The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4164 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix     for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the     fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222494)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : java-11-openjdk (RHSA-2023:4164)

medium Nessus Plugin ID 178570

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.0

Version 1.4 Nov 7, 2024, 8:25 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202411072025
Version 1.3 Nov 5, 2024, 6:29 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202411051829
Version 1.2 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202404281425
Version 1.1 Jan 26, 2024, 11:18 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262318
Version 1.0 Jul 20, 2023, 8:13 AM New Plugin Feed: 202307200813
Version 1.0 Jan 26, 2024, 9:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262100