The version of Jetty installed on the remote host when handling too large response headers throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and potentially leak sensitive data between the two clients. Note that the scanner has not tested for this issue but has instead relied only on the application's self-reported version number.

Updates to the latest upstream release of Eclipse. See the upstream release notes for details:
https://www.eclipse.org/eclipseide/2020-06/noteworthy/

Also contains security fixes for CVE-2019-17566 and CVE-2019-17638.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3808 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jenkins: Stored XSS vulnerability in job build time trend (CVE-2020-2220)

    * jenkins: Stored XSS vulnerability in upstream cause (CVE-2020-2221)

    * jenkins: Stored XSS vulnerability in 'keep forever' badge icons (CVE-2020-2222)

    * jenkins: Stored XSS vulnerability in console links (CVE-2020-2223)

    * kubernetes: Node disk DOS by writing to container /etc/hosts (CVE-2020-8557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Jenkins running on the remote web server is 2.224 through 2.242 or is a version of Jenkins LTS  2.222.1 through 2.235.4. It is, therefore, affected by an information disclosure vulnerability exists due to an vulnerable Jetty 9.4.27  library. An unauthenticated, remote attacker can exploit this to disclose potentially sensitive information intended for  other users.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:4223 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jetty: Double release of resource can lead to information disclosure (CVE-2019-17638)

    * jenkins: User-specified tooltip values leads to stored cross-site scripting (CVE-2020-2229)

    * jenkins: Stored XSS vulnerability in project naming strategy (CVE-2020-2230)

    * jenkins: Stored XSS vulnerability in 'trigger builds remotely' (CVE-2020-2231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jenkins Security Advisory : Description(Critical) SECURITY-1983 / CVE-2019-17638 Buffer corruption in bundled Jetty

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3841 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * jetty: double release of resource can lead to information disclosure (CVE-2019-17638)

    * jenkins: user-specified tooltip values leads to stored cross-site scripting (CVE-2020-2229)

    * jenkins: stored XSS vulnerability in project naming strategy (CVE-2020-2230)

    * jenkins: stored XSS vulnerability in 'trigger builds remotely' (CVE-2020-2231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113003	Jetty 9.4.27 < 9.4.30 Buffer Overflow	Web App Scanning	Component Vulnerability	10/4/2021	3/14/2023	critical
140107	Fedora 32 : 1:ecj / 1:eclipse / 1:eclipse-emf / 2:eclipse-cdt / batik / etc (2020-cf8ef2f333)	Nessus	Fedora Local Security Checks	9/1/2020	2/22/2024	critical
140749	RHEL 7 / 8 : OpenShift Container Platform 4.3.38 jenkins and openshift (RHSA-2020:3808)	Nessus	Red Hat Local Security Checks	9/23/2020	11/7/2024	critical
139734	Jenkins < 2.235.5 LTS / 2.243 Information Disclosure Vulnerability	Nessus	CGI abuses	8/21/2020	6/5/2024	critical
141814	RHEL 7 : OpenShift Container Platform 3.11.306 jenkins (RHSA-2020:4223)	Nessus	Red Hat Local Security Checks	10/22/2020	11/7/2024	critical
139640	FreeBSD : jenkins -- Buffer corruption in bundled Jetty (09ea1b08-1d3e-4bf2-91a1-d6573f4da3d8)	Nessus	FreeBSD Local Security Checks	8/18/2020	2/26/2024	critical
141125	RHEL 7 : OpenShift Container Platform 4.5.13 jenkins (RHSA-2020:3841)	Nessus	Red Hat Local Security Checks	10/2/2020	11/7/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical