The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1514 advisory.

  - OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

  - OpenJDK: Incorrect handling of Certificate messages during TLS handshake (JSSE, 8232581) (CVE-2020-2767)

  - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)     (CVE-2020-2773)

  - OpenJDK: Incomplete enforcement of algorithm restrictions for TLS (JSSE, 8232424) (CVE-2020-2778)

  - OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

  - OpenJDK: Application data accepted before TLS handshake completion (JSSE, 8235691) (CVE-2020-2816)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : java-11-openjdk (RHSA-2020:1514)

high Nessus Plugin ID 135861

Version 1.10

Version 1.9

Version 1.8

Version 1.10 Apr 25, 2024, 2:46 AM Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404250246
Version 1.9 May 25, 2023, 5:09 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305251709
Version 1.8 Jan 23, 2023, 7:12 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301231912