A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5342 advisory.

  - hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals     are used (CVE-2020-25638)

  - wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL (CVE-2020-25644)

  - jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity     (XXE) (CVE-2020-25649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5340 advisory.

  - hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals     are used (CVE-2020-25638)

  - wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL (CVE-2020-25644)

  - jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity     (XXE) (CVE-2020-25649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5341 advisory.

  - hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals     are used (CVE-2020-25638)

  - wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL (CVE-2020-25644)

  - jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity     (XXE) (CVE-2020-25649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4922 advisory.

  - wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL (CVE-2020-25644)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4256 advisory.

  - wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL (CVE-2020-25644)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
143474	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.4 (RHSA-2020:5342)	Nessus	Red Hat Local Security Checks	high
143473	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.4 (RHSA-2020:5340)	Nessus	Red Hat Local Security Checks	high
143472	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.4 (RHSA-2020:5341)	Nessus	Red Hat Local Security Checks	high
142455	RHEL 6 / 8 : Red Hat JBoss Enterprise Application Platform 7.3 (RHSA-2020:4922)	Nessus	Red Hat Local Security Checks	high
141458	RHEL 6 / 8 : Red Hat JBoss Enterprise Application Platform 7.3 (RHSA-2020:4256)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-25644

high

Tenable Plugins

high

high

high

high

high