The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2276 advisory.

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The IBM WebSphere Application Server running on the remote host is version 9.0.x prior to 9.0.0.9. It is, therefore, affected by a man-in-the-middle (MITM) vulnerability in the Apache CXF sub-component due to the TLS hostname verification not working correctly with the com.sun.net.ssl interface. A remote, unauthenticated attacker can exploit this to launch a man-in-the-middle attack.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2424 advisory.

  - cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services (CVE-2017-12624)

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

  - bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

The following packages have been upgraded to a later upstream version:
rhvm-appliance (4.2). (BZ#1590658, BZ#1591095, BZ#1591096, BZ#1592655, BZ# 1594636, BZ#1597534, BZ#1612683)

Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915 and Ammarit Thongthua (Deloitte Thailand Pentest team) and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915.

Security fixes :

* vulnerability: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)

* vulnerability: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

* vulnerability: postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

* vulnerability: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of ) (CVE-2018-1067, CVE-2016-4993)

* vulnerability: undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service (CVE-2018-1114)

* vulnerability: guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)

* vulnerability: bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2423 advisory.

  - cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services (CVE-2017-12624)

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

  - bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the Enterprise Manager Base Platform component of   Oracle Enterprise Manager Products Suite (subcomponent: Connector Framework (Apache CXF)),   which could allow an unauthenticated, remote attacker to compromise   Enterprise Manager Base Platform. (CVE-2018-8039)

  - An unspecified vulnerability in the Oracle Enterprise Manager Base Platform component   of Oracle Enterprise Manager Products Suite (subcomponent: Valid Session (Apache ActiveMQ)),   which could allow an unauthenticated, remote attacker to compromise   Oracle Enterprise Manager Base Platform. (CVE-2019-0222)

  - An unspecified vulnerability in the Enterprise Manager Base Platform component of   Oracle Enterprise Manager Products Suite (subcomponent: Discovery Framework (OpenSSL)), which   could allow and unauthenticated, remote attacker to compromise   Enterprise Manager Base Platform. (CVE-2019-1559)

ID	Name	Product	Family	Published	Updated	Severity
111486	RHEL 6 / 7 : Red Hat JBoss Enterprise Application Platform 7.1 (RHSA-2018:2276)	Nessus	Red Hat Local Security Checks	8/2/2018	8/28/2024	high
141915	IBM WebSphere Application Server 9.0.x < 9.0.0.9 MITM (CVE-2018-8039)	Nessus	Web Servers	10/27/2020	11/30/2020	high
112030	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 (RHSA-2018:2424)	Nessus	Red Hat Local Security Checks	8/21/2018	8/15/2024	high
117324	RHEL 7 : Virtualization (RHSA-2018:2643)	Nessus	Red Hat Local Security Checks	9/6/2018	8/9/2024	high
112029	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 (RHSA-2018:2423)	Nessus	Red Hat Local Security Checks	8/21/2018	8/15/2024	high
126775	Oracle Enterprise Manager Cloud Control (Jul 2019 CPU)	Nessus	Misc.	7/17/2019	12/6/2022	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high