Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local
    users to bypass intended access restrictions via unspecified vectors. (CVE-2013-2027)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local     users to bypass intended access restrictions via unspecified vectors. (CVE-2013-2027)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities :

  - A flaw exists in Jython due to executable classes being     created with insecure permissions. A local attacker can     exploit this to bypass intended access restrictions and     thereby disclose sensitive information or gain elevated     privileges. (CVE-2013-2027)

  - A remote code execution vulnerability exists in the     Apache Struts component in the Jakarta Multipart parser     due to improper handling of the Content-Type,     Content-Disposition, and Content-Length headers.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted header value in the HTTP     request, to execute arbitrary code. (CVE-2017-5638)

  - An unspecified flaw exists in the Web Services component     that allows an unauthenticated, remote attacker to have     an impact on integrity and availability.
    (CVE-2017-10063)

  - An unspecified flaw exists in the Web Container     component that allows an authenticated, remote attacker     to disclose sensitive information. (CVE-2017-10123)

  - An unspecified flaw exists in the JNDI component that     allows an unauthenticated, remote attacker to execute     arbitrary code. (CVE-2017-10137)

  - An unspecified flaw exists in the Core Components that     allows an unauthenticated, remote attacker to cause a     denial of service condition. (CVE-2017-10147)

  - An unspecified flaw exists in the Core Components that     allows an unauthenticated, remote attacker to have an     impact on integrity. (CVE-2017-10148)

  - An unspecified flaw exists in the Web Container     component that allows an unauthenticated, remote     attacker to have an impact on confidentiality and     integrity. (CVE-2017-10178)

Updated jython packages fix security vulnerability :

There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure (CVE-2013-2027).

jython was updated to fix one security issue.

This security issue was fixed :

  - CVE-2013-2027: Creates executables class files with     wrong permissions

ID	Name	Product	Family	Type	Severity
434549	SCA: security update for org.python:jython-standalone (GHSA-9347-9w64-q5wp)	Tenable Cloud Security	SCA Checks	Local	medium
434549	SCA: security update for org.python:jython-standalone (GHSA-9347-9w64-q5wp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
217812	Linux Distros Unpatched Vulnerability : CVE-2013-2027	Nessus	Misc.	Local	critical
101815	Oracle WebLogic Server Multiple Vulnerabilities (July 2017 CPU)	Nessus	Misc.	Local	critical
82411	Mandriva Linux Security Advisory : jython (MDVSA-2015:158)	Nessus	Mandriva Local Security Checks	Local	medium
81338	openSUSE Security Update : jython (openSUSE-2015-139)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-2027

medium

Tenable Plugins

medium

medium

critical

critical

medium

medium