The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8117 advisory.

    [1.8.0.432.b06-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:1.8.0.432.b06-1]
    - Update to shenandoah-jdk8u432-b06 (GA)
    - Update release notes for shenandoah-8u432-b06.
    - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
    - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
    - Bump version of bundled zlib to 1.3.1 following JDK-8324632
    - Include backport of JDK-8328999 to update giflib to 5.2.2
    - Bump version of bundled giflib to 5.2.2 following JDK-8328999
    - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
    - Sync the copy of the portable specfile with the latest update
    - Resolves: RHEL-58791
    - Resolves: RHEL-62278
    - Resolves: RHEL-61285
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202412-07 (OpenJDK: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenJDK. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.432.b06-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2720 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21131)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21138)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21140)

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Concurrency).  Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf,     11.0.23; Oracle GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise     Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21144)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java     SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data     to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed     Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that     comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8     (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
    (CVE-2024-21145)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and  21.3.10. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized access to     critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified     Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to     Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java     sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). (CVE-2024-21147)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21208)

    Vulnerability in Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle     Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and  23. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.
    Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to     some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21210)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE:
    8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle     GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21217)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23;   Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;   Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and     Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.7. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.7 advisory.

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

  - A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can     trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs,     the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result     in leaked passwords, such as those found in /etc/shadow while performing authentications. (CVE-2024-10041)

  - A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as     hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname,     gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who     can access certain services or terminals. (CVE-2024-10963)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21131)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411,     8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle     GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2024-21138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 8 < 8.432.06.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2024-Oct-15 advisory.

  - core-libs/java.net (CVE-2024-21208)

  - hotspot/compiler (CVE-2024-21210, CVE-2024-21235)

  - core-libs/java.io:serialization (CVE-2024-21217)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8120 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8117 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)
    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)
    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)
    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)
    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8127 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8117 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8121 advisory.

    [1:11.0.25.0.9-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:11.0.25.0.9-2]
    - Update to jdk-11.0.25+9 (GA)
    - Update release notes to 11.0.25+9
    - Switch to GA mode for release
    - Related: RHEL-58772
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

    [1:11.0.25.0.8-0.2.ea]
    - Update to jdk-11.0.25+8 (EA)
    - Update release notes to 11.0.25+8
    - Related: RHEL-58772

    [1:11.0.25.0.7-0.3.ea]
    - RHJDKBP-875 - Added gating.yaml and/or rpminspect.yaml
    - RHJDKBP-874 - Remove
    - Related: RHEL-58772

    [1:11.0.25.0.7-0.1.ea]
    - Update to jdk-11.0.25+7 (EA)
    - Update release notes to 11.0.25+7
    - Related: RHEL-58772

    [1:11.0.25.0.6-0.3.ea]
    - Limit Java only tests to one 'jdk_test_arch'
    - Resolves: RHEL-59727
    - Related: RHEL-58772

    [1:11.0.25.0.6-0.2.ea]
    - Update to jdk-11.0.25+6 (EA)
    - Switch to EA mode
    - Update release notes to 11.0.25+6
    - Related: RHEL-58772

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8121 advisory.

    * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161)

    * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210)

    * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208)

    * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217)

    * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7097-1 advisory.

    Andy Boothe discovered that the Networking component of OpenJDK 11 did not properly handle access under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to cause a denial of service. (CVE-2024-21208)

    It was discovered that the Hotspot component of OpenJDK 11 did not properly handle vectorization under     certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of OpenJDK 11 did not properly handle deserialization     under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial     of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of OpenJDK 11 was not properly bounding certain UTF-8     strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 11 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 11 did not properly perform range check     elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary     code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21140)

    Yakov Shafranovich discovered that the Concurrency component of OpenJDK 11 incorrectly performed header     validation in the Pack200 archive format. An attacker could possibly use this issue to cause a denial of     service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2024-21144)

    Sergey Bylokhov discovered that OpenJDK 11 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in     Ubuntu 18.04 LTS. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 11 incorrectly handled memory when performing     range check elimination under certain circumstances. An attacker could possibly use this issue to cause a     denial of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only     addressed in Ubuntu 18.04 LTS. (CVE-2024-21147)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3987-1 advisory.

    Update to version jdk8u432 (icedtea-3.33.0):

    - CVE-2024-21208: Enhance HTTP client (bsc#1231702).
    - CVE-2024-21210: Improve handling of vectorization (bsc#1231711).
    - CVE-2024-21217: Improve deserialization support (bsc#1231716).
    - CVE-2024-21235: Improve graph optimizations (bsc#1231719).
    - CVE-2024-21145: Improve 2D image (bsc#1228051).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
209305	Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2024-8117)	Nessus	Oracle Linux Local Security Checks	10/18/2024	10/18/2024	high
212190	GLSA-202412-07 : OpenJDK: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	12/9/2024	12/9/2024	high
213345	Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2720)	Nessus	Amazon Linux Local Security Checks	12/23/2024	12/23/2024	high
233563	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.7)	Nessus	Misc.	3/31/2025	3/31/2025	critical
209072	Amazon Corretto Java 8.x < 8.432.06.1 Multiple Vulnerabilities	Nessus	Misc.	10/16/2024	10/16/2024	medium
209118	RHEL 7 : java-11-openjdk (RHSA-2024:8120)	Nessus	Red Hat Local Security Checks	10/16/2024	10/16/2024	high
209287	AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2024:8117)	Nessus	Alma Linux Local Security Checks	10/18/2024	10/18/2024	high
209683	RockyLinux 8 / 9 : java-21-openjdk (RLSA-2024:8127)	Nessus	Rocky Linux Local Security Checks	10/25/2024	10/25/2024	high
209167	RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2024:8117)	Nessus	Red Hat Local Security Checks	10/17/2024	11/7/2024	high
209264	Oracle Linux 8 / 9 : java-11-openjdk (ELSA-2024-8121)	Nessus	Oracle Linux Local Security Checks	10/17/2024	10/18/2024	high
209688	RockyLinux 8 / 9 : java-11-openjdk (RLSA-2024:8121)	Nessus	Rocky Linux Local Security Checks	10/25/2024	10/25/2024	high
210737	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 11 vulnerabilities (USN-7097-1)	Nessus	Ubuntu Local Security Checks	11/11/2024	11/11/2024	high
211420	SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2024:3987-1)	Nessus	SuSE Local Security Checks	11/15/2024	11/15/2024	medium

Detections

Analytics

Plugins Search

high

high

high

critical

medium

high

high

high

high

high

high

high

medium