)     (CVE-2019-2821)

    * OpenJDK: Insufficient restriction of privileges in AccessController (Security, 8216381) (CVE-2019-2786)

    * OpenJDK: Non-constant time comparison in ChaCha20Cipher (Security, 8221344) (CVE-2019-2818)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1810 advisory.

    [1:11.0.4.11-0.0.1]
    - link atomic for ix86 build

    [1:11.0.4.11-0]
    - Update to shenandoah-jdk-11.0.4+11 (GA)
    - Switch to GA mode for final release.
    - Resolves: rhbz#1724452

    [1:11.0.4.10-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+10 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.9-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+9 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.8-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+8 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.7-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+7 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Provide Javadoc debug subpackages for now, but populate them from the normal build.
    - Resolves: rhbz#1724452

    [1:11.0.4.6-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+6 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.5-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+5 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.4-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+4 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.3-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+3 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Use RHEL 7 format for jspawnhelper addition.
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.0.ea]
    - Update to shenandoah-jdk-11.0.4+2 (EA)
    - Resolves: rhbz#1724452

    [1:11.0.4.2-0.1.ea]
    - Package jspawnhelper (see JDK-8220360).
    - Resolves: rhbz#1724452

    [1:11.0.3.7-2]
    - Include 'ea' designator in Release when appropriate.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-2]
    - Handle milestone as variables so we can alter it easily and set the docs zip filename appropriately.
    - Resolves: rhbz#1724452

    [1:11.0.3.7-1]
    - Don't build the test images needlessly.
    - Don't produce javadoc/javadoc-zip sub packages for the debug variant build.
    - Don't perform a bootcycle build for the debug variant build.
    - Resolves: rhbz#1724452

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 7 Update 231, 8 Update 221, 11 Update 4, or 12 Update 2. It is, therefore, affected by multiple vulnerabilities:

  - Unspecified vulnerabilities in the utilities and JCE     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to cause a partial denial     of service. (CVE-2019-2762, CVE-2019-2769, CVE-2019-2842)

  - An unspecified vulnerability in the security subcomponent     of Oracle Java SE, which could allow an unauthenticated     local attacker to gain unauthorized access to critical Java     SE data. (CVE-2019-2745)

  - Unspecified vulnerabilities in the networking and security     subcomponents of Oracle Java SE, which could allow an     unauthenticated remote attacker to gain unauthorized     access to Java SE data. Exploitation of this vulnerability     requires user interaction.     (CVE-2019-2766, CVE-2019-2786, CVE-2019-2818)

  - An unspecified vulnerability in the networking subcomponent     of Oracle Java SE, which could allow an unauthenticated     remote attacker unauthorized read, update, insert or     delete access to Java SE data. (CVE-2019-2816)

  - An unspecified vulnerability in the JSSE subcomponent of     Oracle Java SE, which could allow an unauthenticated,     remote attacker to gain unauthorized access to critical     Java SE data. Exploitation of this vulnerability requires     user interaction. (CVE-2019-2821)

  - A use after free vulnerability exists in the libpng     subcomponent of Oracle Java SE. An unauthenticated,     remote attacker can exploit this to cause a complete     denial of service condition in Java SE. Exploitation     of this vulnerability requires user interaction.
    (CVE-2019-7317)

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
159436	Amazon Corretto Java 11.x < 11.0.4.11.1 Multiple Vulnerabilities	Nessus	Misc.	medium
151215	OpenJDK 7 <= 7u221 / 8 <= 8u212 / 11.0.0 <= 11.0.3 / 12.0.0 <= 12.0.1 Multiple Vulnerabilities (2019-07-16)	Nessus	Misc.	medium
145663	CentOS 8 : java-11-openjdk (CESA-2019:1817)	Nessus	CentOS Local Security Checks	medium
136333	Photon OS 2.0: Openjdk11 PHSA-2020-2.0-0235	Nessus	PhotonOS Local Security Checks	high
136109	Photon OS 1.0: Openjdk11 PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	critical
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	critical
130102	Photon OS 3.0: Openjdk8 PHSA-2019-3.0-0035	Nessus	PhotonOS Local Security Checks	medium
128736	Photon OS 2.0: Openjdk8 PHSA-2019-2.0-0173	Nessus	PhotonOS Local Security Checks	medium
128710	Photon OS 1.0: Openjdk PHSA-2019-1.0-0250	Nessus	PhotonOS Local Security Checks	medium
128008	openSUSE Security Update : java-11-openjdk (openSUSE-2019-1916)	Nessus	SuSE Local Security Checks	medium
127800	Ubuntu 18.04 LTS : OpenJDK 11 vulnerabilities (USN-4083-1)	Nessus	Ubuntu Local Security Checks	medium
127745	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2019:2002-1)	Nessus	SuSE Local Security Checks	medium
127602	Oracle Linux 8 : java-11-openjdk (ELSA-2019-1817)	Nessus	Oracle Linux Local Security Checks	medium
126989	CentOS 7 : java-11-openjdk (CESA-2019:1810)	Nessus	CentOS Local Security Checks	medium
126967	Debian DSA-4486-1 : openjdk-11 - security update	Nessus	Debian Local Security Checks	medium
126958	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2019-1246)	Nessus	Amazon Linux Local Security Checks	medium
126944	Scientific Linux Security Update : java-11-openjdk on SL7.x x86_64 (20190722)	Nessus	Scientific Linux Local Security Checks	medium
126943	RHEL 8 : java-11-openjdk (RHSA-2019:1817)	Nessus	Red Hat Local Security Checks	medium
126939	RHEL 7 : java-11-openjdk (RHSA-2019:1810)	Nessus	Red Hat Local Security Checks	medium
126936	Oracle Linux 7 : java-11-openjdk (ELSA-2019-1810)	Nessus	Oracle Linux Local Security Checks	medium
126821	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Windows	medium
126820	Oracle Java SE 1.7.0_231 / 1.8.0_221 / 1.11.0_4 / 1.12.0_2 Multiple Vulnerabilities (Jul 2019 CPU) (Unix)	Nessus	Misc.	medium

Detections

Analytics

CVE-2019-2821

medium

Tenable Plugins

medium

medium

medium

high

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium