Detections
Analytics

Alpine: multiple openjdk21 packages: security update to 21.0.2_p13-r0

medium Tenable Self-Hosted Container Security Plugin ID 408243

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already
 cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design,
 `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in
 browser environments. Since undici handles headers more liberally than the spec, there was a disconnect
 from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to
 accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection
 target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version
 5.26.2. There are no known workarounds. (CVE-2023-45143)

 - Denial of Service in JSON-Java versions up to and including 20230618. A bug in the parser means that an
 input string of modest size can lead to indefinite amounts of memory being used. (CVE-2023-5072)

 - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation
 can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of
 Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u391,
 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise
 Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker
 with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle
 GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,
 deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle
 GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete
 access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.
 Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web
 service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in
 clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run
 untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.
 (CVE-2024-20918)

See Also

https://security.alpinelinux.org/vuln/CVE-2023-44487

https://security.alpinelinux.org/vuln/CVE-2023-45143

https://security.alpinelinux.org/vuln/CVE-2023-5072

https://security.alpinelinux.org/vuln/CVE-2024-20918

https://security.alpinelinux.org/vuln/CVE-2024-20919

https://security.alpinelinux.org/vuln/CVE-2024-20921

https://security.alpinelinux.org/vuln/CVE-2024-20945

https://security.alpinelinux.org/vuln/CVE-2024-20952

Plugin Details

Severity: Medium

ID: 408243

Version: Revision 1.35

Type: Local

Published: 1/17/2024

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 97.25

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2023-45143

CVSS v3

Risk Factor: Low

Base Score: 3.5

Temporal Score: 3.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:A

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2023-44487

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/10/2023

CISA Known Exploited Vulnerability Due Dates: 10/31/2023

Reference Information

CVE: CVE-2023-44487, CVE-2023-45143, CVE-2023-5072, CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20945, CVE-2024-20952