The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1511 advisory.

    Red Hat AMQ Clients enable connecting, sending, and receiving messages over the AMQP 1.0 wire transport     protocol to or from AMQ Broker 6 and 7.

    This update provides various bug fixes and enhancements in addition to the client package versions     previously released on Red Hat Enterprise Linux 7 and 8.

    Security Fix(es):

    * netty: Information disclosure via the local system temporary directory (CVE-2021-21290)

    * netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)

    * netty: Request smuggling via content-length header (CVE-2021-21409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6049-1 advisory.

    It was discovered that Netty's Zlib decoders did not limit memory allocations. A remote attacker could     possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a denial of     service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-11612)

    It was discovered that Netty created temporary files with excessive permissions. A local attacker could     possibly use this issue to expose sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu     18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)

    It was discovered that Netty did not properly validate content-length headers. A remote attacker could     possibly use this issue to smuggle requests. This issue was only fixed in Ubuntu 20.04 ESM.
    (CVE-2021-21295, CVE-2021-21409)

    It was discovered that Netty's Bzip2 decompression decoder did not limit the decompressed output data     size. A remote attacker could possibly use this issue to cause Netty to exhaust memory via malicious     input, leading to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu     22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136)

    It was discovered that Netty's Snappy frame decoder function did not limit chunk lengths. A remote     attacker could possibly use this issue to cause Netty to exhaust memory via malicious input, leading to a     denial of service. (CVE-2021-37137)

    It was discovered that Netty did not properly handle control chars at the beginning and end of header     names. A remote attacker could possibly use this issue to smuggle requests. This issue only affected     Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797)

    It was discovered that Netty could be made into an infinite recursion when parsing a malformed crafted     message. A remote attacker could possibly use this issue to cause Netty to crash, leading to a denial of     service. This issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41881)

    It was discovered that Netty did not validate header values under certain circumstances. A remote attacker     could possibly use this issue to perform HTTP response splitting via malicious header values. This issue     only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-41915)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2693 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.3.8 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.3.7, and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 7.3.8 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * netty: Request smuggling via content-length header (CVE-2021-21409)

    * wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the zookeeper package has been released.

The 17.12.11, 18.8.11, 19.12.10, and 20.12.0 versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Nimbus JOSE+JWT)). Supported versions that are affected are 18.8.0-18.8.11. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera     Gateway. Successful attacks of this vulnerability can result in takeover of Primavera Gateway.
    (CVE-2019-17195)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Lodash)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11, 19.12.0-19.12.10 and     20.12.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data and     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Gateway.
    (CVE-2020-8203)

  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin     (Netty)). Supported versions that are affected are 17.12.0-17.12.11, 18.8.0-18.8.11 and 19.12.0-19.12.10.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Primavera Gateway. Successful attacks of this vulnerability can result in unauthorized     creation, deletion or modification access to critical data or all Primavera Gateway accessible data.
    (CVE-2021-21409)     
  - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component:
    jackson-databind). (CVE-2020-36189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:1315-1 advisory.

  - Netty is an open-source, asynchronous event-driven network application framework for rapid development of     maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before     version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is     not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to     true. This could lead to request smuggling if the request is proxied to a remote peer and translated to     HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case.
    This was fixed as part of 4.1.61.Final. (CVE-2021-21409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3658 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.1 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.0 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.1 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)

    * undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)

    * undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS     (CVE-2021-3597)

    * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

    * netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)

    * netty: Request smuggling via content-length header (CVE-2021-21409)

    * jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)

    * apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)

    * wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)

    * wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3656 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.1 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.0 and includes bug fixes and enhancements. See the Red Hat JBoss     Enterprise Application Platform 7.4.1 Release Notes for information about the most significant bug fixes     and enhancements included in this release.

    Security Fix(es):

    * velocity: arbitrary code execution when attacker is able to modify templates (CVE-2020-13936)

    * undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)

    * undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS     (CVE-2021-3597)

    * wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)

    * netty: possible request smuggling in HTTP/2 due missing validation (CVE-2021-21295)

    * netty: Request smuggling via content-length header (CVE-2021-21409)

    * jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)

    * apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)

    * wildfly: XSS via admin console when creating roles in domain mode (CVE-2021-3536)

    * wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
149319	RHEL 7 / 8 : AMQ Clients 2.9.1 (RHSA-2021:1511)	Nessus	Red Hat Local Security Checks	2021/5/6	2024/11/7	medium
174932	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 LTS : Netty vulnerabilities (USN-6049-1)	Nessus	Ubuntu Local Security Checks	2023/4/28	2025/9/3	medium
151579	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.8 on RHEL 7 (RHSA-2021:2693)	Nessus	Red Hat Local Security Checks	2021/7/13	2024/11/7	medium
150910	Photon OS 3.0: Zookeeper PHSA-2021-3.0-0254	Nessus	PhotonOS Local Security Checks	2021/6/21	2025/8/22	medium
151974	Oracle Primavera Gateway (Jul 2021 CPU)	Nessus	CGI abuses	2021/7/22	2023/12/7	critical
170224	openSUSE 15 Security Update : netty (SUSE-SU-2022:1315-1)	Nessus	SuSE Local Security Checks	2023/1/20	2023/9/7	medium
153832	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 (Important) (RHSA-2021:3658)	Nessus	Red Hat Local Security Checks	2021/10/1	2024/11/7	high
153835	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 (Important) (RHSA-2021:3656)	Nessus	Red Hat Local Security Checks	2021/10/1	2024/11/7	high

检测

插件搜索

medium

medium

medium

medium

critical

medium

high

high