Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / etc Multiple Vulnerabilities (crlsa-2020_4847)

critical Nessus Plugin ID 359386

Synopsis

The Rocky Linux host is missing one or more security updates.

Description

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_4847 advisory.

* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)

* pki: Dogtag's python client does not validate certificates (CVE-2020-15720)

* pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page (CVE-2019-10146)

* pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab (CVE-2019-10179)

* pki-core: Reflected XSS in getcookies?url= endpoint in CA (CVE-2019-10221)

* pki-core: KRA vulnerable to reflected XSS via the getPk12 page (CVE-2020-1721)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages based on the guidance in CIQ advisory crlsa-2020_4847.

Plugin Details

Severity: Critical

ID: 359386

File Name: ciq_rocky_linux_8_crlsa-2020_4847.nasl

Version: 1.1

Type: Local

Family: Rocky Linux Local Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.9

Percentile: 99.36

Vendor

Vendor Severity: Unknown

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-25762

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

CVSS Score Source: CVE-2020-1938

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/3/2020

Vulnerability Publication Date: 1/18/2018

CISA Known Exploited Vulnerability Due Dates: 3/17/2022, 2/13/2025

Reference Information

CVE: CVE-2015-9251, CVE-2016-10735, CVE-2018-14040, CVE-2018-14042, CVE-2019-10146, CVE-2019-10179, CVE-2019-10221, CVE-2019-11358, CVE-2019-8331, CVE-2020-11022, CVE-2020-11023, CVE-2020-15720, CVE-2020-1721, CVE-2020-1935, CVE-2020-1938, CVE-2020-25715, CVE-2022-25762

Detections

Analytics