The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3134 advisory.

  - OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532)     (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915)     (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298)     (CVE-2019-2989)

  - OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenJDK: Improper handling of Kerberos proxy credentials     (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: Unexpected exception thrown during regular     expression processing in Nashorn (Scripting, 8223518)     (CVE-2019-2975)

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar     URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Incorrect handling of HTTP proxy responses in     HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

  - OpenJDK: Missing restrictions on use of custom     SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D,     8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern     processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser     processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown by XPath processing     crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object     deserialization (Serialization, 8224915) (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in     FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in     SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Excessive memory allocation in CMap when     reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes     in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

From Red Hat Security Advisory 2019:3157 :

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

* OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

* OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

* OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

* OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964)

* OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973)

* OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

* OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983)

* OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

* OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

* OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

* OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - OpenJDK: Incorrect handling of nested jar: URLs in Jar     URL handler (Networking, 8223892) (CVE-2019-2978)

  - OpenJDK: Incorrect handling of HTTP proxy responses in     HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

  - OpenJDK: Missing restrictions on use of custom     SocketImpl (Networking, 8218573) (CVE-2019-2945)

  - OpenJDK: NULL pointer dereference in DrawGlyphList (2D,     8222690) (CVE-2019-2962)

  - OpenJDK: Unexpected exception thrown by Pattern     processing crafted regular expression (Concurrency,     8222684) (CVE-2019-2964)

  - OpenJDK: Unexpected exception thrown by XPathParser     processing crafted XPath expression (JAXP, 8223505)     (CVE-2019-2973)

  - OpenJDK: Unexpected exception thrown by XPath processing     crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

  - OpenJDK: Unexpected exception thrown during Font object     deserialization (Serialization, 8224915) (CVE-2019-2983)

  - OpenJDK: Missing glyph bitmap image dimension check in     FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

  - OpenJDK: Integer overflow in bounds check in     SunGraphics2D (2D, 8225292) (CVE-2019-2988)

  - OpenJDK: Excessive memory allocation in CMap when     reading TrueType font (2D, 8225597) (CVE-2019-2992)

  - OpenJDK: Insufficient filtering of HTML event attributes     in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.7.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

* OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

* OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

* OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

* OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964)

* OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973)

* OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

* OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983)

* OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

* OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

* OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

* OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

* OpenJDK: Unexpected exception thrown during regular expression processing in Nashorn (Scripting, 8223518) (CVE-2019-2975)

* OpenJDK: Incorrect handling of nested jar: URLs in Jar URL handler (Networking, 8223892) (CVE-2019-2978)

* OpenJDK: Incorrect handling of HTTP proxy responses in HttpURLConnection (Networking, 8225298) (CVE-2019-2989)

* OpenJDK: Missing restrictions on use of custom SocketImpl (Networking, 8218573) (CVE-2019-2945)

* OpenJDK: NULL pointer dereference in DrawGlyphList (2D, 8222690) (CVE-2019-2962)

* OpenJDK: Unexpected exception thrown by Pattern processing crafted regular expression (Concurrency, 8222684) (CVE-2019-2964)

* OpenJDK: Unexpected exception thrown by XPathParser processing crafted XPath expression (JAXP, 8223505) (CVE-2019-2973)

* OpenJDK: Unexpected exception thrown by XPath processing crafted XPath expression (JAXP, 8224532) (CVE-2019-2981)

* OpenJDK: Unexpected exception thrown during Font object deserialization (Serialization, 8224915) (CVE-2019-2983)

* OpenJDK: Missing glyph bitmap image dimension check in FreetypeFontScaler (2D, 8225286) (CVE-2019-2987)

* OpenJDK: Integer overflow in bounds check in SunGraphics2D (2D, 8225292) (CVE-2019-2988)

* OpenJDK: Excessive memory allocation in CMap when reading TrueType font (2D, 8225597) (CVE-2019-2992)

* OpenJDK: Insufficient filtering of HTML event attributes in Javadoc (Javadoc, 8226765) (CVE-2019-2999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.5.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2019-Oct-15 advisory.

  - security-libs/javax.net.ssl (CVE-2019-2894, CVE-2019-2949)

  - core-libs (CVE-2019-2933)

  - core-libs/java.net (CVE-2019-2945, CVE-2019-2978, CVE-2019-2989)

  - core-libs/java.lang (CVE-2019-2958)

  - client-libs/2d (CVE-2019-2962, CVE-2019-2983, CVE-2019-2987, CVE-2019-2988, CVE-2019-2992)

  - core-libs/java.util.regex (CVE-2019-2964)

  - xml/jaxp (CVE-2019-2973, CVE-2019-2981)

  - core-libs/javax.script (CVE-2019-2975)

  - hotspot/compiler (CVE-2019-2977)

  - tools/javadoc (CVE-2019-2999)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130041	RHEL 8 : java-1.8.0-openjdk (RHSA-2019:3134)	Nessus	Red Hat Local Security Checks	10/18/2019	4/27/2024	medium
130048	Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x x86_64 (20191016)	Nessus	Scientific Linux Local Security Checks	10/18/2019	4/17/2024	medium
130138	Oracle Linux 7 : java-1.7.0-openjdk (ELSA-2019-3157)	Nessus	Oracle Linux Local Security Checks	10/22/2019	12/18/2019	medium
130157	Scientific Linux Security Update : java-1.7.0-openjdk on SL7.x x86_64 (20191022)	Nessus	Scientific Linux Local Security Checks	10/23/2019	2/24/2020	medium
130180	CentOS 7 : java-1.7.0-openjdk (CESA-2019:3157)	Nessus	CentOS Local Security Checks	10/24/2019	12/18/2019	medium
144540	Virtuozzo 6 : java-1.8.0-openjdk / java-1.8.0-openjdk-debug / etc (VZLSA-2019-3136)	Nessus	Virtuozzo Local Security Checks	12/22/2020	5/11/2022	medium
159435	Amazon Corretto Java 11.x < 11.0.5.10.1 Multiple Vulnerabilities	Nessus	Misc.	4/1/2022	5/6/2022	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium