The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:2242 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547)     (CVE-2018-2952)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Note: If the web browser plug-in provided by the icedtea-web package was installed, the issues exposed via     Java applets could have been exploited without user interaction if a user visited a malicious website.

    Bug Fix(es):

    * This update applies changes from OpenJDK upstream version 8u172, which provides a number of bug fixes     over the previous version, 8u171. (BZ#1588364)

    * OpenJDK was recently updated to support reading the system certificate authority database (cacerts)     directly. As an unintended consequence, this removed the ability to read certificates from the user-     provided jssecacerts file. With this update, that ability is restored by reading from that file first, if     available. (BZ#1593737)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : java-1.8.0-openjdk (RHSA-2018:2242)

low Nessus Plugin ID 111257

Version 1.11