The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4083-1 advisory.

    It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing     suppressed exceptions in some situations. An attacker could use this to specially craft an object that,     when deserialized, would cause a denial of service. (CVE-2019-2762)

    It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated     during object deserialization. An attacker could use this to specially craft an object that, when     deserialized, would cause a denial of service (excessive memory consumption). (CVE-2019-2769)

    It was discovered that OpenJDK did not properly restrict privileges in certain situations. An attacker     could use this to specially construct an untrusted Java application or applet that could escape sandbox     restrictions. (CVE-2019-2786)

    Jonathan Birch discovered that the Networking component of OpenJDK did not properly validate URLs in some     situations. An attacker could use this to bypass restrictions on characters in URLs. (CVE-2019-2816)

    It was discovered that the ChaCha20Cipher implementation in OpenJDK did not use constant time computations     in some situations. An attacker could use this to expose sensitive information. (CVE-2019-2818)

    It was discovered that the Java Secure Socket Extension (JSSE) component in OpenJDK did not properly     handle OCSP stapling messages during TLS handshake in some situations. An attacker could use this to     expose sensitive information. (CVE-2019-2821)

    It was discovered that OpenJDK incorrectly handled certain memory operations. If a user or automated     system were tricked into opening a specially crafted PNG file, a remote attacker could use this issue to     cause OpenJDK to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2019-7317)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 18.04 LTS : OpenJDK 11 vulnerabilities (USN-4083-1)

medium Nessus Plugin ID 127800

Version 1.13