The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1512 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1506 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - OpenJDK: Incorrect bounds checks in NIO Buffers     (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in     MethodType.readObject() (Libraries, 8235274)     (CVE-2020-2805)

  - OpenJDK: Unexpected exceptions raised by     DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

  - OpenJDK: Re-use of single TLS session for new     connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer     (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency,     8236201) (CVE-2020-2830)

  - OpenJDK: Misplaced regular expression syntax error check     in RegExpScanner (Scripting, 8223898) (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in     regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to     uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in     ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

Several vulnerabilities have been discovered in the OpenJDK Java runtime, resulting in denial of service, insecure TLS handshakes, bypass of sandbox restrictions or HTTP response splitting attacks.

An update of the openjdk11 package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1509 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Java SE accessible data as well as unauthorized     read access to a subset of Java SE accessible data. Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java     applets. It can also be exploited by supplying data to APIs in the specified Component without using     sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
    (CVE-2020-2767)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result     in unauthorized read access to a subset of Java SE accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2778)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE product of Oracle Java SE (component: JSSE). Supported versions that are     affected are Java SE: 11.0.6 and 14. Easily exploitable vulnerability allows unauthenticated attacker with     network access via HTTPS to compromise Java SE. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Java SE accessible data.
    Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component     without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web     service. (CVE-2020-2816)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-1.7.0-openjdk installed on the remote host is prior to 1.7.0.261-2.6.22.1.83. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1365 advisory.

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2756)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2757)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. CVSS 3.0 Base Score 3.7 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2773)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2781)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0     Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). (CVE-2020-2800)

    A flaw was found in the boundary checks in the java.nio buffer classes in the Libraries component of     OpenJDK, where it is bypassed in certain cases. This flaw allows an untrusted Java application or applet o     bypass Java sandbox restrictions. (CVE-2020-2803)

    A flaw was found in the way the readObject() method of the MethodType class in the Libraries component of     OpenJDK checked argument types. This flaw allows an untrusted Java application or applet to bypass Java     sandbox restrictions. (CVE-2020-2805)

    Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector:
    (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). (CVE-2020-2830)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2241 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP10.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-1_8_0-openjdk to version jdk8u252 fixes the following issues :

CVE-2020-2754: Forward references to Nashorn (bsc#1169511)

CVE-2020-2755: Improve Nashorn matching (bsc#1169511)

CVE-2020-2756: Better mapping of serial ENUMs (bsc#1169511)

CVE-2020-2757: Less Blocking Array Queues (bsc#1169511)

CVE-2020-2773: Better signatures in XML (bsc#1169511)

CVE-2020-2781: Improve TLS session handling (bsc#1169511)

CVE-2020-2800: Better Headings for HTTP Servers (bsc#1169511)

CVE-2020-2803: Enhance buffering of byte buffers (bsc#1169511)

CVE-2020-2805: Enhance typing of methods (bsc#1169511)

CVE-2020-2830: Better Scanner conversions (bsc#1169511)

Ignore whitespaces after the header or footer in PEM X.509 cert (bsc#1171352)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.7+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1410 advisory.

    Further information about this update can be found in the Corretto 11 change log     (https://github.com/corretto/corretto-11/blob/develop/CHANGELOG.md)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is prior to 11 < 11.0.7.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2020-Apr-14 advisory.

  - core-libs/javax.script (CVE-2020-2754, CVE-2020-2755)

  - core-libs/java.io:serialization (CVE-2020-2756, CVE-2020-2757)

  - security-libs/javax.net.ssl (CVE-2020-2767, CVE-2020-2778, CVE-2020-2816)

  - security-libs/javax.xml.crypto (CVE-2020-2773)

  - security-libs/java.security (CVE-2020-2781)

  - core-libs/java.net (CVE-2020-2800)

  - core-libs/java.nio (CVE-2020-2803)

  - core-libs/java.io (CVE-2020-2805)

  - core-libs/java.util (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Java installed on the remote host is prior to 7.0 < 7.0.10.65 / 7.1 < 7.1.4.65 / 8.0 < 8.0.6.25. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle April 14 2020 CPU advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2754, CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2756, CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to     client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java     SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Lightweight HTTP     Server). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded:
    8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well     as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This     vulnerability can only be exploited by supplying data to APIs in the specified Component without using     Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
    (CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other     than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE,     Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2020-2803, CVE-2020-2805)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency).
    Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-029:05 advisory.

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)
      * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)
      * OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)
      * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)
      * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)
      * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)
      * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)
      * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752246531 advisory.

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as     unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client     and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start     applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as     through a web service. (CVE-2020-14556)

  - Vulnerability in the Java SE product of Oracle Java SE (component: ImageIO). Supported versions that are     affected are Java SE: 11.0.7 and 14.0.1. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability     can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note:
    This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2020-14562)

  - Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are     affected are Java SE: 11.0.7 and 14.0.1. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Java SE accessible     data. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through     sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying     data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed     Java applets, such as through a web service. (CVE-2020-14573)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to     compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Java SE, Java SE Embedded accessible data. Note: Applies to client and server     deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and     sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component     without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web     service. (CVE-2020-14577)

  - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u261, 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251.
    Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple     protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a     person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may     significantly impact additional products. Successful attacks of this vulnerability can result in takeover     of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code     installed by an administrator). (CVE-2020-14583)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135775	RHEL 7 : java-1.8.0-openjdk (RHSA-2020:1512)	Nessus	Red Hat Local Security Checks	2020/4/21	2024/11/7	high
135776	RHEL 6 : java-1.8.0-openjdk (RHSA-2020:1506)	Nessus	Red Hat Local Security Checks	2020/4/21	2024/11/7	high
135890	Scientific Linux Security Update : java-1.8.0-openjdk on SL6.x i386/x86_64 (20200421)	Nessus	Scientific Linux Local Security Checks	2020/4/22	2024/3/15	high
135982	Debian DSA-4662-1 : openjdk-11 - security update	Nessus	Debian Local Security Checks	2020/4/27	2024/3/14	high
136100	Photon OS 3.0: Openjdk11 PHSA-2020-3.0-0084	Nessus	PhotonOS Local Security Checks	2020/4/29	2025/8/22	critical
136196	CentOS 7 : java-11-openjdk (RHSA-2020:1509)	Nessus	CentOS Local Security Checks	2020/5/1	2024/10/9	high
136626	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2020-1365)	Nessus	Amazon Linux Local Security Checks	2020/5/15	2024/12/11	high
136738	RHEL 8 : java-1.8.0-ibm (RHSA-2020:2241)	Nessus	Red Hat Local Security Checks	2020/5/20	2024/11/7	high
137598	SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2020:1569-1)	Nessus	SuSE Local Security Checks	2020/6/18	2022/5/13	high
135595	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1410)	Nessus	Amazon Linux Local Security Checks	2020/4/16	2024/12/11	high
159438	Amazon Corretto Java 11.x < 11.0.7.10.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/1	2022/5/6	high
160353	IBM Java 7.0 < 7.0.10.65 / 7.1 < 7.1.4.65 / 8.0 < 8.0.6.25 Multiple Vulnerabilities	Nessus	Misc.	2022/4/29	2022/5/6	high
294162	MiracleLinux 7 : java-1.7.0-openjdk-1.7.0.261-2.6.22.2.0.1.el7.AXS7 (AXSA:2020-029:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
360784	AlmaLinux 9.2 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-demo / java-11-openjdk-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752246531)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/2	high

检测

插件搜索

high

high

high

high

critical

high

high

high

high

high

high

high

high

high