The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4305 advisory.

    [1:11.0.9.11-0]
    - Update to jdk-11.0.9+11
    - Update release notes for 11.0.9 release.
    - Add backport of JDK-8254177 to update to tzdata 2020b
    - Require tzdata 2020b due to resource changes in JDK-8254177
    - Delay tzdata 2020b dependency until tzdata update has shipped.
    - This tarball is embargoed until 2020-10-20 @ 1pm PT.
    - Resolves: rhbz#1876665

    [1:11.0.9.10-0.0.ea]
    - Update to jdk-11.0.9+10 (EA)
    - With Shenandoah now upstream in OpenJDK 11, we can use jdk-updates/jdk11 directly
    - Following JDK-8005165, class data sharing can be enabled on all JIT architectures
    - Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
    - Remove JDK-8252258/RH1868406 now applied upstream.
    - Improve quoting of vendor name
    - Resolves: rhbz#1876665

    [1:11.0.9.10-0.0.ea]
    - Set vendor property and vendor URLs
    - Made URLs to be preconfigured by OS
    - Moved vendor_version_string to a better place
    - Resolves: rhbz#1876665

    [1:11.0.9.10-0.0.ea]
    - Update static-libs packaging to new layout
    - Resolves: rhbz#1876665

    [1:11.0.9.1-0.1.ea]
    - Cleanup architecture and JVM feature handling in preparation for using upstreamed Shenandoah.
    - Resolves: rhbz#1876665

    [1:11.0.9.1-0.0.ea]
    - Update to shenandoah-jdk-11.0.9+1 (EA)
    - Switch to EA mode for 11.0.9 pre-release builds.
    - JDK-8245832 increases the set of static libraries, so try and include them all with a wildcard.
    - Resolves: rhbz#1876665

    [1:11.0.8.10-2]
    - Add JDK-8252258 to return default vendor to the original value of 'Oracle Corporation'
    - Include a test in the RPM to check the build has the correct vendor information.
    - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
    - Resolves: rhbz#1873390

    [1:11.0.8.10-1]
    - Added scriplet to handle dir->symlink change when updating el7->el8
    - Symlink hunk moved behind the main copy logic, to be more user-friendly with multiple installs
    - Resolves: rhbz#1871709

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4347 advisory.

    [1:1.8.0.272.b10-1]
    - Add backport of JDK-8215727: 'Restore JFR thread sampler loop to old / previous behaviour'
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b10-0]
    - Update to aarch64-shenandoah-jdk8u272-b10.
    - Switch to GA mode for final release.
    - Update release notes for 8u272 release.
    - Add backport of JDK-8254177 to update to tzdata 2020b
    - Require tzdata 2020b due to resource changes in JDK-8254177
    - Delay tzdata 2020b dependency until tzdata update has shipped.
    - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
    - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
    - This tarball is embargoed until 2020-10-20 @ 1pm PT.
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.1.ea]
    - Include a test in the RPM to check the build has the correct vendor information.
    - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
    - Improve quoting of vendor name
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.1.ea]
    - Set vendor property and vendor URLs
    - Made URLs to be preconfigured by OS
    - Resolves: rhbz#1876665

    [1:1.8.0.272.b09-0.0.ea]
    - Update to aarch64-shenandoah-jdk8u272-b09 (EA).
    - Switch to EA mode.
    - Add debugging output for build.
    - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
    - Remove JDK-8154313 backport now applied upstream.
    - Change target from 'zip-docs' to 'docs-zip', which is the naming used upstream.
    - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
    - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
    - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
    - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
    - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
    - Remove JDK-8165996/PR3506/RH1760437 as now applied upstream.
    - Resolves: rhbz#1876665

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4347 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792)

    * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)     (CVE-2020-14797)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    * OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization,     8236862) (CVE-2020-14779)

    * OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) (CVE-2020-14796)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4350 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)

    * OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)     (CVE-2020-14782)

    * OpenJDK: Integer overflow leading to out-of-bounds access (Hotspot, 8241114) (CVE-2020-14792)

    * OpenJDK: Incomplete check for invalid characters in URI to path conversion (Libraries, 8242685)     (CVE-2020-14797)

    * OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)

    * OpenJDK: High memory usage during deserialization of Proxy class with many interfaces (Serialization,     8236862) (CVE-2020-14779)

    * OpenJDK: Missing permission check in path to URI conversion (Libraries, 8242680) (CVE-2020-14796)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * JDK-8215727: Restore JFR thread sampler loop to old / previous behavior (BZ#1889532)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New in release OpenJDK 8u272 (2020-10-20):
===========================================

Full versions of these release notes can be found at :

- https://bitly.com/openjdk8u272

- https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u272.txt

## New features

  - JDK-8245468: Add TLSv1.3 implementation classes from     11.0.7

## Security fixes

  - JDK-8233624: Enhance JNI linkage

  - JDK-8236196: Improve string pooling

  - JDK-8236862, CVE-2020-14779: Enhance support of Proxy     class

  - JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts

  - JDK-8237995, CVE-2020-14782: Enhance certificate     processing

  - JDK-8240124: Better VM Interning

  - JDK-8241114, CVE-2020-14792: Better range handling

  - JDK-8242680, CVE-2020-14796: Improved URI Support

  - JDK-8242685, CVE-2020-14797: Better Path Validation

  - JDK-8242695, CVE-2020-14798: Enhanced buffer support

  - JDK-8243302: Advanced class supports

  - JDK-8244136, CVE-2020-14803: Improved Buffer supports

  - JDK-8244479: Further constrain certificates

  - JDK-8244955: Additional Fix for JDK-8240124

  - JDK-8245407: Enhance zoning of times

  - JDK-8245412: Better class definitions

  - JDK-8245417: Improve certificate chain handling

  - JDK-8248574: Improve jpeg processing

  - JDK-8249927: Specify limits of     jdk.serialProxyInterfaceLimit

  - JDK-8253019: Enhanced JPEG decoding

## JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b

Following JDK's update to tzdata2020b, the long-obsolete files pacificnew and systemv have been removed. As a result, the 'US/Pacific-New' zone name declared in the pacificnew data file is no longer available for use.

Information regarding the update can be viewed at https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New in release OpenJDK 11.0.9 (2020-10-20):
===========================================

Full versions of these release notes can be found at :

- https://bitly.com/openjdk1109

- https://builds.shipilev.net/backports-monitor/release-notes-11.0.9.txt

## Security fixes

  - JDK-8233624: Enhance JNI linkage

  - JDK-8236196: Improve string pooling

  - JDK-8236862, CVE-2020-14779: Enhance support of Proxy     class

  - JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts

  - JDK-8237995, CVE-2020-14782: Enhance certificate     processing

  - JDK-8240124: Better VM Interning

  - JDK-8241114, CVE-2020-14792: Better range handling

  - JDK-8242680, CVE-2020-14796: Improved URI Support

  - JDK-8242685, CVE-2020-14797: Better Path Validation

  - JDK-8242695, CVE-2020-14798: Enhanced buffer support

  - JDK-8243302: Advanced class supports

  - JDK-8244136, CVE-2020-14803: Improved Buffer supports

  - JDK-8244479: Further constrain certificates

  - JDK-8244955: Additional Fix for JDK-8240124

  - JDK-8245407: Enhance zoning of times

  - JDK-8245412: Better class definitions

  - JDK-8245417: Improve certificate chain handling

  - JDK-8248574: Improve jpeg processing

  - JDK-8249927: Specify limits of     jdk.serialProxyInterfaceLimit

  - JDK-8253019: Enhanced JPEG decoding

## JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b

Following JDK's update to tzdata2020b, the long-obsolete files pacificnew and systemv have been removed. As a result, the 'US/Pacific-New' zone name declared in the pacificnew data file is no longer available for use.

Information regarding the update can be viewed at https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4607-2 advisory.

    USN-4607-1 fixed vulnerabilities and added features in OpenJDK. Unfortunately, that update introduced a     regression that could cause TLS connections with client certificate authentication to fail in some     situations. This update fixes the problem.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-ibm fixes the following issues :

Update to Java 8.0 Service Refresh 6 Fix Pack 20 [bsc#1180063,bsc#1177943] CVE-2020-14792 CVE-2020-14797 CVE-2020-14781 CVE-2020-14779 CVE-2020-14798 CVE-2020-14796 CVE-2020-14803

  - Class libraries :

  - SOCKETADAPTOR$SOCKETINPUTSTREAM.READ is blocking for     more time that the set timeout

  - Z/OS specific C function send_file is changing the file     pointer position

  - Java Virtual Machine :

  - Crash on iterate java stack

  - Java process hang on SIGTERM

  - JIT Compiler :

  - JMS performance regression from JDK8 SR5 FP40 TO FP41

  - Class Libraries :

  - z15 high utilization following Z/VM and Linux migration     from z14 To z15

  - Java Virtual Machine :

  - Assertion failed when trying to write a class file

  - Assertion failure at modronapi.cpp

  - Improve the performance of defining and finding classes

  - JIT Compiler :

  - An assert in ppcbinaryencoding.cpp may trigger when     running with traps disabled on power

  - AOT field offset off by n bytes

  - Segmentation fault in jit module on ibm z platform

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). (CVE-2020-14796)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 5.19.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.2 advisory.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

  - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4     bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of     service. (CVE-2020-10769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
141813	Oracle Linux 8 : java-11-openjdk (ELSA-2020-4305)	Nessus	Oracle Linux Local Security Checks	2020/10/22	2024/10/22	medium
141935	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2020-4347)	Nessus	Oracle Linux Local Security Checks	2020/10/27	2024/10/22	medium
142004	RHEL 8 : java-1.8.0-openjdk (RHSA-2020:4347)	Nessus	Red Hat Local Security Checks	2020/10/28	2024/11/7	medium
142009	RHEL 7 : java-1.8.0-openjdk (RHSA-2020:4350)	Nessus	Red Hat Local Security Checks	2020/10/28	2024/11/7	medium
146641	EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2021-1310)	Nessus	Huawei Local Security Checks	2021/2/22	2024/1/22	high
142191	Fedora 31 : 1:java-1.8.0-openjdk (2020-febe36c3ac)	Nessus	Fedora Local Security Checks	2020/11/2	2024/2/13	medium
142195	Fedora 32 : 1:java-11-openjdk (2020-fdc79d8e5b)	Nessus	Fedora Local Security Checks	2020/11/2	2024/2/12	medium
142865	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenJDK regressions (USN-4607-2)	Nessus	Ubuntu Local Security Checks	2020/11/12	2024/10/29	medium
143184	openSUSE Security Update : java-11-openjdk (openSUSE-2020-1984)	Nessus	SuSE Local Security Checks	2020/11/23	2024/2/8	medium
143779	SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2020:3191-1)	Nessus	SuSE Local Security Checks	2020/12/9	2022/12/5	high
144761	SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0032-1)	Nessus	SuSE Local Security Checks	2021/1/6	2022/12/7	medium
252148	Linux Distros Unpatched Vulnerability : CVE-2020-14796	Nessus	Misc.	2025/8/19	2026/7/16	low
164578	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.2)	Nessus	Misc.	2022/9/1	2025/7/22	high

检测

插件搜索

medium

medium

medium

medium

high

medium

medium

medium

medium

high

medium

low

high