jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a     denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK     serialization. (CVE-2021-46877)

  - In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur     because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when     the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. (CVE-2022-42003)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3610 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

    * json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

    * springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

    * jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin     (CVE-2023-24422)

    * jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin (CVE-2023-32977)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * Jenkins plugin: CSRF vulnerability in Blue Ocean Plugin (CVE-2022-30953)

    * Jenkins plugin: missing permission checks in Blue Ocean Plugin (CVE-2022-30954)

    * jettison: parser crash by stackoverflow (CVE-2022-40149)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

    * springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

    * jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline     Utility Steps Plugin (CVE-2023-32981)

    * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2097 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):
    * CVE-2022-1471 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 candlepin and     puppetserver: various flaws
    * CVE-2022-22577 tfm-rubygem-actionpack: rubygem-actionpack: Possible cross-site scripting vulnerability     in Action Pack
    * CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
    * CVE-2022-23515 rubygem-loofah: rubygem-loofah: Improper neutralization of data URIs leading to Cross     Site Scripting
    * CVE-2022-23516 rubygem-loofah: Uncontrolled Recursion leading to denial of service
    * CVE-2022-23517 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Inefficient Regular     Expression leading to denial of service
    * CVE-2022-23518 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Improper neutralization     of data URIs leading to Cross site scripting
    * CVE-2022-23519 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting     vulnerability with certain configurations
    * CVE-2022-23520 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting     vulnerability with certain configurations
    * CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag     helpers
    * CVE-2022-31163 rubygem-tzinfo: rubygem-tzinfo: arbitrary code execution
    * CVE-2022-32224 tfm-rubygem-activerecord: activerecord: Possible RCE escalation bug with Serialized     Columns in Active Record
    * CVE-2022-33980 candlepin: apache-commons-configuration2: Apache Commons Configuration insecure     interpolation defaults
    * CVE-2022-41323 satellite-capsule:el8/python-django: Potential denial-of-service vulnerability in     internationalized URLs
    * CVE-2022-41946 candlepin: postgresql-jdbc: Information leak of prepared statement data due to insecure     temporary file permissions
    * CVE-2022-42003 CVE-2022-42004 candlepin: various flaws
    * CVE-2022-42889 candlepin: apache-commons-text: variable interpolation RCE
    * CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
    * CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
    * CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    Additional Changes:

    The items above are not a complete list of changes. This update also fixes     several bugs and adds various enhancements. Documentation for these changes     is available from the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3299 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * apache-commons-text: variable interpolation RCE (CVE-2022-42889)

    * google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

    * jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin     (CVE-2023-24422)

    * kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * springframework: Authorization Bypass in RegexRequestMatcher (CVE-2022-22978)

    * xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151)

    * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks     (CVE-2022-40152)

    * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

    * jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

    * jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

    * Jenkins: Denial of Service attack (CVE-2023-27900)

    * Jenkins: Denial of Service attack (CVE-2023-27901)

    * Jenkins: Workspace temporary directories accessible through directory browser (CVE-2023-27902)

    * Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.7.2.x prior to 9.7.2.8. It is, therefore, affected by multiple vulnerabilities as referenced in the 7124058 advisory.

  - Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet     containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly     vulnerable to an authorization bypass. (CVE-2022-32532)

  - The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow     a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary     shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client     or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade     both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
    (CVE-2023-46604)

  - Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be     exploited. There is only a risk in conjunction with Java object deserialization within an application. In     such situations, it allows attackers to erase contents of arbitrary files, make network connections, or     possibly run arbitrary code (specifically, Function0 functions) via a gadget chain. (CVE-2022-36944)

  - IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which     could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the     website trusts. IBM X-Force ID: 251216. (CVE-2023-28949)

  - A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows     remote attackers to inject arbitrary web script through a crafted protected comment (with the     cke_protected syntax). (CVE-2020-9281)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-14750 advisory.

  - jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a     denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK     serialization. (CVE-2021-46877)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-428 advisory.

  - jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a     denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK     serialization. (CVE-2021-46877)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4920 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.5 on RHEL 9 serves as a replacement for Red Hat Single Sign-On     7.6.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4918 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.5 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4919 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.5 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.6.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4506 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.12 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.11 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.12 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4507 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.12 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.11 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.12 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4505 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.12 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.11 and includes     bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.12 Release Notes for     information about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: OutOfMemoryError due to @MultipartConfig handling (CVE-2023-3223)

    * jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode (CVE-2021-46877)

    * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198704	RHEL 8 : jboss-on (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194324	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3610)	Nessus	Red Hat Local Security Checks	critical
194316	RHEL 8 : Satellite 6.13 Release (Important) (RHSA-2023:2097)	Nessus	Red Hat Local Security Checks	critical
194250	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3299)	Nessus	Red Hat Local Security Checks	critical
191754	IBM Engineering Requirements Management DOORS 9.7.2.x < 9.7.2.8 Multiple Vulnerabilities (7124058)	Nessus	Windows	critical
186231	Atlassian Jira Service Management Data Center and Server 4.20.x < 4.20.27 (JSDSERVER-14750)	Nessus	Misc.	high
184422	Amazon Linux 2023 : jackson-databind (ALAS2023-2023-428)	Nessus	Amazon Linux Local Security Checks	high
180419	RHEL 9 : Red Hat Single Sign-On 7.6.5 security update on RHEL 9 (Important) (RHSA-2023:4920)	Nessus	Red Hat Local Security Checks	high
180418	RHEL 7 : Red Hat Single Sign-On 7.6.5 security update on RHEL 7 (Important) (RHSA-2023:4918)	Nessus	Red Hat Local Security Checks	high
180417	RHEL 8 : Red Hat Single Sign-On 7.6.5 security update on RHEL 8 (Important) (RHSA-2023:4919)	Nessus	Red Hat Local Security Checks	high
179411	RHEL 8 : Red Hat JBoss Enterprise Application Platform (RHSA-2023:4506)	Nessus	Red Hat Local Security Checks	high
179410	RHEL 9 : Red Hat JBoss Enterprise Application Platform (RHSA-2023:4507)	Nessus	Red Hat Local Security Checks	high
179409	RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2023:4505)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2021-46877

high

Tenable Plugins

high

critical

critical

critical

critical

high

high

high

high

high

high

high

high