The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

  - jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

  - jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

  - jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin     (CVE-2020-2307)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials     IDs (CVE-2020-2309)

  - ant: insecure temporary file (CVE-2020-11979)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

  - jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

  - jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

  - jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

  - jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

  - jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

  - jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

  - jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

  - jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

  - jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)

high Nessus Plugin ID 147013

Version 1.15

Version 1.14

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.15 Apr 28, 2024, 2:25 PM CVE (set "CVE" coverage to "CVE-2020-1945,CVE-2020-2304,CVE-2020-2305,CVE-2020-2306,CVE-2020-2307,CVE-2020-2308,CVE-2020-2309,CVE-2020-11979,CVE-2020-25658,CVE-2021-21602,CVE-2021-21603,CVE-2021-21604,CVE-2021-21605,CVE-2021-21606,CVE-2021-21607,CVE-2021-21608,CVE-2021-21609,CVE-2021-21610,CVE-2021-21611") CVSS metrics ("CVSSv2 score" set to 6.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P") CVSS metrics ("CVSSv3 score" set to 8.0) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2020-11979" to "CVE-2021-21605") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.14 Jan 18, 2024, 8:01 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Plugin Feed: 202401182001
Version 1.13 May 25, 2023, 12:55 AM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305250055
Version 1.12 Jan 23, 2023, 7:12 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301231912
Version 1.11 Dec 15, 2022, 5:58 PM Detection Plugin Feed: 202212151758
Version 1.10 Dec 6, 2022, 6:53 AM Reference Plugin Feed: 202212060653