A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page).

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1738 advisory.

    2023-05-11: CVE-2017-12616 was added to this advisory.

    When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security     constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a     specially crafted request. (CVE-2017-12616)

    Tomcat: Memory leak (CVE-2022-4132)

    Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting     in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note     that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is     not enabled by default and must be explicitly configured. (CVE-2023-24998)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199900	RHEL 8 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199885	RHEL 7 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199820	RHEL 9 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195812	RHEL 6 : jss (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
175088	Amazon Linux AMI : tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-4132

medium

Tenable Plugins

medium

medium

medium

medium

high