** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)

  - Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support     (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or     `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request     with a part that has a name but no filename and very large content. This happens even with the default     settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client     may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server     may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some     time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade.
    Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-     negative value, so the whole multipart content is limited (although still read into memory).
    (CVE-2023-26048)

  - ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE     less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply     nested) hashmap or hashtable (depending on which logging component is in use) to be processed could     exhaust the available memory in the virtual machine and achieve Denial of Service when the object is     deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j     2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
    (CVE-2023-26464)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - log4j: Socket receiver deserialization vulnerability (CVE-2017-5645)

  - ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE     less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply     nested) hashmap or hashtable (depending on which logging component is in use) to be processed could     exhaust the available memory in the virtual machine and achieve Denial of Service when the object is     deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j     2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
    (CVE-2023-26464)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - log4j: Socket receiver deserialization vulnerability (CVE-2017-5645)

  - ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE     less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply     nested) hashmap or hashtable (depending on which logging component is in use) to be processed could     exhaust the available memory in the virtual machine and achieve Denial of Service when the object is     deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j     2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
    (CVE-2023-26464)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3663 advisory.

  - http2-server: Invalid HTTP/2 requests cause DoS (CVE-2022-2048)

  - springframework: BCrypt skips salt rounds for work factor of 31 (CVE-2022-22976)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - xstream: Denial of Service by injecting recursive collections or maps based on element's hash values     raising a stack overflow (CVE-2022-41966)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion)     (CVE-2023-1370)

  - jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436)

  - springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860)

  - log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

  - Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

  - Jenkins: Temporary plugin file created with insecure permissions (CVE-2023-27899)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

  - jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin (CVE-2023-32977)

  - jenkins-2-plugin: pipeline-utility-steps: Arbitrary file write vulnerability on agents in Pipeline Utility     Steps Plugin (CVE-2023-32981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5486 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5485 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5484 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.13 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.12 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.13 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * server: eap-7: heap exhaustion via deserialization (CVE-2023-3171)

    * log4j: log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

    * nodejs-semver: Regular expression denial of service (CVE-2022-25883)

    * wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

    * tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

    * bouncycastle: potential blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

    * netty: netty-handler: SniHandler 16MB allocation (CVE-2023-34462)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the installation of Apache Log4j on the remote host is 1.x and is no longer supported. Log4j reached its end of life prior to 2016. Additionally, Log4j 1.x is affected by multiple vulnerabilities, including :

  - Log4j includes a SocketServer that accepts serialized log events and deserializes them without verifying whether     the objects are allowed or not. This can provide an attack vector that can be exploited. (CVE-2019-17571)

  - Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS     connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that     appender. (CVE-2020-9488)

  - JMSSink uses JNDI in an unprotected manner allowing any application using the JMSSink to be vulnerable if it is     configured to reference an untrusted site or if the site referenced can be accesseed by the attacker.
    (CVE-2022-23302)

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

ID	Name	Product	Family	Severity
199118	RHEL 9 : log4j (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199080	RHEL 6 : log4j (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199036	RHEL 7 : log4j (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194242	RHEL 8 : jenkins and jenkins-2-plugins (RHSA-2023:3663)	Nessus	Red Hat Local Security Checks	critical
182684	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 (Important) (RHSA-2023:5486)	Nessus	Red Hat Local Security Checks	critical
182683	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8 (Important) (RHSA-2023:5485)	Nessus	Red Hat Local Security Checks	critical
182622	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7 (Important) (RHSA-2023:5484)	Nessus	Red Hat Local Security Checks	critical
156860	Apache Log4j 1.x Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-26464

high

Tenable Plugins

medium

critical

critical

critical

critical

critical

critical

critical