The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0_432.b06-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2024-014 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted     code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21208)

    Vulnerability in Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle     Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and  23. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.
    Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to     some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). (CVE-2024-21210)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Serialization).  Supported versions that are affected are Oracle Java SE:
    8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23; Oracle     GraalVM Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result     in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This     vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2024-21217)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Hotspot).  Supported versions that are affected are Oracle Java SE: 8u421,     8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23;   Oracle GraalVM for JDK: 17.0.12, 21.0.4, 23;   Oracle GraalVM     Enterprise Edition: 20.3.15 and  21.3.11. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK,     Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized     update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE,     Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and     Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2024-21235)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3875-1 advisory.

    Updated to version 11.0.25+9 (October 2024 CPU):

    - CVE-2024-21208: Fixed partial DoS in component Networking (bsc#1231702)
    - CVE-2024-21210: Fixed unauthorized read/write access to data in component Hotspot (bsc#1231711)
    - CVE-2024-21217: Fixed partial DoS in component Serialization (bsc#1231716)
    - CVE-2024-21235: Fixed unauthorized read/write access to data in component Hotspot (bsc#1231719)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3954-1 advisory.

    - Update to upstream tag jdk-21.0.5+13 (October 2024 CPU)
      * Security fixes         + JDK-8307383: Enhance DTLS connections         + JDK-8311208: Improve CDS Support         + JDK-8328286, CVE-2024-21208, bsc#1231702: Enhance HTTP client         + JDK-8328544, CVE-2024-21210, bsc#1231711: Improve handling of vectorization         + JDK-8328726: Better Kerberos support         + JDK-8331446, CVE-2024-21217, bsc#1231716: Improve deserialization support         + JDK-8332644, CVE-2024-21235, bsc#1231719: Improve graph optimizations         + JDK-8335713: Enhance vectorization analysis

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7096-1 advisory.

    Andy Boothe discovered that the Networking component of OpenJDK 8 did not properly handle access under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to cause a denial of service.

    (CVE-2024-21208)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly handle vectorization under     certain circumstances. An unauthenticated

    attacker could possibly use this issue to access unauthorized resources

    and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of OpenJDK 8 did not

    properly handle deserialization under certain circumstances. An

    unauthenticated attacker could possibly use this issue to cause a denial of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of OpenJDK 8 was not properly bounding certain UTF-8 strings,     which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of     service or execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 8 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. This issue was only addressed in Ubuntu 16.04 LTS.
    (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly perform range check     elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary     code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS.

    (CVE-2024-21140)

    Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8 incorrectly performed header     validation in the Pack200 archive format. An attacker could possibly use this issue to cause a denial of     service. This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21144)

    Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in     Ubuntu

    16.04 LTS. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled memory when performing range     check elimination under certain circumstances. An attacker could possibly use this issue to cause a denial     of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only addressed in     Ubuntu 16.04 LTS.

    (CVE-2024-21147)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled certain exceptions with     specially crafted long messages. An attacker could possibly use this issue to cause a denial of service.
    This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21011)

    Vladimir Kondratyev discovered that the Hotspot component of OpenJDK 8 incorrectly handled address offset     calculations in the C1 compiler. An attacker could possibly use this issue to cause a denial of service or     execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21068)

    Yakov Shafranovich discovered that OpenJDK 8 did not properly manage memory in the Pack200 archive format.
    An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in     Ubuntu 16.04 LTS. (CVE-2024-21085)

    It was discovered that the Hotspot component of OpenJDK 8 incorrectly handled array accesses in the C2     compiler. An attacker could possibly use this issue to cause a denial of service or execute arbitrary     code. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-21094)

    Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly handled array accesses in the C1     compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code     or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20918)

    It was discovered that the Hotspot component of OpenJDK 8 did not properly verify bytecode in certain     situations. An attacker could possibly use this issue to bypass Java sandbox restrictions. This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20919)

    It was discovered that the Hotspot component of OpenJDK 8 had an optimization flaw when generating range     check loop predicates. An attacker could possibly use this issue to cause a denial of service, execute     arbitrary code or bypass Java sandbox restrictions. This issue was only

    addressed in Ubuntu 16.04 LTS. (CVE-2024-20921)

    Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain options in the Nashorn JavaScript     subcomponent. An attacker could possibly use this issue to execute arbitrary code. This issue was only

    addressed in Ubuntu 16.04 LTS. (CVE-2024-20926)

    It was discovered that OpenJDK 8 could produce debug logs that contained private keys used for digital     signatures. An attacker could possibly use this issue to obtain sensitive information. This issue was only     addressed in Ubuntu 16.04 LTS. (CVE-2024-20945)

    Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a timing side-channel and incorrectly     handled RSA padding. A remote attacker could possibly use this issue to recover sensitive information.
    This

    issue was only addressed in Ubuntu 16.04 LTS. (CVE-2024-20952)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7098-1 advisory.

    Andy Boothe discovered that the Networking component of OpenJDK 17 did not properly handle access under     certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of     service. (CVE-2024-21208)

    It was discovered that the Hotspot component of OpenJDK 17 did not properly handle vectorization under     certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of OpenJDK 17 did not properly handle deserialization     under certain circumstances. An

    unauthenticated attacker could possibly use this issue to cause a denial

    of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of OpenJDK 17 was not properly bounding certain UTF-8     strings, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a     denial of service or execute arbitrary code. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21131)

    It was discovered that the Hotspot component of OpenJDK 17 could be made to run into an infinite loop. If     an automated system were tricked into processing excessively large symbols, an attacker could possibly use     this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21138)

    It was discovered that the Hotspot component of OpenJDK 17 did not properly perform range check     elimination. An attacker could possibly use this issue to cause a denial of service, execute arbitrary     code or bypass Java sandbox restrictions. This issue was only addressed in Ubuntu 18.04 LTS.
    (CVE-2024-21140)

    Sergey Bylokhov discovered that OpenJDK 17 did not properly manage memory when handling 2D images. An     attacker could possibly use this issue to obtain sensitive information. This issue was only addressed in     Ubuntu 18.04 LTS. (CVE-2024-21145)

    It was discovered that the Hotspot component of OpenJDK 17 incorrectly handled memory when performing     range check elimination under certain circumstances. An attacker could possibly use this issue to cause a     denial of service, execute arbitrary code or bypass Java sandbox restrictions. This issue was only     addressed in Ubuntu 18.04 LTS. (CVE-2024-21147)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3963-1 advisory.

    - Update to upstream tag jdk-17.0.13+11 (October 2024 CPU)
      * Security fixes         + JDK-8307383: Enhance DTLS connections         + JDK-8290367, JDK-8332643: Update default value and extend the           scope of com.sun.jndi.ldap.object.trustSerialData system property         + JDK-8328286, CVE-2024-21208, bsc#1231702: Enhance HTTP client         + JDK-8328544, CVE-2024-21210, bsc#1231711: Improve handling of vectorization         + JDK-8328726: Better Kerberos support         + JDK-8331446, CVE-2024-21217, bsc#1231716: Improve deserialization support         + JDK-8332644, CVE-2024-21235, bsc#1231719: Improve graph optimizations         + JDK-8335713: Enhance vectorization analysis

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4202-1 advisory.

    Update to version jdk8u432 (icedtea-3.33.0):
    - CVE-2024-21208: Fixed partial DoS in component Networking (bsc#1231702,JDK-8328286)
    - CVE-2024-21210: Fixed unauthorized update, insert or delete access to some of Oracle Java SE accessible     data in component Hotspot (bsc#1231711,JDK-8328544)
    - CVE-2024-21217: Fixed partial DoS in component Serialization (bsc#1231716,JDK-8331446)
    - CVE-2024-21235: Fixed unauthorized read/write access to data in component Hotspot     (bsc#1231719,JDK-8332644)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4252-1 advisory.

    Updated to Java 8.0 Service Refresh 8 Fix Pack 35 with Oracle October 15 2024 CPU (bsc#1232064):
    - CVE-2024-21208: Fixed partial DoS in component Networking (bsc#1231702,JDK-8328286)
    - CVE-2024-21210: Fixed unauthorized update, insert or delete access to some of Oracle Java SE accessible     data in component Hotspot (bsc#1231711,JDK-8328544)
    - CVE-2024-21217: Fixed partial DoS in component Serialization (bsc#1231716,JDK-8331446)
    - CVE-2024-21235: Fixed unauthorized read/write access to data in component Hotspot     (bsc#1231719,JDK-8332644)

    Other issues fixed in past releases:
    - CVE-2024-3933: Fixed evaluate constant byteLenNode of arrayCopyChild (bsc#1225470)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0435-1 advisory.

    Update to OpenJDK 8u442 build 06 with OpenJ9 0.49.0 virtual machine.

    - CVE-2024-21235: unauthorized read/write access to data through the Hotspot component. (bsc#1231719)
    - CVE-2024-21217: partial denial-of-service through the Serialization component. (bsc#1231716)
    - CVE-2024-21210: unauthorized read/write access to data through the Hotspot component. (bsc#1231711)
    - CVE-2024-21208: partial denial-of-service through the Networking component. (bsc#1231702)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7339-1 advisory.

    Andy Boothe discovered that the Networking component of CRaC JDK 21 did not properly handle access under     certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of     service. (CVE-2024-21208)

    It was discovered that the Hotspot component of CRaC JDK 21 did not properly handle vectorization under     certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2024-21210, CVE-2024-21235)

    It was discovered that the Serialization component of CRaC JDK 21 did not properly handle deserialization     under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial     of service. (CVE-2024-21217)

    It was discovered that the Hotspot component of CRaC JDK 21 did not properly handle API access under     certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized     resources and expose sensitive information. (CVE-2025-21502)

    In addition to security fixes, the updated packages contain bug fixes, new features, and possibly     incompatible changes.

    Please see the following for more information:
    https://openjdk.org/groups/vulnerability/advisories/2024-10-15     https://openjdk.org/groups/vulnerability/advisories/2025-01-21

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8117 advisory.

    [1.8.0.432.b06-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:1.8.0.432.b06-1]
    - Update to shenandoah-jdk8u432-b06 (GA)
    - Update release notes for shenandoah-8u432-b06.
    - Drop JDK-828109{6,7,8}/PR3836 patch following integration of upstream version
    - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
    - Bump version of bundled zlib to 1.3.1 following JDK-8324632
    - Include backport of JDK-8328999 to update giflib to 5.2.2
    - Bump version of bundled giflib to 5.2.2 following JDK-8328999
    - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
    - Sync the copy of the portable specfile with the latest update
    - Resolves: RHEL-58791
    - Resolves: RHEL-62278
    - Resolves: RHEL-61285
    - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
210079	Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2024-014)	Nessus	Amazon Linux Local Security Checks	2024/11/1	2024/12/11	medium
210106	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : java-11-openjdk (SUSE-SU-2024:3875-1)	Nessus	SuSE Local Security Checks	2024/11/2	2024/11/2	medium
210711	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : java-21-openjdk (SUSE-SU-2024:3954-1)	Nessus	SuSE Local Security Checks	2024/11/9	2024/12/12	medium
210735	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 8 vulnerabilities (USN-7096-1)	Nessus	Ubuntu Local Security Checks	2024/11/11	2025/6/18	high
210738	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : OpenJDK 17 vulnerabilities (USN-7098-1)	Nessus	Ubuntu Local Security Checks	2024/11/11	2025/6/18	medium
210763	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : java-17-openjdk (SUSE-SU-2024:3963-1)	Nessus	SuSE Local Security Checks	2024/11/12	2024/12/12	medium
212293	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-openjdk (SUSE-SU-2024:4202-1)	Nessus	SuSE Local Security Checks	2024/12/11	2024/12/11	medium
212296	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2024:4252-1)	Nessus	SuSE Local Security Checks	2024/12/11	2025/1/13	high
216184	SUSE SLES15 / openSUSE 15 Security Update : java-1_8_0-openj9 (SUSE-SU-2025:0435-1)	Nessus	SuSE Local Security Checks	2025/2/12	2025/2/12	medium
232564	Ubuntu 24.10 : CRaC JDK 21 vulnerabilities (USN-7339-1)	Nessus	Ubuntu Local Security Checks	2025/3/11	2025/3/11	medium
209305	Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2024-8117)	Nessus	Oracle Linux Local Security Checks	2024/10/18	2025/9/11	high

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

high

medium

medium

high