Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

The version of jettison installed on the remote host is prior to 1.3.3-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2363 advisory.

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40149)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6177-1 advisory.

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40149)

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by Out of memory. This effect may support a denial of service attack. (CVE-2022-40150)

  - A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted     JSON data. (CVE-2022-45685)

  - Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This     vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. (CVE-2022-45693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Access Manager installed on the remote host is missing a security patch from the April 2023 CPU Advisory. It is, therefore, affected by multiple vulnerabilities:

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Third Party     (Jython)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle Access Manager. (CVE-2019-20916)

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Build Scripts     (Jettison)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Access Manager. (CVE-2022-40149)

  - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Third Party     (Zip4j)). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle Access Manager accessible data. (CVE-2023-22899)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1044 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - keycloak: path traversal via double URL encoding (CVE-2022-3782)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1043 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - keycloak: path traversal via double URL encoding (CVE-2022-3782)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1045 advisory.

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

  - minimist: prototype pollution (CVE-2021-44906)

  - keycloak: HTML injection in execute-actions-email Admin REST API (CVE-2022-1274)

  - keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)

  - SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)

  - Moment.js: Path traversal  in moment.locale (CVE-2022-24785)

  - snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

  - Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)

  - moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

  - loader-utils:Regular expression denial of service (CVE-2022-37603)

  - keycloak: path traversal via double URL encoding (CVE-2022-3782)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)

  - snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)

  - snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)

  - keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - keycloak: reflected XSS attack (CVE-2022-4137)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)

  - Apache CXF: directory listing / code exfiltration (CVE-2022-46363)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

  - keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)

  - keycloak: user impersonation via stolen uuid code (CVE-2023-0264)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0553 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0554 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0552 advisory.

  - jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

  - bootstrap: XSS in the data-target attribute (CVE-2016-10735)

  - nodejs-moment: Regular expression denial of service (CVE-2017-18214)

  - bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

  - bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)

  - bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

  - jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or     property injection (CVE-2019-11358)

  - bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

  - jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

  - jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

  - wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)

  - jettison: parser crash by stackoverflow (CVE-2022-40149)

  - jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)

  - woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)

  - jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)

  - jackson-databind: use of deeply nested arrays (CVE-2022-42004)

  - mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)

  - jettison:  If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)

  - Apache CXF: SSRF Vulnerability (CVE-2022-46364)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5312 advisory.

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40149)

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by Out of memory. This effect may support a denial of service attack. (CVE-2022-40150)

  - A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted     JSON data. (CVE-2022-45685)

  - Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This     vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. (CVE-2022-45693)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3184 advisory.

  - Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks     (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the     parser to crash by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40149)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186550	Amazon Linux 2 : jettison (ALAS-2023-2363)	Nessus	Amazon Linux Local Security Checks	high
177430	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : Jettison vulnerabilities (USN-6177-1)	Nessus	Ubuntu Local Security Checks	high
174465	Oracle Access Manager Multiple Vulnerabilities (Apr 2023 CPU)	Nessus	Misc.	high
172042	RHEL 8 : Red Hat Single Sign-On 7.6.2 security update on RHEL 8 (Important) (RHSA-2023:1044)	Nessus	Red Hat Local Security Checks	critical
172041	RHEL 7 : Red Hat Single Sign-On 7.6.2 security update on RHEL 7 (Important) (RHSA-2023:1043)	Nessus	Red Hat Local Security Checks	critical
172039	RHEL 9 : Red Hat Single Sign-On 7.6.2 security update on RHEL 9 (Important) (RHSA-2023:1045)	Nessus	Red Hat Local Security Checks	critical
170914	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0553)	Nessus	Red Hat Local Security Checks	critical
170911	RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0554)	Nessus	Red Hat Local Security Checks	critical
170909	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.9 Security update (Important) (RHSA-2023:0552)	Nessus	Red Hat Local Security Checks	critical
169917	Debian DSA-5312-1 : libjettison-java - security update	Nessus	Debian Local Security Checks	high
167296	Debian DLA-3184-1 : libjettison-java - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-40149

high

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical

high

high