The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3141 advisory.

    The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization     Manager. The appliance is available to download as an OVA file from the Customer Portal.

    The following packages have been upgraded to a later upstream version: rhvm-appliance (20171019.0).
    (BZ#1496586)

    Security Fix(es):

    * A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user     to perform code execution by sending the maliciously crafted input to the readValue method of the     ObjectMapper. (CVE-2017-7525)

    * A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password     hash comparison. (CVE-2014-9970)

    * It was found that when the security manager's reflective permissions, which allows it to access the     private members of the class, are granted to Hibernate Validator, a potential privilege escalation can     occur. By allowing the calling code to access those private members without the permission an attacker may     be able to validate an invalid instance and access the private member value via     ConstraintViolation#getInvalidValue(). (CVE-2017-7536)

    Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-7525. The CVE-2017-7536 issue was     discovered by Gunnar Morling (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : rhvm-appliance (RHSA-2017:3141)

critical Nessus Plugin ID 104493

Version 3.12