Oracle Linux 9 : maven:3.9 (ELSA-2026-38500)

high Nessus Plugin ID 327521

Synopsis

The remote Oracle Linux host is missing a security update.

Description

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38500 advisory.

aopalliance [0:1.0-49]
- Update javapackages test plan to f42

[0:1.0-40]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[0:1.0-39]
- Rebuilt for java-21-openjdk as system jdk

[0:1.0-38]
- bump of release for for java-21-openjdk as system jdk

[0:1.0-37]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[0:1.0-36]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[0:1.0-35]
- Rebuild to regenerate auto-Requires on java

[0:1.0-34]
- Convert License tag to SPDX format

[0:1.0-33]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

[0:1.0-32]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

apache-commons-cli [1.9.0-3]
- Update javapackages test plan to f42

[1.9.0-2]
- Use %autosetup -C

[1.9.0-1]
- Update to upstream version 1.9.0
- Resolves: rhbz#2305042

[1.8.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1.8.0-1]
- Update to upstream version 1.8.0

[1.6.0-5]
- Rebuilt for java-21-openjdk as system jdk

[1.6.0-4]
- bump of release for for java-21-openjdk as system jdk

[1.6.0-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.6.0-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.6.0-1]
- Update to upstream version 1.6.0

apache-commons-codec [1.17.1-7]
- Update javapackages test plan to f42

[1.17.1-6]
- Use %autosetup -C

[1.17.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1.17.1-1]
- Update to upstream version 1.17.1

[1.16.1-1]
- Update to upstream version 1.16.1

[1.16.0-7]
- Rebuilt for java-21-openjdk as system jdk

[1.16.0-6]
- bump of release for for java-21-openjdk as system jdk

[1.16.0-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.16.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.16.0-3]
- Rebuild to regenerate auto-Requires on java

apache-commons-io [1:2.16.1-7]
- Update javapackages test plan to f42

[1:2.16.1-6]
- Use %autosetup -C

[1:2.16.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1:2.16.1-1]
- Update to upstream version 2.16.1

[1:2.13.0-8]
- Rebuilt for java-21-openjdk as system jdk

[1:2.13.0-7]
- bump of release for for java-21-openjdk as system jdk

[1:2.13.0-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1:2.13.0-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1:2.13.0-4]
- Rebuild to regenerate auto-Requires on java

[1:2.13.0-3]
- Rebuild

atinject [1.0.5-14]
- Sync with Fedora

[1.0.5-13]
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018

[1.0.5-12]
- Bump release for Aug 2024 java mass rebuild

[1.0.5-11]
- Bump release for June 2024 mass rebuild

[1.0.5-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.0.5-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.0.5-8]
- Rebuild to regenerate auto-Requires on java

[1.0.5-7]
- Convert License tag to SPDX format

[1.0.5-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

[1.0.5-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

google-guice [5.1.0-20]
- Update javapackages test plan to f42

[5.1.0-13]
- Drop unneeded Obsoletes

[5.1.0-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[5.1.0-11]
- Rebuilt for java-21-openjdk as system jdk

[5.1.0-10]
- bump of release for for java-21-openjdk as system jdk

[5.1.0-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[5.1.0-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[5.1.0-7]
- Rebuild to regenerate auto-Requires on java

[5.1.0-6]
- Convert License tag to SPDX format

[5.1.0-5]
- Build with Jurand instead of deprecated javapackages-extra

guava [33.3.0-3]
- Update javapackages test plan to f42

[33.3.0-1]
- Update to upstream version 33.3.0

[33.2.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[33.2.1-1]
- Update to upstream version 33.2.1

[32.1.3-5]
- Rebuilt for java-21-openjdk as system jdk

[32.1.3-4]
- bump of release for for java-21-openjdk as system jdk

[32.1.3-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[32.1.3-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[32.1.3-1]
- Update to upstream version 32.1.3

[31.1-8]
- Rebuild to regenerate auto-Requires on java

httpcomponents-client [4.5.14-18]
- Update javapackages test plan to f42

[4.5.14-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[4.5.14-8]
- Rebuilt for java-21-openjdk as system jdk

[4.5.14-7]
- bump of release for for java-21-openjdk as system jdk

[4.5.14-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[4.5.14-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[4.5.14-4]
- Port to Mockito 5

[4.5.14-3]
- Rebuild to regenerate auto-Requires on java

[4.5.14-2]
- Convert License tag to SPDX format

[4.5.14-1]
- Update to upstream version 4.5.14

httpcomponents-core [4.4.16-18]
- Disable tests failing without networking

[4.4.16-17]
- Update javapackages test plan to f42

[4.4.16-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[4.4.16-8]
- Rebuilt for java-21-openjdk as system jdk

[4.4.16-7]
- Port to OpenJDK 21

[4.4.16-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[4.4.16-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[4.4.16-4]
- Port to Mockito 5

[4.4.16-3]
- Rebuild to regenerate auto-Requires on java

[4.4.16-2]
- Convert License tag to SPDX format

jakarta-annotations [1.3.5-36]
- Update javapackages test plan to f42

[1.3.5-24]
- Switch to new GitHub repository

[1.3.5-23]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1.3.5-22]
- Rebuilt for java-21-openjdk as system jdk

[1.3.5-21]
- bump of release for for java-21-openjdk as system jdk

[1.3.5-20]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.3.5-19]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.3.5-18]
- Rebuild to regenerate auto-Requires on java

[1.3.5-17]
- Convert License tag to SPDX format

[1.3.5-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

jansi [2.4.1-9]
- Update javapackages test plan to f42

[2.4.1-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[2.4.1-3]
- Rebuilt for java-21-openjdk as system jdk

[2.4.1-2]
- bump of release for for java-21-openjdk as system jdk

[2.4.1-1]
- Update to upstream version 2.4.1

[2.4.0-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.4.0-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.4.0-10]
- Rebuild to regenerate auto-Requires on java

[2.4.0-9]
- Convert License tag to SPDX format

[2.4.0-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

jsr-305 [3.0.2-34]
- Update javapackages test plan to f42

[3.0.2-33]
- Use xpath macros instead of sed

[3.0.2-17]
- Replace CC-BY-2.5 annotations with Apache-2.0 ones
- Resolves: rhbz#2301569

[3.0.2-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[3.0.2-15]
- Rebuilt for java-21-openjdk as system jdk

[3.0.2-14]
- bump of release for for java-21-openjdk as system jdk

[3.0.2-13]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.0.2-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.0.2-11]
- Rebuild to regenerate auto-Requires on java

[3.0.2-10]
- Convert License tag to SPDX format

maven [1:3.9.9-13]
- Add maven-openjdk25 binding

[1:3.9.9-12]
- Reuse jlink image if it already exists

[1:3.9.9-11]
- Require /plans/matrix/unbound/jlink for gating

[1:3.9.9-10]
- Update javapackages test plan to f42

[1:3.9.9-9]
- Add test plan for maven-unbound

[1:3.9.9-8]
- Exclude maven-unbound from openjdk21 tests

[1:3.9.9-6]
- Generate bindings with %jp_binding macro

[1:3.9.9-4]
- Expect JVMs in %_jvmdir instead of %_jvmlibdir

[1:3.9.9-3]
- Update gating.yaml

[1:3.9.9-2]
- Drop bindings for OpenJDK < 21

maven-resolver [1:1.9.22-2]
- Update javapackages test plan to f42

[1:1.9.22-1]
- Update to upstream version 1.9.22

[1:1.9.18-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1:1.9.18-4]
- Switch to a newer patch macro syntax

[1:1.9.18-3]
- Rebuilt for java-21-openjdk as system jdk

[1:1.9.18-2]
- bump of release for for java-21-openjdk as system jdk

[1:1.9.18-1]
- Update to upstream version 1.9.18

[1:1.9.15-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1:1.9.15-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1:1.9.15-3]
- Rebuild to regenerate auto-Requires on java

maven-shared-utils [3.4.2-17]
- Update javapackages test plan to f42

[3.4.2-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[3.4.2-7]
- Rebuilt for java-21-openjdk as system jdk

[3.4.2-6]
- bump of release for for java-21-openjdk as system jdk

[3.4.2-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.4.2-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.4.2-3]
- Rebuild to regenerate auto-Requires on java

[3.4.2-2]
- Rebuild

[3.4.2-1]
- Update to upstream version 3.4.2

[3.3.4-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

maven-wagon [3.5.3-15]
- Use %autosetup -C

[3.5.3-14]
- Update javapackages test plan to f42

[3.5.3-13]
- Set Java compiler source/target via javaVersion property

[3.5.3-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[3.5.3-7]
- Rebuilt for java-21-openjdk as system jdk

[3.5.3-6]
- Update Java source/target to 1.8

[3.5.3-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.5.3-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.5.3-3]
- Rebuild to regenerate auto-Requires on java

[3.5.3-2]
- Convert License tag to SPDX format

plexus-cipher [2.0-24]
- Update javapackages test plan to f42

[2.0-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[2.0-11]
- Rebuilt for java-21-openjdk as system jdk

[2.0-10]
- Update Java source/target to 1.8

[2.0-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.0-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.0-7]
- Rebuild to regenerate auto-Requires on java

[2.0-6]
- Rebuild

[2.0-5]
- Use implicit maven toolchains

[2.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

plexus-classworlds [2.8.0-8]
- Update javapackages test plan to f42

[2.8.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[2.8.0-3]
- Rebuilt for java-21-openjdk as system jdk

[2.8.0-2]
- bump of release for for java-21-openjdk as system jdk

[2.8.0-1]
- Update to upstream version 2.8.0

[2.7.0-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.7.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.7.0-3]
- Rebuild to regenerate auto-Requires on java

[2.7.0-2]
- Convert License tag to SPDX format

[2.7.0-1]
- Update to upstream version 2.7.0

plexus-containers [2.2.0-8]
- Update javapackages test plan to f42

[2.2.0-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[2.2.0-3]
- Rebuilt for java-21-openjdk as system jdk

[2.2.0-2]
- bump of release for for java-21-openjdk as system jdk

[2.2.0-1]
- Update to upstream version 2.2.0
- Drop obsolete plexus-containers-container-default

[2.1.1-9]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.1.1-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.1.1-7]
- Rebuild to regenerate auto-Requires on java

[2.1.1-6]
- Rebuild

[2.1.1-5]
- Use implicit maven toolchains

plexus-interpolation [1.27-9]
- Update javapackages test plan to f42

[1.27-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1.27-3]
- Rebuilt for java-21-openjdk as system jdk

[1.27-2]
- bump of release for for java-21-openjdk as system jdk

[1.27-1]
- Update to upstream version 1.27

[1.26-19]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.26-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.26-17]
- Rebuild to regenerate auto-Requires on java

[1.26-16]
- Rebuild

[1.26-15]
- Use implicit maven toolchains

plexus-sec-dispatcher [2.0-26]
- Update javapackages test plan to f42

[2.0-14]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[2.0-13]
- Rebuilt for java-21-openjdk as system jdk

[2.0-12]
- bump of release for for java-21-openjdk as system jdk

[2.0-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.0-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[2.0-9]
- Rebuild to regenerate auto-Requires on java

[2.0-8]
- Convert License tag to SPDX format

[2.0-7]
- Build with default JDK 17

[2.0-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

plexus-utils [3.5.1-16]
- Update javapackages test plan to f42

[3.5.1-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[3.5.1-7]
- Rebuilt for java-21-openjdk as system jdk

[3.5.1-6]
- bump of release for for java-21-openjdk as system jdk

[3.5.1-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.5.1-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[3.5.1-3]
- Rebuild to regenerate auto-Requires on java

[3.5.1-2]
- Convert License tag to SPDX format

[3.5.1-1]
- Update to upstream version 3.5.1

[3.4.2-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

sisu [1:0.9.0~M3-3]
- Update javapackages test plan to f42

[1:0.9.0~M3-1]
- Update to upstream version 0.9.0.M3

[1:0.3.5-15]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1:0.3.5-14]
- Switch to a newer patch macro syntax

[1:0.3.5-13]
- Rebuilt for java-21-openjdk as system jdk

[1:0.3.5-12]
- bump of release for for java-21-openjdk as system jdk

[1:0.3.5-11]
- Add plexus-container-default alias

[1:0.3.5-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1:0.3.5-9]
- Rebuild to regenerate auto-Requires on java

[1:0.3.5-8]
- Convert License tag to SPDX format

slf4j [1.7.36-7]
- Update javapackages test plan to f42

[1.7.36-6]
- Rebuild to regenerate auto-requires

[1.7.36-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

[1.7.36-1]
- Update to upstream version 1.7.36

[1.7.32-12]
- Rebuilt for java-21-openjdk as system jdk

[1.7.32-11]
- bump of release for for java-21-openjdk as system jdk

[1.7.32-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

[1.7.32-9]
- Rebuild to regenerate auto-Requires on java

[1.7.32-8]
- Convert License tag to SPDX format

[1.7.32-7]
- Build with default JDK 17

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-38500.html

Plugin Details

Severity: High

ID: 327521

File Name: oraclelinux_ELSA-2026-38500.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/17/2026

Updated: 7/17/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.88

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-67030

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:maven-wagon, p-cpe:/a:oracle:linux:aopalliance, p-cpe:/a:oracle:linux:plexus-classworlds, p-cpe:/a:oracle:linux:plexus-interpolation, p-cpe:/a:oracle:linux:httpcomponents-core, p-cpe:/a:oracle:linux:maven-openjdk25, p-cpe:/a:oracle:linux:maven, p-cpe:/a:oracle:linux:maven-openjdk8, p-cpe:/a:oracle:linux:plexus-containers-component-annotations, cpe:/o:oracle:linux:9, p-cpe:/a:oracle:linux:sisu, p-cpe:/a:oracle:linux:plexus-utils, p-cpe:/a:oracle:linux:google-guice, p-cpe:/a:oracle:linux:maven-resolver, p-cpe:/a:oracle:linux:jsr-305, p-cpe:/a:oracle:linux:jcl-over-slf4j, p-cpe:/a:oracle:linux:maven-shared-utils, p-cpe:/a:oracle:linux:guava, p-cpe:/a:oracle:linux:plexus-sec-dispatcher, p-cpe:/a:oracle:linux:jansi, p-cpe:/a:oracle:linux:maven-unbound, p-cpe:/a:oracle:linux:maven-openjdk11, p-cpe:/a:oracle:linux:maven-openjdk21, p-cpe:/a:oracle:linux:maven-lib, p-cpe:/a:oracle:linux:apache-commons-cli, p-cpe:/a:oracle:linux:plexus-cipher, p-cpe:/a:oracle:linux:apache-commons-codec, p-cpe:/a:oracle:linux:jakarta-annotations, p-cpe:/a:oracle:linux:atinject, p-cpe:/a:oracle:linux:httpcomponents-client, p-cpe:/a:oracle:linux:apache-commons-io, p-cpe:/a:oracle:linux:slf4j, p-cpe:/a:oracle:linux:maven-openjdk17

Required KB Items: Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list, Host/local_checks_enabled

Exploit Ease: No known exploits are available

Patch Publication Date: 7/15/2026

Vulnerability Publication Date: 3/25/2026

Reference Information

CVE: CVE-2025-67030