The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5696 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07).
    (BZ#2084648)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-8] (BZ#2099911)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-8]     (BZ#2108564)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-8]     (BZ#2108566)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:5726 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1,     17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1     Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
    (CVE-2022-21540)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1,     17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector:
    (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). (CVE-2022-21541)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM     Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete     access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1     Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
    (CVE-2022-21549)

  - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious     XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler     and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being     retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes     (such as OpenJDK) include repackaged copies of Xalan. (CVE-2022-34169)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5192 advisory.

    Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in the     execution of arbitrary Java bytecode or the bypass of the Java sandbox. For the stable distribution     (bullseye), this problem has been fixed in version 17.0.4+8-1~deb11u1. We recommend that you upgrade your     openjdk-17 packages. For the detailed security status of openjdk-17 please refer to its security tracker     page at: https://security-tracker.debian.org/tracker/openjdk-17

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2819-1 advisory.

    - Updated to version jdk8u345 (icedtea-3.24.0)
        - CVE-2022-21540: Fixed a potential Java sandbox bypass (bsc#1201694).
        - CVE-2022-21541: Fixed a potential Java sandbox bypass (bsc#1201692).
        - CVE-2022-34169: Fixed an issue where arbitrary bytecode could           be executed via a malicious stylesheet (bsc#1201684).

    - Non-security fixes:
        - Allowed for customization of PKCS12 keystores (bsc#1195163).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2949-1 advisory.

    - Updated to Java 8.0 Service Refresh 7 Fix Pack 11 (bsc#1202427):
      - CVE-2022-34169: Fixed an integer truncation issue in the Xalan         Java XSLT library that occurred when processing malicious         stylesheets (bsc#1201684).
      - CVE-2022-21549: Fixed an issue that could lead to computing         negative random exponentials (bsc#1201685).
      - CVE-2022-21541: Fixed a potential bypass of sandbox restrictions         in the Hotspot component (bsc#1201692).
      - CVE-2022-21540: Fixed a potential bypass of sandbox restrictions         in the Hotspot component (bsc#1201694).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-119 advisory.

    Generated code produced by C1 may leak a package-private class to a class from a different package.
    (CVE-2022-21540)

    MethodHandle.invokeBasic() method can be accessed on byte code level from an arbitrary class.
    (CVE-2022-21541)

    The Xalan Java XSLT library has an integer truncation issue when processing malicious stylesheets. This     can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary     Java bytecode. (CVE-2022-34169)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-113 advisory.

    Generated code produced by C1 may leak a package-private class to a class from a different package.
    (CVE-2022-21540)

    MethodHandle.invokeBasic() method can be accessed on byte code level from an arbitrary class.
    (CVE-2022-21541)

    computeNextExponential sometimes returns negative numbers contrary to the documentation. (CVE-2022-21549)

    The Xalan Java XSLT library has an integer truncation issue when processing malicious stylesheets. This     can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary     Java bytecode. (CVE-2022-34169)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1,     17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
    Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2022-21540)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1,     17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through     a web service which supplies data to the APIs. (CVE-2022-21541)

  - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious     XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler     and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being     retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes     (such as OpenJDK) include repackaged copies of Xalan. (CVE-2022-34169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-151 advisory.

    Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count (should be     charactercount). (CVE-2022-21618)

    Title: Improve NTLM supportwriteSecurityBuffer() writes a serialized security buffer to be used for     NTLMauth. One of the fields that are serialized is a hostname provided by thename resolver. If this     hostname is very long, integer truncation occurs,which would allow a malicious hostname to be partially     re-interpreted assomething else following a hostname, once the security buffer is deserializedon the other     size. (CVE-2022-21619)

    Title: Improve JNDI lookupsJNDI DNS port numbers can be easily guessed and should be more random.
    (CVE-2022-21624)

    Title: Key X509 usagesDecoding of X509 keys may use excessive amount of heap memory. (CVE-2022-21626)

    Title: Better HttpServer serviceHttpServer eagerly accepts connections which may exceed the limit.
    (CVE-2022-21628)

    Title: Improve HTTP/1.1 client usageThe HTTP/2 connection cache caches connection based on the IP address     but notthe SNI which can allow spoofing for servers on the same IP. (CVE-2022-39399)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5736 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory:

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1;     Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of     Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. (CVE-2022-21540)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1;     Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.     (CVE-2022-21541)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition:     21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data. (CVE-2022-21549)

  - Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Native Image (Gson)).     Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily     exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle GraalVM     Enterprise Edition executes to compromise Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle GraalVM Enterprise Edition. (CVE-2022-25647)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP     (Xalan-J)). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1;     Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.
    (CVE-2022-34169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5683 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8).
    (BZ#2084649)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-11]     (BZ#2099917)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-11]     (BZ#2108248)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-11]     (BZ#2108251)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3599:06 advisory.

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)
      * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)
      * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
163444	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5696)	Nessus	Red Hat Local Security Checks	2022/7/26	2025/3/6	high
163477	Rocky Linux 8 : java-17-openjdk (RLSA-2022:5726)	Nessus	Rocky Linux Local Security Checks	2022/7/27	2023/11/6	high
163481	Debian DSA-5192-1 : openjdk-17 - security update	Nessus	Debian Local Security Checks	2022/7/27	2025/1/24	high
164220	SUSE SLES12: java-1_8_0-openjdk / java-1_8_0-openjdk-demo / etc (SUSE-SU-2022:2819-1)	Nessus	SuSE Local Security Checks	2022/8/17	2026/6/25	high
164548	SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-32bit / java-1_8_0-ibm-alsa / etc (SUSE-SU-2022:2949-1)	Nessus	SuSE Local Security Checks	2022/9/1	2026/6/25	high
164705	Amazon Linux 2022 : java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-devel (ALAS2022-2022-119)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	high
164750	Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-113)	Nessus	Amazon Linux Local Security Checks	2022/9/6	2024/12/11	high
164948	Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2022-1633)	Nessus	Amazon Linux Local Security Checks	2022/9/12	2024/12/11	high
165801	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2022-2440)	Nessus	Huawei Local Security Checks	2022/10/8	2022/11/29	high
166353	Amazon Linux 2022 : java-17-amazon-corretto, java-17-amazon-corretto-devel, java-17-amazon-corretto-headless (ALAS2022-2022-151)	Nessus	Amazon Linux Local Security Checks	2022/10/20	2024/12/11	high
167716	AlmaLinux 9 : java-17-openjdk (ALSA-2022:5736)	Nessus	Alma Linux Local Security Checks	2022/11/16	2022/11/24	high
163304	Oracle Java SE Multiple Vulnerabilities (July 2022 CPU)	Nessus	Misc.	2022/7/20	2023/10/24	high
163338	RHEL 8 : java-11-openjdk (RHSA-2022:5683)	Nessus	Red Hat Local Security Checks	2022/7/21	2025/3/6	high
294492	MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.342.b07-1.el7 (AXSA:2022-3599:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high