The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6662-1 advisory.

    Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly handled array accesses in the C1     compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code     or bypass Java sandbox restrictions. (CVE-2024-20918)

    It was discovered that the Hotspot component of OpenJDK 21 did not properly verify bytecode in certain     situations. An attacker could possibly use this issue to bypass Java sandbox restrictions.
    (CVE-2024-20919)

    It was discovered that the Hotspot component of OpenJDK 21 had an optimization flaw when generating range     check loop predicates. An attacker could possibly use this issue to cause a denial of service, execute     arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)

    It was discovered that OpenJDK 21 could produce debug logs that contained private keys used for digital     signatures. An attacker could possibly use this issue to obtain sensitive information. (CVE-2024-20945)

    Hubert Kario discovered that the TLS implementation in OpenJDK 21 had a timing side-channel and     incorrectly handled RSA padding. A remote attacker could possibly use this issue to recover sensitive     information. (CVE-2024-20952)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : OpenJDK 21 vulnerabilities (USN-6662-1)

high Nessus Plugin ID 191042

Version 1.1