In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious
    actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a
    number of edge cases where the input text of a number can lead to much larger processing time than one
    would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their
    scale. (CVE-2023-4043)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Spatial and Graph (libcurl2) component of Oracle Database Server. Supported     versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Spatial and Graph     (libcurl2). Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Oracle Spatial and Graph (libcurl2). (CVE-2024-7264)

  - Vulnerability in the Oracle Database Security (OpenSSL) component of Oracle Database Server. Supported     versions that are affected are 23.4-23.5. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Oracle Database Security (OpenSSL). Successful     attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service     (partial DOS) of Oracle Database Security (OpenSSL). (CVE-2024-5535, CVE-2024-6119)

  - Vulnerability in the Fleet Patching and Provisioning - Micronaut (Netty) component of Oracle Database     Server. Supported versions that are affected are 23.4-23.5. Easily exploitable vulnerability allows low     privileged attacker having Authenticated User privilege with network access via HTTP to compromise Fleet     Patching and Provisioning - Micronaut (Netty). Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Fleet Patching and Provisioning
    - Micronaut (Netty). (CVE-2024-29025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1193 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.1 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.0, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.0 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jgit: arbitrary file overwrite (CVE-2023-4759)

    * sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)

    * parsson: Denial of Service due to large number parsing (CVE-2023-4043)

    * apache-sshd: ssh: Prefix truncation attack on Binary Packet Protocol (CVE-2023-48795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1192 advisory.

    Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly     application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.0.1 serves as a     replacement for Red Hat JBoss Enterprise Application Platform 8.0.0, and includes bug fixes and     enhancements. See the Red Hat JBoss Enterprise Application Platform 8.0.0 Release Notes for information     about the most significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * jgit: arbitrary file overwrite (CVE-2023-4759)

    * sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)

    * parsson: Denial of Service due to large number parsing (CVE-2023-4043)

    * apache-sshd: ssh: Prefix truncation attack on Binary Packet Protocol (CVE-2023-48795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory.

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected     are 19.3-19.21 and 21.3-21.12. Easily exploitable vulnerability allows low privileged attacker having     Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Java VM accessible data. (CVE-2024-20903)

  - Vulnerability in the Oracle Spatial and Graph (curl) component of Oracle Database Server. Supported     versions that are affected are 19.3-19.21, 21.3-21.12 and 23.3. Easily exploitable vulnerability allows     low privileged attacker having Authenticated User privilege with network access via HTTP to compromise     Oracle Spatial and Graph (curl). Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Spatial and Graph (curl).
    (CVE-2023-38545)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 19.3-19.21. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with     network access via Oracle Net to compromise Oracle Text. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Text.
    (CVE-2022-21432)

  - Security-in-depth update for non-exploitable vulnerabilities CVE-2022-41409, CVE-2022-46337, CVE-2023-2976,     CVE-2023-4043, CVE-2023-36479, CVE-2023-40167, CVE-2023-41900, CVE-2023-42794, CVE-2023-42795,     CVE-2023-44487, CVE-2023-45648 and CVE-2023-46589,.


Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
414993	SCA: security update for org.eclipse.parsson:project (GHSA-g8p6-p27c-52fx)	Tenable Cloud Security	SCA Checks	Local	high
414993	SCA: security update for org.eclipse.parsson:project (GHSA-g8p6-p27c-52fx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
209306	Oracle Database Server (October 2024 CPU)	Nessus	Databases	Local	medium
191654	RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.1 (RHSA-2024:1193)	Nessus	Red Hat Local Security Checks	Local	critical
191651	RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.1 (RHSA-2024:1192)	Nessus	Red Hat Local Security Checks	Local	critical
189165	Oracle Database Server (January 2024 CPU)	Nessus	Databases	Local	medium

Detections

Analytics

CVE-2023-4043

high

Tenable Plugins

high

high

medium

critical

critical

medium