It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-152 advisory.

    Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count (should be     charactercount). (CVE-2022-21618)

    Title: Improve NTLM supportwriteSecurityBuffer() writes a serialized security buffer to be used for     NTLMauth. One of the fields that are serialized is a hostname provided by thename resolver. If this     hostname is very long, integer truncation occurs,which would allow a malicious hostname to be partially     re-interpreted assomething else following a hostname, once the security buffer is deserializedon the other     size. (CVE-2022-21619)

    Title: Improve JNDI lookupsJNDI DNS port numbers can be easily guessed and should be more random.
    (CVE-2022-21624)

    Title: Key X509 usagesDecoding of X509 keys may use excessive amount of heap memory. (CVE-2022-21626)

    Title: Better HttpServer serviceHttpServer eagerly accepts connections which may exceed the limit.
    (CVE-2022-21628)

    Title: Improve HTTP/1.1 client usageThe HTTP/2 connection cache caches connection based on the IP address     but notthe SNI which can allow spoofing for servers on the same IP. (CVE-2022-39399)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-152)

high Nessus Plugin ID 166351

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.5 Oct 9, 2023, 5:00 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") Plugin Feed: 202310091700
Version 1.4 Nov 28, 2022, 4:23 PM CVSS metrics ("CVSSv2 score" changed from "5.0" to "7.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N") CVSSv2 score source (changed from "CVE-2022-21626" to "CVE-2022-34169") CVSSv2 severity (based on CVE-2022-34169, severity increased from "Medium" to "High") Plugin Feed: 202211281623
Version 1.3 Nov 5, 2022, 9:45 AM CVSSv3 score source (Changed from CVE-2022-21618 to CVE-2022-34169) CVSS temporal metrics CVSS metrics CVE Plugin metadata Exploit attributes CVSSv3 severity (Based on CVE-2022-34169 severity increased from Medium to High) Plugin Feed: 202211050945
Version 1.2 Oct 21, 2022, 5:42 AM New Plugin Feed: 202210210542