The version of AOS installed on the remote host is prior to 5.20.3.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.3.5 advisory.

  - CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw     V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. (CVE-2022-23307)

  - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the     values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be     included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or     headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue     only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
    Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized     SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2022-23305)

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

  - Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data     which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when     listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
    (CVE-2019-17571)

  - Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an     SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent     through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1 (CVE-2020-9488)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5460 advisory.

    Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on the WildFly     application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 6.4.24 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 6.4.23 and includes bug fixes and enhancements. See the Red Hat     JBoss Enterprise Application Platform 6.4.24 Release Notes for information about the most significant bug     fixes and enhancements included in this release.

    Security Fix(es):

    * tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS     (CVE-2020-13935)

    * jbossweb: Incomplete fix of CVE-2020-13935 for WebSocket in JBossWeb could lead to DoS (CVE-2020-14384)

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:14881-1 advisory.

    - CVE-2022-23307: Fixed deserialization flaw in the chainsaw component of log4j leading to malicious code     execution. (bsc#1194844)
    - CVE-2022-23305: Fixed SQL injection when application is configured to use JDBCAppender. (bsc#1194843)
    - CVE-2022-23302: Fixed remote code execution when application is configured to use JMSSink. (bsc#1194842)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0226-1 advisory.

    - CVE-2022-23307: Fix deserialization issue by removing the chainsaw sub-package. (bsc#1194844)
    - CVE-2022-23305: Fix SQL injection by removing src/main/java/org/apache/log4j/jdbc/JDBCAppender.java.
    (bsc#1194843)
    - CVE-2022-23302: Fix remote code execution by removing src/main/java/org/apache/log4j/net/JMSSink.java.
    (bsc#1194842)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0475 advisory.

    The ovirt-engine package provides the manager for virtualization environments.
    This manager enables admins to define hosts and networks, as well as to add     storage, create VMs and manage user permissions.

    Security Fix(es):

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    Bug Fix(es):

    * With this release, the ovirt-engine-extension-logger-log4j package has been removed. It is replaced by     an internal ovirt-engine implementation.

    When upgrading from earlier Red Hat Virtualization versions to RHV 4.4.10, the ovirt-engine-extension-     logger-log4j package is uninstalled if it is present. If you used the ovirt-engine-extension-logger-log4j     in earlier Red Hat Virtualization versions, you must manually remove the ovirt-engine-extension-logger-     log4j configuration files and configure the new feature for sending log records to a remote syslog     service, as outlined in the Administration Guide.

    After a successful upgrade to RHV 4.4.10, you can uninstall log4j12 without breaking the Red Hat     Virtualization setup by running the following command: `$ dnf remove log4j12`. (BZ#2044277)

    * Previously, when preparing a host with FIPS kernel parameters enabled, the boot UUID parameter was blank     after reboot. In this release, the UUID is present in the kernel arguments. Enabling FIPS does not change     the UUID after reboot. (BZ#2013430)

    * Because installing the self-hosted engine with Cockpit is deprecated, the 'Installing Red Hat     Virtualization as a self-hosted engine using the Cockpit web interface' link     on the Red Hat Virtualization Administration Portal login page has been replaced with the Installing Red     Hat Virtualization as a self-hosted engine using the command line link. (BZ#1992476)

    * In this release, Red Hat Virtualization 4.4.10 requires snmp4j version 3.6.4 or later, which no longer     depends on the log4j library. (BZ#2044257)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9419 advisory.

    - Fix CVE-2022-23302, CVE-2022-23305, CVE-2022-23307, CVE-2017-5645

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0294 advisory.

    Parfait is a Java performance monitoring library that collects metrics and exposes them through a variety     of outputs. It provides APIs for extracting performance metrics from the JVM and other sources. It     interfaces to Performance Co-Pilot (PCP) using the Memory Mapped Value (MMV) machinery for extremely     lightweight instrumentation.

    Security Fix(es):

    * log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender (CVE-2022-23305)

    * log4j: Unsafe deserialization flaw in Chainsaw log viewer (CVE-2022-23307)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender     (CVE-2021-4104)

    * log4j: Remote code execution in Log4j 1.x when application is configured to use JMSSink (CVE-2022-23302)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0290 advisory.

  - JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write     access to the Log4j configuration. The attacker can provide TopicBindingName and     TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result     in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2     when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2021-4104)

  - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker     has write access to the Log4j configuration or if the configuration references an LDAP service the     attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing     JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to     CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which     is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2     as it addresses numerous other issues from the previous versions. (CVE-2022-23302)

  - By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the     values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be     included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or     headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue     only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
    Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized     SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions. (CVE-2022-23305)

  - CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw     V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. (CVE-2022-23307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0006 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-4104:
    JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write     access to the Log4j configuration. The attacker can provide TopicBindingName and     TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result     in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2     when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions.

    CVE-2022-23302:
    JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker     has write access to the Log4j configuration or if the configuration references an LDAP service the     attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing     JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to     CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which     is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2     as it addresses numerous other issues from the previous versions.

    CVE-2022-23305:
    By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the     values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be     included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or     headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue     only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
    Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized     SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of     life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the     previous versions.

    CVE-2022-23307:
    CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw     V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7590-1 advisory.

    It was discovered that several deserialization issues existed within Apache Log4j. An attacker could     possibly use these issues to enable the execution of arbitrary code. (CVE-2022-23302, CVE-2022-23305,     CVE-2022-23307)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the installation of Apache Log4j on the remote host is 1.x and is no longer supported. Log4j reached its end of life prior to 2016. Additionally, Log4j 1.x is affected by multiple vulnerabilities, including :

  - Log4j includes a SocketServer that accepts serialized log events and deserializes them without verifying whether     the objects are allowed or not. This can provide an attack vector that can be exploited. (CVE-2019-17571)

  - Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS     connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that     appender. (CVE-2020-9488)

  - JMSSink uses JNDI in an unprotected manner allowing any application using the JMSSink to be vulnerable if it is     configured to reference an untrusted site or if the site referenced can be accesseed by the attacker.
    (CVE-2022-23302)

Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities.

ID	Name	Product	Family	Published	Updated	Severity
165276	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.3.5)	Nessus	Misc.	9/21/2022	7/22/2025	critical
162638	RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.24 (RHSA-2022:5460)	Nessus	Red Hat Local Security Checks	7/1/2022	11/7/2024	critical
157154	SUSE SLES11 Security Update : log4j (SUSE-SU-2022:14881-1)	Nessus	SuSE Local Security Checks	1/27/2022	6/26/2026	critical
157233	SUSE SLED15 / SLES15 Security Update : log4j12 (SUSE-SU-2022:0226-1)	Nessus	SuSE Local Security Checks	1/29/2022	6/26/2026	critical
157854	RHEL 8 : RHV Manager (ovirt-engine) security update [ovirt-4.4.10-1] (Low) (RHSA-2022:0475)	Nessus	Red Hat Local Security Checks	2/9/2022	1/21/2026	critical
161444	Oracle Linux 6 : log4j (ELSA-2022-9419)	Nessus	Oracle Linux Local Security Checks	5/23/2022	10/22/2024	critical
164861	RHEL 8 : parfait:0.5 (RHSA-2022:0294)	Nessus	Red Hat Local Security Checks	9/8/2022	11/7/2024	critical
184625	Rocky Linux 8 : parfait:0.5 (RLSA-2022:0290)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	critical
236700	Alibaba Cloud Linux 3 : 0006: parfait:0.5 (ALINUX3-SA-2022:0006)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	critical
240493	Ubuntu 14.04 LTS : Apache Log4j vulnerabilities (USN-7590-1)	Nessus	Ubuntu Local Security Checks	6/25/2025	6/25/2025	critical
156860	Apache Log4j 1.x Multiple Vulnerabilities	Nessus	Misc.	1/19/2022	1/21/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical