The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5486 advisory.

  - nodejs-semver: Regular expression denial of service (CVE-2022-25883)

  - eap-7: heap exhaustion via deserialization (CVE-2023-3171)

  - wildfly-core: Management User RBAC permission allows unexpected reading of system-properties to an     Unauthorized actor (CVE-2023-4061)

  - tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)

  - log4j1-chainsaw, log4j1-socketappender: DoS via hashmap logging (CVE-2023-26464)

  - bouncycastle: potential  blind LDAP injection attack using a self-signed certificate (CVE-2023-33201)

  - netty: SniHandler 16MB allocation leads to OOM (CVE-2023-34462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9 (Important) (RHSA-2023:5486)

critical Nessus Plugin ID 182684

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Apr 28, 2024, 2:25 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202404281425
Version 1.1 Oct 13, 2023, 2:22 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202310131422
Version 1.0 Oct 6, 2023, 5:06 PM New Plugin Feed: 202310061706