The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7351-1 advisory.

    Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An     attacker could possibly use this issue to modify the app's behavior for other users through the network.
    (CVE-2020-10688)

    Mirko Selber discovered that RESTEasy improperly validated user input during HTTP response construction.
    This issue could possibly allow an attacker to cause a denial of service or execute arbitrary code.
    (CVE-2020-1695)

    It was discovered that RESTEasy unintentionally disclosed potentially sensitive server information to     users during the handling of certain errors. (CVE-2020-25633)

    It was discovered that RESTEasy unintentionally disclosed parts of its code to users during the handling     of certain errors. (CVE-2021-20289)

    It was discovered that RESTEasy used improper permissions when creating temporary files. An attacker could     possibly use this issue to get access to sensitive data. (CVE-2023-0482)

    It was discovered that RESTEasy improperly handled certain HTTP requests and could be forced into a state     in which it can no longer accept incoming connections. An attacker could possibly use this issue to cause     a denial of service. (CVE-2024-9622)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2398 advisory.

    A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method     names are returned as part of the exception response when RESTEasy cannot convert one of the request URI     path or query values to the matching JAX-RS resource method's parameter value. The highest threat from     this vulnerability is to data confidentiality. (CVE-2021-20289)

    In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and     Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local     user. (CVE-2023-0482)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1513 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.9, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.10 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

    * hsqldb: Untrusted input may lead to RCE attack (CVE-2022-41853)

    * Undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2707 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.3 on RHEL 9 serves as a replacement for Red Hat Single Sign-On     7.6.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1514 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.9, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.4.10 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

    * hsqldb: Untrusted input may lead to RCE attack (CVE-2022-41853)

    * Undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2706 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.3 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.6.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2705 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.3 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * okhttp: information disclosure via improperly used cryptographic function (CVE-2021-0341)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1512 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.10 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.9 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.10 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

    * hsqldb: Untrusted input may lead to RCE attack (CVE-2022-41853)

    * Undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

    * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492)

    * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752)

    * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854)

    * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881)

    * apache-james-mime4j: Temporary File Information Disclosure in MIME4J TempFileStorageProvider     (CVE-2022-45787)

    * RESTEasy: creation of insecure temp files (CVE-2023-0482)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
232708	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RESTEasy vulnerabilities (USN-7351-1)	Nessus	Ubuntu Local Security Checks	3/13/2025	3/13/2025	high
187827	Amazon Linux 2 : resteasy-base (ALAS-2024-2398)	Nessus	Amazon Linux Local Security Checks	1/9/2024	12/11/2024	medium
173692	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 (RHSA-2023:1513)	Nessus	Red Hat Local Security Checks	3/30/2023	11/7/2024	critical
175556	RHEL 9 : Red Hat Single Sign-On 7.6.3 security update on RHEL 9 (Moderate) (RHSA-2023:2707)	Nessus	Red Hat Local Security Checks	5/13/2023	11/7/2024	high
173691	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 (RHSA-2023:1514)	Nessus	Red Hat Local Security Checks	3/30/2023	11/8/2024	critical
175557	RHEL 8 : Red Hat Single Sign-On 7.6.3 security update on RHEL 8 (Moderate) (RHSA-2023:2706)	Nessus	Red Hat Local Security Checks	5/13/2023	11/7/2024	high
175558	RHEL 7 : Red Hat Single Sign-On 7.6.3 security update on RHEL 7 (Moderate) (RHSA-2023:2705)	Nessus	Red Hat Local Security Checks	5/13/2023	11/7/2024	high
173690	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 (RHSA-2023:1512)	Nessus	Red Hat Local Security Checks	3/30/2023	11/7/2024	critical

Detections

Analytics

Plugins Search

high

medium

critical

high

critical

high

high

critical