The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1850-1 advisory.

    - Update to Java 8.0 Service Refresh 8 (bsc#1208480):

      * Security fixes:
        - CVE-2023-21830: Fixed improper restrictions in CORBA deserialization (bsc#1207249).
        - CVE-2023-21835: Fixed handshake DoS attack against DTLS connections (bsc#1207246).
        - CVE-2023-21843: Fixed soundbank URL remote loading (bsc#1207248).

      * New Features/Enhancements:
        - Add RSA-PSS signature to IBMJCECCA.
      * Defect Fixes:
        - IJ45437 Service, Build, Packaging and Deliver: Getting           FIPSRUNTIMEEXCEPTION when calling java code:
          MESSAGEDIGEST.GETINSTANCE('SHA256', 'IBMJCEFIPS'); in MAC
        - IJ45272 Class Libraries: Fix security vulnerability CVE-2023-21843
        - IJ45280 Class Libraries: Update timezone information to the           latest TZDATA2022F
        - IJ44896 Class Libraries: Update timezone information to the           latest TZDATA2022G
        - IJ45436 Java Virtual Machine: Stack walking code gets into           endless loop, hanging the application
        - IJ44079 Java Virtual Machine: When -DFILE.ENCODING is specified           multiple times on the same command line the first option takes           precedence instead of the last
        - IJ44532 JIT Compiler: Java JIT: Crash in DECREFERENCECOUNT()           due to a NULL pointer
        - IJ44596 JIT Compiler: Java JIT: Invalid hard-coding of static           final field object properties
        - IJ44107 JIT Compiler: JIT publishes new object reference to other           threads without executing a memory flush
        - IX90193 ORB: Fix security vulnerability CVE-2023-21830
        - IJ44267 Security: 8273553: SSLENGINEIMPL.CLOSEINBOUND also has           similar error of JDK-8253368
        - IJ45148 Security: code changes for tech preview
        - IJ44621 Security: Computing Diffie-Hellman secret repeatedly,           using IBMJCEPLUS, causes a small memory leak
        - IJ44172 Security: Disable SHA-1 signed jars for EA
        - IJ44040 Security: Generating Diffie-Hellman key pairs repeatedly,           using IBMJCEPLUS, Causes a small memory leak
        - IJ45200 Security: IBMJCEPLUS provider, during CHACHA20-POLY1305           crypto operations, incorrectly throws an ILLEGALSTATEEXCEPTION
        - IJ45182 Security: IBMJCEPLUS provider fails in RSAPSS and ECDSA           during signature operations resulting in Java cores
        - IJ45201 Security: IBMJCEPLUS provider failures (two) with AESGCM algorithm
        - IJ45202 Security: KEYTOOL NPE if signing certificate does not contain           a SUBJECTKEYIDENTIFIER extension
        - IJ44075 Security: PKCS11KEYSTORE.JAVA - DOESPUBLICKEYMATCHPRIVATEKEY()           method uses SHA1XXXX signature algorithms to match private and public keys
        - IJ45203 Security: RSAPSS multiple names for KEYTYPE
        - IJ43920 Security: The PKCS12 keystore update and the PBES2 support
        - IJ40002 XML: Fix security vulnerability CVE-2022-21426

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15: java-1_8_0-ibm / java-1_8_0-ibm-32bit / java-1_8_0-ibm-alsa / etc (SUSE-SU-2023:1850-1)

low Nessus Plugin ID 174375

Version 1.3

Version 1.2

Version 1.0

Version 1.3 Jun 26, 2026, 4:08 PM CVSS metrics ("CVSSv3 score" set to 3.7) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N") CVSSv3 severity (based on CVE-2023-21830, severity decreased from "Medium" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202606261608
Version 1.2 Jul 14, 2023, 10:50 AM Detection Plugin Feed: 202307141050
Version 1.0 Apr 15, 2023, 10:07 AM New Plugin Feed: 202304151007