The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3852 advisory.

    [1:17.0.15.0.6-2.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:17.0.15.0.6-2]
    - Update to jdk-17.0.15+6 (GA)
    - Add to .gitignore openjdk-17.0.15+6.tar.xz
    - Set updatever to 15
    - Set buildver to 6
    - Set rpmrelease to 2
    - Update sources to openjdk-17.0.15+6.tar.xz
    - Set bundled freetype provide version to 2.13.2
    - Set bundled harfbuzz provide version to 8.2.2
    - Require tzdata-java 2025a at runtime and for build
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - Update FIPS patch
    - Resolves: RHEL-86624
    - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2025-3852)

high Nessus Plugin ID 234580

Version 1.3