The version of Amazon Corretto installed on the remote host is prior to 8 < 8.332.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2022-Apr-19 advisory.

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - xml/jaxp (CVE-2022-21426)

  - core-libs/java.lang (CVE-2022-21434)

  - security-libs/java.security (CVE-2022-21443, CVE-2022-21476)

  - core-libs/javax.naming (CVE-2022-21496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1440 advisory.

    [1:11.0.15.0.9-2.0.1]
    - link atomic for ix86 build

    [1:11.0.15.0.9-2]
    - Add JDK-8284920 fix for XPath regression
    - Related: rhbz#2073422

    [1:11.0.15.0.9-2]
    - Remove security items from release notes that were only in 17u and N/A for 11u
    - Related: rhbz#2073422

    [1:11.0.15.0.9-1]
    - Update to jdk-11.0.15.0+9
    - Update release notes to 11.0.15.0+9
    - Switch to GA mode for release
    - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
    - Resolves: rhbz#2073422

    [1:11.0.15.0.8-0.1.ea]
    - Update to jdk-11.0.15.0+8
    - Update release notes to 11.0.15.0+8
    - Resolves: rhbz#2047531

    [1:11.0.15.0.1-0.1.ea]
    - Update to jdk-11.0.15.0+1
    - Update release notes to 11.0.15.0+1
    - Switch to EA mode for 11.0.15 pre-release builds.
    - Related: rhbz#2047531

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1491 advisory.

    [1:1.8.0.332.b09-1]
    - Update to shenandoah-jdk8u332-b09 (GA)
    - Update release notes for 8u332-b09.
    - Switch to GA mode for final release.
    - This tarball is embargoed until 2022-04-19 @ 1pm PT.
    - Resolves: rhbz#2073422

    [1:1.8.0.332.b06-0.1.ea]
    - Update to shenandoah-jdk8u332-b06 (EA)
    - Update release notes for shenandoah-8u332-b06.
    - Switch to EA mode.
    - Remove JDK-8279077 patch now upstream.
    - Related: rhbz#2073422

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1487 advisory.

    [1:1.8.0.332.b09-1]
    - Update to shenandoah-jdk8u332-b09 (GA)
    - Update release notes for 8u332-b09.
    - Switch to GA mode for final release.
    - This tarball is embargoed until 2022-04-19 @ 1pm PT.
    - Resolves: rhbz#2073422

    [1:1.8.0.332.b06-0.1.ea]
    - Update to shenandoah-jdk8u332-b06 (EA)
    - Update release notes for shenandoah-8u332-b06.
    - Resolves: rhbz#2047529

    [1:1.8.0.332.b01-0.1.ea]
    - Update to shenandoah-jdk8u332-b01 (EA)
    - Update release notes for shenandoah-8u332-b01.
    - Switch to EA mode.
    - Related: rhbz#2047529

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1488 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476)

    * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)     (CVE-2022-21426)

    * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)     (CVE-2022-21434)

    * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)

    * OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4959 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR7-FP10.

    Security Fix(es):

    * OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

    * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)     (CVE-2022-21434)

    * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)

    * OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:2137 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3957:12 advisory.

    * OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476)
      * OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504)     (CVE-2022-21426)
      * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)     (CVE-2022-21434)
      * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)
      * OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is 7 prior to 7u331 / 8 prior to 8u322 / 11.0.0 prior to 11.0.14 / 13.0.0 prior to 13.0.10 / 15.0.0 prior to 15.0.6 / 17.0.0 prior to 17.0.2 / 18.0.0 prior to 18.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022-04-19 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,     17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise     Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients     running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code     (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability     can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies     data to the APIs. (CVE-2022-21476)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle     GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21449)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2,     18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE,     Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized     ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise     Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java     Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes     from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by     using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2022-21426)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,     17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21434)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14,     17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21443)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159899	Amazon Corretto Java 8.x < 8.332.08.1 Multiple Vulnerabilities	Nessus	Misc.	2022/4/19	2024/11/27	medium
160050	Oracle Linux 7 : java-11-openjdk (ELSA-2022-1440)	Nessus	Oracle Linux Local Security Checks	2022/4/21	2024/11/27	medium
160186	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2022-1491)	Nessus	Oracle Linux Local Security Checks	2022/4/25	2024/11/27	medium
160191	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2022-1487)	Nessus	Oracle Linux Local Security Checks	2022/4/25	2024/11/27	medium
160210	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:1488)	Nessus	Red Hat Local Security Checks	2022/4/26	2024/11/27	medium
161967	RHEL 7 : java-1.8.0-ibm (RHSA-2022:4959)	Nessus	Red Hat Local Security Checks	2022/6/8	2024/11/7	medium
203865	Photon OS 3.0: Openjdk11 PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/11/25	high
167673	AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2022:2137)	Nessus	Alma Linux Local Security Checks	2022/11/16	2024/11/26	medium
291918	MiracleLinux 9 : java-1.8.0-openjdk-1.8.0.332.b09-1.el9 (AXSA:2022-3957:12)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
159948	OpenJDK 7 <= 7u331 / 8 <= 8u322 / 11.0.0 <= 11.0.14 / 13.0.0 <= 13.0.10 / 15.0.0 <= 15.0.6 / 17.0.0 <= 17.0.2 / 18.0.0 <= 18.0.0 Multiple Vulnerabilities (2022-04-19)	Nessus	Misc.	2022/4/20	2026/11/4	high
164948	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2022-1633)	Nessus	Amazon Linux Local Security Checks	2022/9/12	2024/12/11	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

medium

medium

high

high