Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption. In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values. Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5]. [1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]: https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]: https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in     TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to     upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by     manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a     denial of service issue via CPU consumption. In version 1.22 of Apache Commons Compress, support was added     for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX     extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds     and subsecond precision (for example 1647221103.5998539). The impacted fields are atime, ctime,     mtime and LIBARCHIVE.creationtime. No input validation is performed prior to the parsing of header     values. Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known     algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue     # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with     a very long fraction (300,000 digits) or a number with exponent notation (such as 9e9999999) within a     file modification time header, and the parsing of files with these headers will take hours instead of     seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to     CVE-2012-2098 [5]. [1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]:
    https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]:
    https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]:
    https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-     bin/cvename.cgi?name=CVE-2012-2098 Only applications using CompressorStreamFactory class (with auto-     detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since     this code was introduced in v1.22, only that version and later versions are impacted. (CVE-2023-42503)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in
    TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to
    upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed TAR file by
    manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a
    denial of service issue via CPU consumption. In version 1.22 of Apache Commons Compress, support was added
    for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX
    extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds
    and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”,
    “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header
    values. Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known
    algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue
    # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with
    a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a
    file modification time header, and the parsing of files with these headers will take hours instead of
    seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to
    CVE-2012-2098 [5]. [1]: https://issues.apache.org/jira/browse/COMPRESS-612 [2]:
    https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 [3]:
    https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html [4]:
    https://bugs.openjdk.org/browse/JDK-6560193 [5]: https://cve.mitre.org/cgi-
    bin/cvename.cgi?name=CVE-2012-2098 Only applications using CompressorStreamFactory class (with auto-
    detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since
    this code was introduced in v1.22, only that version and later versions are impacted. (CVE-2023-42503)

The versions of Oracle Application Testing Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager (component:
    Load Testing for Web Apps (Apache Commons Compress)). The supported version that is affected is 13.3.0.1.
    Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where     Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite. Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of Oracle Application Testing Suite. (CVE-2023-42503, CVE-2024-26308, CVE-2024-25710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.13. Easily exploitable vulnerability allows low privileged attacker having     Authenticated User privilege with network access via Oracle Net to compromise RDBMS (Python). Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of RDBMS (Python). (CVE-2023-36632) 

  - Vulnerability in the Grid Infrastructure (Apache Mina SSHD) component of Oracle Database Server.   Supported versions that are affected are 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Grid Infrastructure (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Grid Infrastructure (Apache Mina SSHD) accessible data. (CVE-2023-48795)

  - Vulnerability in the Oracle SQLcl (Apache Mina SSHD) component of Oracle Database Server. Supported   versions that are affected are 19.3-19.22 and 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Oracle SQLcl (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Oracle SQLcl (Apache Mina SSHD) accessible data. (CVE-2023-48795)	

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Google Guava)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17 and 22.12.0-22.12.11. Easily exploitable vulnerability allows low privileged attacker     with logon to the infrastructure where Primavera Unifier executes to compromise Primavera Unifier.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Primavera Unifier accessible data as well as unauthorized update, insert or delete access to     some of Primavera Unifier accessible data. (CVE-2023-2976)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (Apache Commons Compress)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17 and 22.12.0-22.12.11. Easily exploitable vulnerability allows unauthenticated attacker     with logon to the infrastructure where Primavera Unifier executes to compromise Primavera Unifier.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of Primavera Unifier. (CVE-2023-42503)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Manager (Apache ZooKeeper)). Supported versions that are affected are 19.12.0-19.12.16, 20.12.0-20.12.16,     21.12.0-21.12.17 and 22.12.0-22.12.11. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Primavera Unifier accessible data. (CVE-2023-44981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Primavera P6 Enterprise Project Portfolio Management installed on the remote host are affected by vulnerabilities as referenced in the January 2024 CPU advisory.

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (Google Guava)). Supported versions that are affected are     19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6     Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio     Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Primavera P6 Enterprise Project Portfolio Management     accessible data as well as unauthorized access to critical data or complete access to all Primavera P6     Enterprise Project Portfolio Management accessible data. (CVE-2023-2976)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (Apache Commons Compress)). Supported versions that are affected are     19.12.0-19.12.22, 20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable     vulnerability allows low privileged attacker with logon to the infrastructure where Primavera P6     Enterprise Project Portfolio Management executes to compromise Primavera P6 Enterprise Project Portfolio     Management. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable     crash (complete DOS) of Primavera P6 Enterprise Project Portfolio Management. (CVE-2023-42503)

  - Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction     and Engineering (component: Web (JSON-java)). Supported versions that are affected are 19.12.0-19.12.22,     20.12.0-20.12.20, 21.12.0-21.12.17 and 22.12.0-22.12.10. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera P6 Enterprise Project     Portfolio Management. Successful attacks of this vulnerability can result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of Primavera P6 Enterprise Project Portfolio     Management. (CVE-2023-5072)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle WebLogic Server installed on the remote host is missing a security patch from the January 2024 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities, including:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (NekoHTML)). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks require human interaction from a person other than the     attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
    (CVE-2023-49093)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle     WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional     products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Oracle WebLogic Server accessible data. (CVE-2024-20927)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Easily     exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle     WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle WebLogic Server accessible data. (CVE-2024-20931)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle WebCenter Portal installed on the remote host is missing a security patch from the January 2024 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Bouncy Castle Java Library)). Easily exploitable vulnerability allows unauthenticated attacker with network access     via LDAP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized     read access to a subset of Oracle WebCenter Portal accessible data. (CVE-2023-33201)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Solr)). Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized ability to     cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Portal. (CVE-2021-33813)

  - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework     (Apache Commons Compress)). Easily exploitable vulnerability allows unauthenticated attacker with logon to the     infrastructure where Oracle WebCenter Portal executes to compromise Oracle WebCenter Portal. Successful attacks     require human interaction from a person other than the attacker. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter     Portal. (CVE-2023-42503)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the January 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (OpenSSL)). Easily exploitable vulnerability     allows unauthenticated attacker with network access via TLS to compromise Oracle Essbase. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Oracle Essbase. (CVE-2022-3602)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (curl)). Easily exploitable vulnerability allows     unauthenticated attacker with network access via SOCKS5 to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in takeover of Oracle Essbase. (CVE-2023-38545)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (Apache Commons Compress)). Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Essbase executes to     compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Essbase. (CVE-2023-42503)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
227307	Linux Distros Unpatched Vulnerability : CVE-2023-42503	Nessus	Misc.	Local	medium
413899	SCA: security update for org.apache.commons:commons-compress (GHSA-cgwf-w82q-5jrr)	Tenable Cloud Security	SCA Checks	Local	medium
413899	SCA: security update for org.apache.commons:commons-compress (GHSA-cgwf-w82q-5jrr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
209387	Oracle Application Testing Suite (October 2024 CPU)	Nessus	Misc.	Local	medium
193497	Oracle Database Server (Apr 2024 CPU)	Nessus	Databases	Local	critical
189185	Oracle Primavera Unifier (January 2024 CPU)	Nessus	CGI abuses	Remote	critical
189184	Oracle Primavera P6 Enterprise Project Portfolio Management (January 2024 CPU)	Nessus	CGI abuses	Remote	high
189176	Oracle WebLogic Server (January 2024 CPU)	Nessus	Misc.	Local	critical
189118	Oracle WebCenter Portal Multiple Vulnerabilities (January 2024 CPU)	Nessus	Misc.	Local	medium
189117	Oracle Essbase Multiple Vulnerabilities (January 2024 CPU)	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2023-42503

medium

Tenable Plugins

medium

medium

medium

medium

critical

critical

high

critical

medium

critical