The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3113 advisory.

  - SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) (CVE-2016-2183)

  - httpd: Uninitialized memory reflection in mod_auth_digest (CVE-2017-9788)

  - httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) (CVE-2017-9798)

  - tomcat: Remote Code Execution via JSP Upload (CVE-2017-12615)

  - tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 / 7 : Red Hat JBoss Web Server (RHSA-2017:3113)

critical Nessus Plugin ID 104456

Version 3.19

Version 3.18

Version 3.17

Version 3.19 Apr 28, 2024, 1:01 AM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404280101
Version 3.18 Apr 25, 2023, 11:11 PM CVSS temporal metrics (Adjust exploitability metrics for CISA KEV vulnerabilities) Plugin Feed: 202304252311
Version 3.17 Dec 6, 2022, 1:01 AM Reference Plugin Feed: 202212060101