The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7000 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [rhel-8] (BZ#2132503)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7012 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [rhel-8] (BZ#2131863)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7008 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) (BZ#2130373)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory:

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).     Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3     and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to     compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result     in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. (CVE-2022-21618)

  - VVulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle     GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. (CVE-2022-21624)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:     Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM     Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks     of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Java SE, Oracle GraalVM Enterprise Edition. (CVE-2022-21626)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenJDK installed on the remote host is prior to 7 <= 7u351 / 8 <= 8u342 / 11.0.0 <= 11.0.16 / 13.0.0 <= 13.0.12 / 15.0.0 <= 15.0.8 / 17.0.0 <= 17.0.4 / 19.0.0 <= 19.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022-10-18 advisory.

Please Note: Java CVEs do not always include OpenJDK versions, but are confirmed separately by Tenable using the patch versions from the referenced OpenJDK security advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,     11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2022-21626)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM     Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21618)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341,     8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2022-21628)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19;
    Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2022-39399)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,     11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. (CVE-2022-21619)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1,     17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of java-17-amazon-corretto installed on the remote host is prior to 17.0.5+8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1866 advisory.

    Title: Wider MultiByte conversionsBuffer overflow is possible due to incorrect byte count (should be     charactercount). (CVE-2022-21618)

    Title: Improve NTLM supportwriteSecurityBuffer() writes a serialized security buffer to be used for     NTLMauth. One of the fields that are serialized is a hostname provided by thename resolver. If this     hostname is very long, integer truncation occurs,which would allow a malicious hostname to be partially     re-interpreted assomething else following a hostname, once the security buffer is deserializedon the other     size. (CVE-2022-21619)

    Title: Improve JNDI lookupsJNDI DNS port numbers can be easily guessed and should be more random.
    (CVE-2022-21624)

    Title: Key X509 usagesDecoding of X509 keys may use excessive amount of heap memory. (CVE-2022-21626)

    Title: Better HttpServer serviceHttpServer eagerly accepts connections which may exceed the limit.
    (CVE-2022-21628)

    Title: Improve HTTP/1.1 client usageThe HTTP/2 connection cache caches connection based on the IP address     but notthe SNI which can allow spoofing for servers on the same IP. (CVE-2022-39399)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4080-1 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM     Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21618)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,     11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to     compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in     clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run     untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This     vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service     which supplies data to the APIs. (CVE-2022-21619)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1,     17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also     be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to     the APIs. (CVE-2022-21624)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf,     11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using     APIs in the specified Component, e.g., through a web service which supplies data to the APIs.
    (CVE-2022-21626)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341,     8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM     Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2022-21628)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19;
    Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or     delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2022-39399)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3307 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3307-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     February 06, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openjdk-11     Version        : 11.0.18+10-1~deb10u1     CVE ID         : CVE-2022-21619 CVE-2022-21624 CVE-2022-21626 CVE-2022-21628                      CVE-2022-39399 CVE-2023-21835 CVE-2023-21843

    Several vulnerabilities have been discovered in the OpenJDK Java runtime,     which may result in denial of service or spoofing.

    For Debian 10 buster, these problems have been fixed in version     11.0.18+10-1~deb10u1.

    We recommend that you upgrade your openjdk-11 packages.

    For the detailed security status of openjdk-11 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-11

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-f687000ef7 advisory.

    # New in release OpenJDK 17.0.5 (2022-10-18)

    * [Release announcement](https://bit.ly/openjdk1705)
    * [Full release notes](https://builds.shipilev.net/backports-monitor/release-notes-17.0.5.html)

    ## Security Fixes
      - JDK-8282252: Improve BigInteger/Decimal validation
      - JDK-8285662: Better permission resolution
      - JDK-8286077, CVE-2022-21618: Wider MultiByte conversions
      - JDK-8286511: Improve macro allocation
      - JDK-8286519: Better memory handling
      - JDK-8286526, CVE-2022-21619: Improve NTLM support
      - JDK-8286910, CVE-2022-21624: Improve JNDI lookups
      - JDK-8286918, CVE-2022-21628: Better HttpServer service
      - JDK-8287446: Enhance icon presentations
      - JDK-8288508: Enhance ECDSA usage
      - JDK-8289366, CVE-2022-39399: Improve HTTP/2 client usage
      - JDK-8289853: Update HarfBuzz to 4.4.1
      - JDK-8290334: Update FreeType to 2.12.1

    ## Major Changes

    ### [JDK-8278067](https://bugs.openjdk.org/browse/JDK-8278067): Make HttpURLConnection Default Keep Alive     Timeout Configurable     Two system properties have been added which control the keep alive behavior of HttpURLConnection in the     case where the server does not specify a keep alive time. Two properties are defined for controlling     connections to servers and proxies separately. They are:

    * `http.keepAlive.time.server`
    * `http.keepAlive.time.proxy`

    respectively. More information about them can be found on the [Networking Properties     page](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/net/doc-files/net-     properties.html).

    ### JDK-8286918: Better HttpServer service     The HttpServer can be optionally configured with a maximum connection limit by setting the     jdk.httpserver.maxConnections system property. A value of `0` or a negative integer is ignored and     considered to represent no connection limit. In the case of a positive integer value, any newly accepted     connections will be first checked against the current count of established connections and, if the     configured limit has been reached, then the newly accepted connection will be closed immediately.

    ### [JDK-8281181](https://bugs.openjdk.org/browse/JDK-8281181): CPU Shares Ignored When Computing Active     Processor Count     Previous JDK releases used an incorrect interpretation of the Linux cgroups parameter cpu.shares. This     might cause the JVM to use fewer CPUs than available, leading to an under utilization of CPU resources     when the JVM is used inside a container.

    Starting from this JDK release, by default, the JVM no longer considers cpu.shares when deciding the     number of threads to be used by the various thread pools. The `-XX:+UseContainerCpuShares` command-line     option can be used to revert to the previous behaviour. This option is deprecated and may be removed in a     future JDK release.

    ### [JDK-8269039](https://bugs.openjdk.org/browse/JDK-8269039): Disabled SHA-1 Signed JARs     JARs signed with SHA-1 algorithms are now restricted by default and treated as if they were unsigned. This     applies to the algorithms used to digest, sign, and optionally timestamp the JAR. It also applies to the     signature and digest algorithms of the certificates in the certificate chain of the code signer and the     Timestamp Authority, and any CRLs or OCSP responses that are used to verify if those certificates have     been revoked. These restrictions also apply to signed JCE providers.

    To reduce the compatibility risk for JARs that have been previously timestamped, there is one exception to     this policy:

    - Any JAR signed with SHA-1 algorithms and timestamped prior to January 01, 2019 will not be restricted.

    This exception may be removed in a future JDK release. To determine if your signed JARs are affected by     this change, run:
    ~~~     $ jarsigner -verify -verbose -certs`     ~~~     on the signed JAR, and look for instances of SHA1 or SHA-1 and disabled and a warning that the JAR     will be treated as unsigned in the output.

    For example:
    ~~~        Signed by CN=Signer        Digest algorithm: SHA-1 (disabled)        Signature algorithm: SHA1withRSA (disabled), 2048-bit key

       WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now     disabled by the security property:

       jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01     ~~~     JARs affected by these new restrictions should be replaced or re-signed with stronger algorithms.

    Users can, *at their own risk*, remove these restrictions by modifying the `java.security` configuration     file (or override it by using the `java.security.properties` system property) and removing SHA1 usage     SignedJAR & denyAfter 2019-01-01 from the     `jdk.certpath.disabledAlgorithms` security property and SHA1 denyAfter 2019-01-01 from the     `jdk.jar.disabledAlgorithms` security property.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk11 package has been released.

ID	Name	Product	Family	Published	Updated	Severity
166275	RHEL 8 : java-17-openjdk (RHSA-2022:7000)	Nessus	Red Hat Local Security Checks	10/19/2022	11/7/2024	medium
166281	RHEL 8 : java-11-openjdk (RHSA-2022:7012)	Nessus	Red Hat Local Security Checks	10/20/2022	11/7/2024	medium
166290	RHEL 7 : java-11-openjdk (RHSA-2022:7008)	Nessus	Red Hat Local Security Checks	10/20/2022	11/7/2024	medium
166316	Oracle Java SE Multiple Vulnerabilities (October 2022 CPU)	Nessus	Misc.	10/20/2022	10/9/2023	medium
166381	OpenJDK 7 <= 7u351 / 8 <= 8u342 / 11.0.0 <= 11.0.16 / 13.0.0 <= 13.0.12 / 15.0.0 <= 15.0.8 / 17.0.0 <= 17.0.4 / 19.0.0 <= 19.0.0 Multiple Vulnerabilities (2022-10-18	Nessus	Misc.	10/21/2022	10/9/2023	medium
166394	Amazon Linux 2 : java-17-amazon-corretto (ALAS-2022-1866)	Nessus	Amazon Linux Local Security Checks	10/21/2022	12/11/2024	medium
167951	SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2022:4080-1)	Nessus	SuSE Local Security Checks	11/19/2022	7/14/2023	medium
171041	Debian dla-3307 : openjdk-11-dbg - security update	Nessus	Debian Local Security Checks	2/6/2023	1/22/2025	low
211429	Fedora 37 : java-17-openjdk (2022-f687000ef7)	Nessus	Fedora Local Security Checks	11/15/2024	11/15/2024	medium
203865	Photon OS 3.0: Openjdk11 PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	7/24/2024	11/25/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

low

medium

high