The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-225:01 advisory.

    The OpenJDK runtime environment.
    Security issues fixed with this release:
    CVE-2015-2590
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2601
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2621
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2625
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2628
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2632
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2659
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-2808     The RC4 algorithm, as used in the TLS protocol and SSL protocol, does     not properly combine state data with key data during the     initialization phase, which makes it easier for remote attackers to     conduct plaintext-recovery attacks against the initial bytes of a     stream by sniffing network traffic that occasionally relies on keys     affected by the Invariance Weakness, and then using a brute-force     approach involving LSB values, aka the Bar Mitzvah issue.
    CVE-2015-3149
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4000     The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is     enabled on a server but not on a client, does not properly convey a     DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with DHE replaced     by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT     replaced by DHE, aka the Logjam issue.
    CVE-2015-4731
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4732
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4733
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4748
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4749
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4760
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Version-Release number of selected component (if applicable):

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

MiracleLinux 7 : java-1.8.0-openjdk-1.8.0.51-1.b16.el7 (AXSA:2015-225:01)

critical Nessus Plugin ID 289889

Version 1.3

Version 1.1

Version 1.3 Jan 18, 2026, 1:30 AM CEA reference CISA reference Exploit attributes ("Exploited by malware" set to "True") Plugin Feed: 202601180130
Version 1.1 Jan 16, 2026, 10:12 PM New Plugin Feed: 202601162212