The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - ant: insecure temporary file (CVE-2020-11979)

  - jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

  - jenkins: XSS vulnerability in notification bar (CVE-2021-21603)

  - jenkins: Improper handling of REST API XML deserialization errors (CVE-2021-21604)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - ant: insecure temporary file (CVE-2020-11979)

  - jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

  - jenkins: XSS vulnerability in notification bar (CVE-2021-21603)

  - jenkins: Improper handling of REST API XML deserialization errors (CVE-2021-21604)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202011-18 (Apache Ant: Insecure temporary file)

    A previous fix for a security vulnerability involving insecure temporary       files has been found to be incomplete.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary       files with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4022-1 advisory.

    - CVE-2020-1945: Fixed insecure temporary file vulnerability (bsc#1171696).
    - CVE-2020-11979: Fixed issue introduced with fix for CVE-2020-1945 (bsc#1177180).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.33. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:0428

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

    * jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

    * ant: Insecure temporary file vulnerability (CVE-2020-1945)

    * jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

    * jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes     plug-in (CVE-2020-2307)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating     credentials IDs (CVE-2020-2309)

    * ant: Insecure temporary file (CVE-2020-11979)

    * python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 3.11.394. See the following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:0638

    Space precludes documenting all of the container images in this advisory. See the following Release Notes     documentation, which will be updated shortly for this release, for details about these changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    This update fixes the following bugs among others:

    * Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters.
    This was causing come clusters to never complete their restart. This bug fix passes the logging ops     cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)

    * Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file     during cluster installation. This caused the check to fail during initial installation because the `ca-     bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the     `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)

    * Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of     the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered     before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml`     file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set,     allowing for successful node upgrades. (BZ#1921353)

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so     that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the     temporary file and created a new one without said protection, effectively nullifying the effort. This     would still allow an attacker to inject modified source files into the build process. (CVE-2020-11979)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the apache package has been released.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0423 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.6.17. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHBA-2021:0424

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
312429	RHCOS 4 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/7	high
312439	RHCOS 4 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/7	high
142932	GLSA-202011-18 : Apache Ant: Insecure temporary file	Nessus	Gentoo Local Security Checks	2020/11/17	2024/2/8	high
167779	SUSE SLES12: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (SUSE-SU-2022:4022-1)	Nessus	SuSE Local Security Checks	2022/11/17	2026/6/26	high
147015	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
252907	Linux Distros Unpatched Vulnerability : CVE-2020-11979	Nessus	Misc.	2025/8/20	2026/8/4	high
141860	Photon OS 1.0: Apache PHSA-2020-1.0-0335	Nessus	PhotonOS Local Security Checks	2020/10/23	2022/12/5	high
146566	RHEL 8 : OpenShift Container Platform 4.6.17 (RHSA-2021:0423)	Nessus	Red Hat Local Security Checks	2021/2/18	2024/11/7	high

检测

插件搜索

high

high

high

high

high

high

high

high

high