The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3592 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3592-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     September 30, 2023                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : jetty9     Version        : 9.4.16-0+deb10u3     CVE ID         : CVE-2023-26048 CVE-2023-26049 CVE-2023-36479 CVE-2023-40167

    Multiple security vulnerabilities were found in Jetty, a Java based web server     and servlet engine.

    The org.eclipse.jetty.servlets.CGI class has been deprecated. It is potentially     unsafe to use it. The upstream developers of Jetty recommend to use Fast CGI     instead. See also CVE-2023-36479.

    CVE-2023-26048

        In affected versions servlets with multipart support (e.g. annotated with         `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or         `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the         client sends a multipart request with a part that has a name but no         filename and very large content. This happens even with the default         settings of `fileSizeThreshold=0` which should stream the whole part         content to disk.

    CVE-2023-26049

        Nonstandard cookie parsing in Jetty may allow an attacker to smuggle         cookies within other cookies, or otherwise perform unintended behavior by         tampering with the cookie parsing mechanism.

    CVE-2023-40167

        Prior to this version Jetty accepted the `+` character proceeding the         content-length value in a HTTP/1 header field. This is more permissive than         allowed by the RFC and other servers routinely reject such requests with         400 responses. There is no known exploit scenario, but it is conceivable         that request smuggling could result if jetty is used in combination with a         server that does not close the connection after sending such a 400         response.

    CVE-2023-36479

        Users of the CgiServlet with a very specific command structure may have the         wrong command executed. If a user sends a request to a         org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its         name, the servlet will escape the command by wrapping it in quotation         marks. This wrapped command, plus an optional command prefix, will then be         executed through a call to Runtime.exec. If the original binary name         provided by the user contains a quotation mark followed by a space, the         resulting command line will contain multiple tokens instead of one.

    For Debian 10 buster, these problems have been fixed in version     9.4.16-0+deb10u3.

    We recommend that you upgrade your jetty9 packages.

    For the detailed security status of jetty9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/jetty9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0778 advisory.

    Jenkins is a continuous integration server that monitors executions of repeated jobs, such as building a     software project or jobs run by cron.

    Security Fix(es):

    * apache-commons-text: variable interpolation RCE (CVE-2022-42889)

    * google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can     lead to improper authorization (CVE-2020-7692)

    * maven: Block repositories using http by default (CVE-2021-26291)

    * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

    * maven-shared-utils: Command injection via Commandline class (CVE-2022-29599)

    * jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin     (CVE-2023-24422)

    * jenkins: Arbitrary file read vulnerability through the CLI can lead to RCE (CVE-2024-23897)

    * jenkins: cross-site WebSocket hijacking (CVE-2024-23898)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * guava: insecure temporary directory creation (CVE-2023-2976)

    * springframework: Spring Expression DoS Vulnerability (CVE-2023-20861)

    * spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout (CVE-2023-20862)

    * jenkins-2-plugins/JUnit: Stored XSS vulnerability in JUnit Plugin (CVE-2023-25761)

    * jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin     (CVE-2023-25762)

    * jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)

    * jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)

    * Jenkins: Open redirect vulnerability in OpenShift Login Plugin (CVE-2023-37947)

    * jetty: Improper validation of HTTP/1 content-length (CVE-2023-40167)

    * jenkins-plugins: cloudbees-folder: CSRF vulnerability in Folders Plugin (CVE-2023-40337)

    * jenkins-plugins: cloudbees-folder: Information disclosure in Folders Plugin (CVE-2023-40338)

    * jenkins-plugins: config-file-provider: Improper masking of credentials in Config File Provider Plugin     (CVE-2023-40339)

    * jenkins-plugins: blueocean: CSRF vulnerability in Blue Ocean Plugin allows capturing credentials     (CVE-2023-40341)

    * Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

    * Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2539-1 advisory.

  - Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support     (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or     `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request     with a part that has a name but no filename and very large content. This happens even with the default     settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client     may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server     may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some     time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade.
    Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-     negative value, so the whole multipart content is limited (although still read into memory).
    (CVE-2023-26048)

  - Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an     attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering     with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `` (double quote), it     will continue to read the cookie string until it sees a closing quote -- even if a semicolon is     encountered. So, a cookie header such as: `DISPLAY_LANGUAGE=b; JSESSIONID=1337; c=d` will be parsed as     one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate     cookies. This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the     DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into     the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is     enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by     the Jetty server or its logging system. This issue has been addressed in versions 9.4.51, 10.0.14,     11.0.14, and 12.0.0.beta0 and users are advised to upgrade. There are no known workarounds for this issue.
    (CVE-2023-26049)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.2.4 FP4 or 12.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the 7173592 advisory.

  - An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via     a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases     in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all     versions that can change the default behavior of how files are handled. Strapi does not consider this to     be a valid vulnerability. (CVE-2022-29622)

  - Node.js IP package could allow a remote attacker to execute arbitrary code on the system, caused by a     server-side request forgery flaw in the ip.isPublic() function. By sending a specially crafted request     using a hexadecimal representation of a private IP address, an attacker could exploit this vulnerability     to execute arbitrary code on the system and obtain sensitive information. (CVE-2023-42282)   
  - Multiple vendors are vulnerable to a denial of service, caused by a flaw in handling multiplexed streams     in the HTTP/2 protocol. By sending numerous HTTP/2 requests and RST_STREAM frames over multiple streams, a     remote attacker could exploit this vulnerability to cause a denial of service due to server resource     consumption. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
182409	Debian dla-3592 : jetty9 - security update	Nessus	Debian Local Security Checks	2023/10/1	2025/1/22	medium
194435	RHEL 8 : Jenkins and Jenkins-2-plugins (RHSA-2024:0778)	Nessus	Red Hat Local Security Checks	2024/4/29	2024/11/7	critical
177440	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jetty-minimal (SUSE-SU-2023:2539-1)	Nessus	SuSE Local Security Checks	2023/6/20	2023/7/14	medium
213274	IBM Cognos Analytics 11.2.x < 11.2.4 FP4 / 12.0.x < 12.0.4 Multiple Vulnerabilities (7173592)	Nessus	CGI abuses	2024/12/20	2025/4/3	critical

检测

插件搜索

medium

critical

medium

critical