The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6999 advisory.

  - OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

  - OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

  - OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

  - OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

  - OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

  - OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : java-17-openjdk (RHSA-2022:6999)

medium Nessus Plugin ID 166328

Version 1.6