SUSE SLED15: apache-commons-cli / aqute-bndlib / glassfish-annotation-api / etc (SUSE-SU-2026:5189-1)

high Nessus Plugin ID 379426

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5189-1 advisory.

apache-parent was updated to 40:

* Breaking changes

- Replace nicoulaj checksum plugin with maveniverse checksum plugin
- #586: Use RAT0.18 and remove commons-lang3 configuration for JDK25
- Property version.maven-surefire was removed in #588, should be replaced by version.maven-surefire-plugin, version.maven-failsafe-plugin or version.maven-surefire-report-plugin
* New features and improvements
- Fix several version property issues
* Documentation updates
- Update documentation for push-to-atr profile
- Restore the common wording on the download page
* Maintenance
- Add local maven configuration for ATR project name override
- Remove custom name-template for release-drafter
- Port the site documentation from APT to Markdown

Update to 39:

* New features and improvements
- add push-to-atr profile

Update to 38:

* Maintenance
- Update banner links

Update to 37:

* New features and improvements
- Disable parallel PUT on release

Update to 36:

* Breaking changes
- Update minimum maven version to match current stable version (3.6.3 -> 3.9)
- Introduce javaVersion property for maven.compiler.* configuration
- Switch JDK >= 9 to only use maven.compiler.release
* New features and improvements
- Add default specification and implementation for javadoc and source manifest entries
* Documentation updates
- Clarify how to use Apache Snapshot repository
- activate Fluido skin's anchorJs
* Maintenance
- Avoid - WARNING: Use of the three-letter time zone ID ... on JDK 25 for RAT plugin
- feat: enable prevent branch protection rules

- Port to slf4j 2.x

- Add dependency on osgi-service-subsystem to allow upgrade to osgi-compendium 8.0.0

Update to aqute-bnd 6.4.1

* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic

- Initial packaging of the bnd-maven-plugin distributed as a part of aqute-bnd 3.5.0

- Port to slf4j 2.x

- Add dependency on osgi-service-subsystem to allow upgrade to osgi-compendium 8.0.0

Update to aqute-bnd 6.4.1
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
* https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic

- Initial packaging of aqute-bnd 3.5.0

Upgrade to version 2.14.0

* Support for serializing and deserializing Java records
* Add JsonArray.asList and JsonObject.asMap view methods
* Add Gson.fromJson(..., TypeToken) overloads
* Make Object and JsonElement deserialization iterative rather than recursive
* Add support for reflection access filter
* Put module-info.class into Multi-Release JAR folder
* Add GsonBuilder.disableJdkUnsafe()

- Add BuildRequires on google-errorprone-annotations for compiling and Javadoc generation
- Refactor ant build to support Java 9+ modular compilation of module-info.java

- Rewrite the build system for ant to avoid potential build cycles with upcoming Maven 4

Upgrade to upstream version 1.6.5

* Changes of version 1.6.5

- Fixed a vulnerability (bsc#1284124, CVE-2026-104721) closely related to CVE-2026-19880 (bsc#1284020). The fix made in version 1.6.3, which strips forward and backward slashes from MDC values, was not sufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses.
MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.
- When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely.
- SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.
* Changes of version 1.6.4
- Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>.
+ OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change.
Existing encoders need no changes.
+ Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.
+ Fixed a data race on the logger count in LoggerContext.
Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger.
+ TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture.
+ If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.
+ The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.
* Changes of version 1.6.3 + In relation to CVE-2026-19880 (bsc#1284020), MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).
+ Colour console support is split out into a dedicated JansiConsoleAppender (ch.qos.logback.core.JansiConsoleAppender). It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next.
+ The withJansi property on ConsoleAppender is deprecated.
Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.
+ ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM.
+ Invocation throttling helpers were reworked:
SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.
+ The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.
* Changes of version 1.6.2 + Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.
+ Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:
<property name='logback.skipCallerContradictionAnalysis' value='true'/> + SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect.
See the documentation on restricting client access.
+ Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.
+ Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.
+ Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.
* Changes of version 1.6.1 + In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. `.gz`, `.zip`, `.xz`). Previously it used a nanotime-based `.tmp` suffix. This makes the file easier to identify if compression fails during rollover.
+ On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.
+ ConsoleAppender with <withJansi> now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class.
This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests.
+ LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout.
Previously, a missing layout (for example after an ignored <if>/<then>/<else> branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss.
+ FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not.
+ More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

Upgrade to upstream version 1.6.0

* Notable changes In version 1.5.37 and subsequently in 1.6.x, support for Janino-based conditional expressions was removed. Evaluating arbitrary Java expressions with the Janino library had led to numerous security vulnerabilities.
If you are upgrading from a version earlier than 1.5.37 and your configuration files still use those older Janino-style conditionals, you must migrate them to the new format using the <condition> element (available since version version 1.5.20).
The <condition> element accepts implementations of the PropertyCondition interface to decide whether a branch of the configuration should apply. Logback-core ships with several implementations of said interface. For details, see the https://logback.qos.ch/manual/configuration.html#conditional
* Changes + Removed deprecated variables
- ch.qos.logback.classic.PatternLayout#DEFAULT_CONVERTER_MAP
- ch.qos.logback.classic.PatternLayout#defaultConverterMap
- ch.qos.logback.classic.util.ContextInitializer #AUTOCONFIG_FILE
- ch.qos.logback.classic.util.ContextInitializer #TEST_AUTOCONFIG_FILE
- ch.qos.logback.classic.util.ContextInitializer #CONFIG_FILE_PROPERTY + Remove deprecated methods
- ch.qos.logback.classic.PatternLayout #getDefaultConverterMap()
- ch.qos.logback.core.util.ExecutorServiceUtil #newExecutorService()
- ch.qos.logback.core.util.VersionUtil #getVersionOfArtifact(Class<?>)
- ch.qos.logback.core.pattern.PatternLayoutBase #setContextForConverters
- ch.qos.logback.core.pattern.PatternLayoutEncoderBase #setOutputPatternAsPresentationHeader
- ch.qos.logback.core.joran.spi.ConfigurationWatchList #changeDetected
- ch.qos.logback.core.joran.GenericXMLConfigurator #informContextOfURLUsedForConfiguration
- ch.qos.logback.core.model.ModelUtil#setProperty
- ch.qos.logback.core.model.ModelUtil#setProperties
- ch.qos.logback.core.joran.action.PreconditionValidator #generic
- ch.qos.logback.core.util.EnvUtil#logbackVersion
- ch.qos.logback.classic.util.ClassicEnvUtil #getVersionOfLogbackClassic + Remove deprecated class
- ch.qos.logback.classic.turbo.ReconfigureOnChangeFilter + In AsyncAppenderBase, the put(ILoggingEvent) method now has the protected modifier to allow access from derived classes + Bump SLF4J dependency to version 2.0.18.

Upgrade to upstream version 1.5.38

* Change of 1.5.38 + In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered
* Change of 1.5.37 + Given the numerous vulnerabilities related to conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for such expressions has been removed

- Do not use the slf4j2 compatibility package, as the base slf4j package is now on version 2.0.18

Upgrade to upstream version 1.5.36

* Changes of 1.5.36

+ The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks (bsc#1269222, CVE-2026-13006).

* Changes of 1.5.35

+ The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions (bsc#1269222, CVE-2026-13006). Please note that the version 1.5.36 provides the full fix to this vulnerability.
+ Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.
+ ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.
+ The logback-examples module is now included in the set of artifacts published to Maven Central.
+ JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

Upgrade to upstream version 1.5.34

* General changes between series

+ The 1.2.x series has been deprecated for several years and is no longer maintained + In Logback 1.2.x/1.3.x, few optional components depend on Java EE, whereas in logback versions 1.4.x/1.5.x, these optional components depend on Jakarta EE. The 1.5.x series continues the 1.4.x series, but with logback-access relocated to its own repository

* Fixes

+ In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException (#1040) + HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes (bsc#1266783, CVE-2026-10532) + PropertiesConfiguratorModelHandler now registers properties file URLs to the ConfigurationWatchList when scan is enabled (via local scan='true' attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs (issues/1034) + When processing <conversionRule> elements and both class and converterClass attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued (issues/1031) + HardenedModelInputStream will no longer accept to deserialize all classes located under the 'java.lang' and 'java.util' packages but only a limited number of explicitly authorized classes in those packages (bsc#1266783, CVE-2026-9828) + SSL parameters for SSLSocketAppender now enable hostname verification by default. Moreover, the default protocol is now 'TLSv1.2' + When printing the status message field, ViewStatusMessagesServletBase now escapes special characters such as '&' as character entities

- Require apache-parent 40+ because of changed version variables for surefire plugins

Upgrade to Apache Maven parent POM version 50

* Breaking changes + Update configuration for apache-rat-plugin 0.18 + Bump org.codehaus.plexus:plexus-utils from 4.0.3 to 4.1.0 + Property version.maven-surefire was removed in apache/maven-apache-parent#588, should be replaced by version.maven-surefire-plugin, version.maven-failsafe-plugin or version.maven-surefire-report-plugin
* New features and improvements + Exclude dev-tooling dotfiles from RAT check
* Documentation updates + Document optional repository profiles for Apache snapshots and staging

Upgrade to Apache Maven parent POM version 49

* New features and improvements + Upgrade parent to 39 to benefit from push-to-atr profile

Upgrade to Apache Maven parent POM version 48
* New features and improvements + Add configuration for rerunning failing integration tests
* Bug Fixes + Fix enforce-bytecode-version configuration for ignored scopes
* Maintenance + Update banner links + Simplify docs configuration + Remove taglist/jxr/checkstyle/surefire/pmd-reports + Update Maven logos

Upgrade to Apache Maven parent POM version 47

Upgrade to Apache Maven parent POM version 46

* Breaking changes + Require Maven 3.6.3+ from plugins + Update rat plugin configuration + Use spotless 3 when running on JDK >= 17 + Drop Doxia Tools parent pom
* New features and improvements + MPOM-387: Exclude test scope from enforcedBytecodeVersion + feat: activate Fluido skin's anchorJs + Enhance target JDK definition for JDK >= 9 + Always render a GitHub ribbon on the right-hand side
* Maintenance + MPOM-277: Move maven-invoker-plugin configuration to one place + Remove doxia-tools from documentations + feat: enable prevent branch protection rules + Add Apache 2.0 LICENSE file

Upgrade to Apache Maven parent POM version 45

* New features and improvements + Use a standard tag template for releases
* Bug Fixes + Use spotless / palantirJavaFormat - 2.56.0 for all JDKs
* Build + Allow manually executing release-drafter

Upgrade to Apache Maven parent POM version 44

* Breaking changes + Move snapshot repositories in a profile + Check test code by checkstyle
* New features and improvements + Move snapshot repositories in a profile + Introduce property maven.site.path.suffix to allow override site path + Use v@{project.version} as tag template for releases + import KEYS history from svn + Add licenseText to modello + Update site descriptor to 2.0 + Check test code by checkstyle + Add issues templates + Accept all line endings with spotless + Enable automatic formatter when not on CI + Bump com.diffplug.spotless:spotless-maven-plugin to enable the sortpom/quiet option
* Bug Fixes + Fix asf.yaml syntax

+ Skip render empty taglist report

Update to upstream version 2.0.24

* New features and improvements + Fix PathConflictResolver OOM on dense dependency graphs
* Bug Fixes + Fix flaky IpcClientForkedTest on Windows + fix: synchronize IPC stream access + fix: propagate fatal errors from Jetty request content + Use structured logging in the IPC server + MRESOLVER-2142: Increase HTTP3 port allocation retries + Honor system proxy credentials in Apache transport
* Documentation updates + docs: rewrite how-resolver-works.md to STE rules + docs: refresh resolver misconception references + docs: clarify checksum trust boundaries + fix: correct config filename to .mvn/maven.config + Use configuration key as link label

Update to upstream version 2.0.23

* New features and improvements + Finish the repo key story + Fix: log only once the warning in DefRemoteRepoMan + Fix #2058: Add links to configuration page + Eliminate per-node HashSet allocation in PathConflictResolver
* Bug Fixes + fix: accept locally cached artifacts via same-id fallback when tracking URL changes + Fix listener error swallowing + MRESOLVER-379: Preserve relocated candidates from version ranges + Create the local repository directory before resolving its real path + Optimize TrackingFileManager unit tests and fix potential lock leaks + Validate the repository key used in checksum summary file names + fix: bound response reads and sanitize remote-derived strings + fix: earn trust labels through verification and bind tracking to URL + fix: bind credentials to origin and reject TLS downgrade redirects + fix: prevent remote signals from weakening operator-configured policy + fix: atomic file publication and authenticated IPC lock daemon + fix: deploy-side integrity must fail closed + fix: harden opt-in transport and lock backends against unauthenticated infrastructure + Compose named lock keys one segment per coordinate field + Resolve file transport locations with path operations instead of substring matching + Validate coordinate components in the Maven 2 layout and local path composer
* Documentation updates + docs: Clarify trusted checksum sources + Fix #2058: Add links to configuration page
* Maintenance + test: move from minio docker image + Fix listener error swallowing + Fix: tidy up f013 + Fix #2096: harden NamedLocksTrackingFileManagerTest against CI load + Carry repository provenance into aggregateRepositories + Validate the repository key used as a local repository path ...

Please note that the description has been truncated due to length. Please refer to vendor advisory for the full description.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 379426

File Name: suse_SU-2026-5189-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.4

Percentile: 96.92

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2024-12798

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7

Threat Score: 3.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

CVSS Score Source: CVE-2026-13006

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:apache-commons-cli, p-cpe:/a:novell:suse_linux:aqute-bndlib, p-cpe:/a:novell:suse_linux:glassfish-annotation-api, p-cpe:/a:novell:suse_linux:google-gson, p-cpe:/a:novell:suse_linux:httpcomponents-client, p-cpe:/a:novell:suse_linux:httpcomponents-core, p-cpe:/a:novell:suse_linux:jcl-over-slf4j, p-cpe:/a:novell:suse_linux:jline3-jansi-core, p-cpe:/a:novell:suse_linux:jline3-native, p-cpe:/a:novell:suse_linux:jline3-terminal-jni, p-cpe:/a:novell:suse_linux:jline3-terminal, p-cpe:/a:novell:suse_linux:jul-to-slf4j, p-cpe:/a:novell:suse_linux:log4j-over-slf4j, p-cpe:/a:novell:suse_linux:maven-artifact-transfer, p-cpe:/a:novell:suse_linux:maven-lib, p-cpe:/a:novell:suse_linux:maven-resolver-api, p-cpe:/a:novell:suse_linux:maven-resolver-connector-basic, p-cpe:/a:novell:suse_linux:maven-resolver-impl, p-cpe:/a:novell:suse_linux:maven-resolver-named-locks, p-cpe:/a:novell:suse_linux:maven-resolver-spi, p-cpe:/a:novell:suse_linux:maven-resolver-transport-apache, p-cpe:/a:novell:suse_linux:maven-resolver-transport-file, p-cpe:/a:novell:suse_linux:maven-resolver-transport-jdk11, p-cpe:/a:novell:suse_linux:maven-resolver-transport-jdk8, p-cpe:/a:novell:suse_linux:maven-resolver-transport-jdk, p-cpe:/a:novell:suse_linux:maven-resolver-transport-wagon, p-cpe:/a:novell:suse_linux:maven-resolver-util, p-cpe:/a:novell:suse_linux:maven-wagon-file, p-cpe:/a:novell:suse_linux:maven-wagon-http-shared, p-cpe:/a:novell:suse_linux:maven-wagon-http, p-cpe:/a:novell:suse_linux:maven-wagon-provider-api, p-cpe:/a:novell:suse_linux:maven, p-cpe:/a:novell:suse_linux:methanol, p-cpe:/a:novell:suse_linux:osgi-annotation, p-cpe:/a:novell:suse_linux:osgi-compendium, p-cpe:/a:novell:suse_linux:osgi-service-subsystem, p-cpe:/a:novell:suse_linux:slf4j, p-cpe:/a:novell:suse_linux:xmvn-api, p-cpe:/a:novell:suse_linux:xmvn-connector, p-cpe:/a:novell:suse_linux:xmvn-core, p-cpe:/a:novell:suse_linux:xmvn-install, p-cpe:/a:novell:suse_linux:xmvn-minimal, p-cpe:/a:novell:suse_linux:xmvn-mojo, p-cpe:/a:novell:suse_linux:xmvn-resolve, p-cpe:/a:novell:suse_linux:xmvn-subst, p-cpe:/a:novell:suse_linux:xmvn

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/11/2026

Vulnerability Publication Date: 12/19/2024

Reference Information

CVE: CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-104721, CVE-2026-10532, CVE-2026-1225, CVE-2026-13006, CVE-2026-19880, CVE-2026-9828

SuSE: SUSE-SU-2026:5189-1

Detections

Analytics

SUSE SLED15: apache-commons-cli / aqute-bndlib / glassfish-annotation-api / etc (SUSE-SU-2026:5189-1)

high Nessus Plugin ID 379426

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information