The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0429 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    This is the initial release of OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux     versions 7, 8, and 9.

    Security Fix(es):

    * OpenJDK: Enhance array handling (CVE-2025-21502)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 11 prior to 11.77.14 / 17 prior to 17.55.14 / 21 prior to 21.39.14 / 23 prior to 23.32.12. It is, therefore, affected by a vulnerability as referenced in the 2025-01-21 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0423 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Important Changes:

    * The Red Hat build of OpenJDK 17 is now the default system-wide version of Java on Red Hat Enterprise     Linux (RHEL) 9, because the full support phase for Red Hat build of OpenJDK 11 has ended (RHEL-63035,     RHEL-63036).

    The 11.0.25 release was the last release of Red Hat build of OpenJDK 11 from Red Hat in the full support     phase of the lifecycle. The full support phase for Red Hat build of OpenJDK 11 ended on 31 October 2024.

    As a consequence, Red Hat build of OpenJDK 17 will be the default system-wide Java version on RHEL 9 after     31 October 2024.

    Please refer to the Release Notes for Red Hat Build of OpenJDK 11.0.25 [1] for more details, including the     Extended Life Cycle Support (ELS) phase for Red Hat build of OpenJDK 11 and for migration instructions.

    See [2] for instructions on configuring Red Hat build of OpenJDK 17 on RHEL and selecting the default Red     Hat build of OpenJDK version to use system wide.

    [1]     https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/11/html/release_notes_for_red_hat_build_     of_openjdk_11.0.25/endfullsupport

    [2]     https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html-     single/configuring_red_hat_build_of_openjdk_17_on_rhel/index

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0426 advisory.

    The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is 17 prior to 17.0.14.7.1. It is, therefore, affected by a vulnerability as referenced in the corretto-17-2025-Jan-21 advisory.

  - hotspot/compiler (CVE-2025-21502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0421 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Bug Fix(es):

    * The Red Hat OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a     new updated JDK. The version of this package in RHEL 8.4 has been outdated for some time and contains bugs     that have been fixed in later RHEL versions. With this update, both copy-jdk-configs and the JDK have been     updated to use the latest version of copy-jdk-configs, which has been used for some years on later RHEL     versions (RHEL-73870).

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0422 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Bug Fix(es):

    * The Red Hat OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a     new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs,     which has been used for some years on later RHEL versions (RHEL-73867, RHEL-73871, RHEL-73872).

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
214461	RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:0429)	Nessus	Red Hat Local Security Checks	1/22/2025	1/22/2025	medium
214447	Azul Zulu Java Vulnerability (2025-01-21)	Nessus	Misc.	1/21/2025	1/21/2025	medium
214464	RHEL 9 : java-17-openjdk security update for RHEL 9.0 and 9.2 (Moderate) (RHSA-2025:0423)	Nessus	Red Hat Local Security Checks	1/22/2025	1/22/2025	medium
214504	RHEL 8 / 9 : java-21-openjdk security update for RHEL 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0426)	Nessus	Red Hat Local Security Checks	1/22/2025	1/22/2025	medium
214446	Amazon Corretto Java 17.x < 17.0.14.7.1 Vulnerability	Nessus	Misc.	1/21/2025	1/23/2025	medium
214462	RHEL 8 : java-17-openjdk security update for RHEL 8.4 (Moderate) (RHSA-2025:0421)	Nessus	Red Hat Local Security Checks	1/22/2025	1/22/2025	medium
214463	RHEL 8 / 9 : java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0422)	Nessus	Red Hat Local Security Checks	1/22/2025	1/22/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium