A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0

The 19c and 21c versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning (Numpy) component of Oracle Database Server. The     supported version that is affected is 21c. Easily exploitable vulnerability allows low privileged attacker     having Create Session privilege with network access via Oracle Net to compromise Oracle Database - Machine     Learning (Numpy). (CVE-2021-41495)  

  - Vulnerability in the Spatial and Graph (jackson-databind) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker     having Authenticated User privilege with network access via HTTP to compromise Spatial and     Graph (jackson-databind). Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Spatial and Graph (jackson-databind).
    (CVE-2020-36518)

  - Vulnerability in the Oracle Notification Server (PCRE2) component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Subscriber privilege with network access via HTTP to compromise Oracle Notification     Server (PCRE2). Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Oracle Notification Server (PCRE2).
    Note: This vulnerability applies to Windows systems only. (CVE-2022-1587)

  - Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported     version that is affected is 19c. Easily exploitable vulnerability allows high privileged attacker having     DBA user privilege with network access via Oracle Net to compromise Oracle Database - Advanced Queuing.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Advanced Queuing.
    (CVE-2022-21596)

  - Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions     that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged attacker having     Local Logon privilege with network access via Local Logon to compromise Oracle Database - Sharding.
    Successful attacks of this vulnerability can result in takeover of Oracle Database - Sharding.
    (CVE-2022-21603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4676 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

    * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

    * mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)

    * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4677 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.2 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.1, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.2 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: potential security issue in flow control over HTTP/2 may lead to DOS (CVE-2021-3629)

    * wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users     (CVE-2021-3717)

    * mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)

    * jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)

    * resteasy: Error message exposes endpoint class information (CVE-2021-20289)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle NoSQL Database Enterprise running on the remote host is prior to 21.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory.

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (Netty). This vulnerability     cannot be exploited in the context of this product. (CVE-2021-21409)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Snappy frame decoder function). The Snappy     frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside     this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to     excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that     decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.
    (CVE-2021-37137)

  - Security-in-Depth issue in Oracle NoSQL Database (component: Administration (Go). This vulnerability     cannot be exploited in the context of this product. (CVE-2021-34558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
166370	Oracle Database Server (Oct 2022 CPU)	Nessus	Databases	critical
155386	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 (Moderate) (RHSA-2021:4676)	Nessus	Red Hat Local Security Checks	high
155365	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8 (Moderate) (RHSA-2021:4677)	Nessus	Red Hat Local Security Checks	high
154253	Oracle NoSQL Database Multiple Vulnerabilities (Oct 2021 CPU)	Nessus	Databases	medium

Detections

Analytics

CVE-2021-30129

medium

Tenable Plugins

critical

high

high

medium