The version of java-11-amazon-corretto installed on the remote host is prior to 11.0.18+10-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1918 advisory.

    Enhance DTLS performance: DTLS does not avail itself of the HelloVerifyRequest message which opens     opportunities for DoS. (CVE-2023-21835)

    Better Banking of Sounds: JARSoundbankReader can load classes from remote URLs. (CVE-2023-21843)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0195 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1;
    Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a     partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). (CVE-2023-21835)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE     (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17,     17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability applies to Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g.,     code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not     apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed     by an administrator). (CVE-2023-21843)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-327768681a advisory.

    # New in release [OpenJDK 11.0.18](https://bit.ly/openjdk11018) (2023-01-17)

    ## CVEs Fixed

      - CVE-2023-21835
      - CVE-2023-21843

    ## Security Fixes

      - JDK-8286070: Improve UTF8 representation
      - JDK-8286496: Improve Thread labels
      - JDK-8287411: Enhance DTLS performance
      - JDK-8288516: Enhance font creation
      - JDK-8289350: Better media supports
      - JDK-8293554: Enhanced DH Key Exchanges
      - JDK-8293598: Enhance InetAddress address handling
      - JDK-8293717: Objective view of ObjectView
      - JDK-8293734: Improve BMP image handling
      - JDK-8293742: Better Banking of Sounds
      - JDK-8295687: Better BMP bounds

    ## Major Changes

    ### JDK-8295687: Better BMP bounds

    Loading a linked ICC profile within a BMP image is now disabled by default. To re-enable it, set the new     system property     `sun.imageio.bmp.enabledLinkedProfiles` to `true`.  This new property replaces the old property,     `sun.imageio.plugins.bmp.disableLinkedProfiles`.

    ### JDK-8293742: Better Banking of Sounds

    Previously, the SoundbankReader implementation, `com.sun.media.sound.JARSoundbankReader`, would download a     JAR soundbank from a URL.  This behaviour is now disabled by default. To re-enable it, set the new system     property `jdk.sound.jarsoundbank` to `true`.

    ### [JDK-8282730](https://bugs.openjdk.org/browse/JDK-8282730): New Implementation Note for LoginModule on     Removing Null from a Principals or Credentials Set

    Back in OpenJDK 9, [JDK-8015081](https://bugs.openjdk.org/browse/JDK-8015081) changed the `Set`     implementation used to hold principals and credentials so that it rejected `null` values. Attempts to call     `add(null)`, `contains(null)` or `remove(null)` were changed to throw a `NullPointerException`.

    However, the `logout()` methods in the `LoginModule` implementations within the JDK were not updated to     check for `null` values, which may occur in the event of a failed login. As a result, a `logout()` call     may throw a `NullPointerException`.

    The `LoginModule` implementations have now been updated with such checks and an implementation note added     to the specification to suggest that the same change is made in third party modules.  Developers of third     party modules are advised to verify that their `logout()` method does not throw a `NullPointerException`.

    ### JDK-8287411: Enhance DTLS performance

    The JDK now exchanges DTLS cookies for all handshakes, new and resumed. The previous behaviour can be re-     enabled by setting the new system property `jdk.tls.enableDtlsResumeCookie` to `false`.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d6bd6ec00b advisory.

    # New in release [OpenJDK 11.0.18](https://bit.ly/openjdk11018) (2023-01-17)

    ## CVEs Fixed

      - CVE-2023-21835
      - CVE-2023-21843

    ## Security Fixes

      - JDK-8286070: Improve UTF8 representation
      - JDK-8286496: Improve Thread labels
      - JDK-8287411: Enhance DTLS performance
      - JDK-8288516: Enhance font creation
      - JDK-8289350: Better media supports
      - JDK-8293554: Enhanced DH Key Exchanges
      - JDK-8293598: Enhance InetAddress address handling
      - JDK-8293717: Objective view of ObjectView
      - JDK-8293734: Improve BMP image handling
      - JDK-8293742: Better Banking of Sounds
      - JDK-8295687: Better BMP bounds

    ## Major Changes

    ### JDK-8295687: Better BMP bounds

    Loading a linked ICC profile within a BMP image is now disabled by default. To re-enable it, set the new     system property     `sun.imageio.bmp.enabledLinkedProfiles` to `true`.  This new property replaces the old property,     `sun.imageio.plugins.bmp.disableLinkedProfiles`.

    ### JDK-8293742: Better Banking of Sounds

    Previously, the SoundbankReader implementation, `com.sun.media.sound.JARSoundbankReader`, would download a     JAR soundbank from a URL.  This behaviour is now disabled by default. To re-enable it, set the new system     property `jdk.sound.jarsoundbank` to `true`.

    ### [JDK-8282730](https://bugs.openjdk.org/browse/JDK-8282730): New Implementation Note for LoginModule on     Removing Null from a Principals or Credentials Set

    Back in OpenJDK 9, [JDK-8015081](https://bugs.openjdk.org/browse/JDK-8015081) changed the `Set`     implementation used to hold principals and credentials so that it rejected `null` values. Attempts to call     `add(null)`, `contains(null)` or `remove(null)` were changed to throw a `NullPointerException`.

    However, the `logout()` methods in the `LoginModule` implementations within the JDK were not updated to     check for `null` values, which may occur in the event of a failed login. As a result, a `logout()` call     may throw a `NullPointerException`.

    The `LoginModule` implementations have now been updated with such checks and an implementation note added     to the specification to suggest that the same change is made in third party modules.  Developers of third     party modules are advised to verify that their `logout()` method does not throw a `NullPointerException`.

    ### JDK-8287411: Enhance DTLS performance

    The JDK now exchanges DTLS cookies for all handshakes, new and resumed. The previous behaviour can be re-     enabled by setting the new system property `jdk.tls.enableDtlsResumeCookie` to `false`.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0200 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [rhel-8] (BZ#2157797)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0196 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0199 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0192 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only     mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS     database.  This update allows more control over database use using two new properties - fips.nssdb.path     and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via     command-line arguments to the Java virtual machine (RHBZ#2147473)

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [rhel-8] (BZ#2153010)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0190 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0198 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0192 advisory.

    [1:17.0.6.0.10-3]
    - Add missing release note for JDK-8295687
    - Resolves: rhbz#2160111

    [1:17.0.6.0.10-3]
    - Update FIPS support to bring in latest changes
    - * OJ1357: Fix issue on FIPS with a SecurityManager in place
    - Related: rhbz#2147473

    [1:17.0.6.0.10-3]
    - Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat
    - Related: rhbz#2160111

    [1:17.0.6.0.10-2]
    - Update to jdk-17.0.6.0+10
    - Update release notes to 17.0.6.0+10
    - Switch to GA mode for release
    - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
    - Related: rhbz#2153010

    [1:17.0.6.0.9-0.2.ea]
    - Update to jdk-17.0.6+9
    - Update release notes to 17.0.6+9
    - Drop local copy of JDK-8293834 now this is upstream
    - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
    - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
    - Resolves: rhbz#2153010

    [1:17.0.6.0.1-0.2.ea]
    - Update to jdk-17.0.6+1
    - Update release notes to 17.0.6+1
    - Switch to EA mode for 17.0.6 pre-release builds.
    - Re-enable EA upstream status check now it is being actively maintained.
    - Drop JDK-8294357 (tzdata2022d) & JDK-8295173 (tzdata2022e) local patches which are now upstream
    - Drop JDK-8275535 local patch now this has been accepted and backported upstream
    - Bump tzdata requirement to 2022e now the package is available in RHEL
    - Related: rhbz#2153010

    [1:17.0.5.0.8-4]
    - Update FIPS support to bring in latest changes
    - * Add nss.fips.cfg support to OpenJDK tree
    - * RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
    - * Remove forgotten dead code from RH2020290 and RH2104724
    - Drop local nss.fips.cfg.in handling now this is handled in the patched OpenJDK build
    - Resolves: rhbz#2147473

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5897-1 advisory.

    Juraj Somorovsky, Marcel Maehren, Nurullah Erinola, and Robert Merget discovered that the DTLS     implementation in the JSSE subsystem of OpenJDK did not properly restrict handshake initiation requests     from clients. A remote attacker could possibly use this to cause a denial of service. (CVE-2023-21835)

    Markus Loewe discovered that the Java Sound subsystem in OpenJDK did not properly validate the origin of a     Soundbank. An attacker could use this to specially craft an untrusted Java application or applet that     could load a Soundbank from an attacker controlled remote URL. (CVE-2023-21843)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0067-1 advisory.

    - Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine
    - Including Oracle October 2024 and January 2025 CPU changes
      * CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711),         CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719),         CVE-2025-21502 (boo#1236278)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.49/

    - Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine
    - Including Oracle July 2024 CPU changes
      * CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047),         CVE-2024-21140 (boo#1228048), CVE-2024-21147 (boo#1228052),         CVE-2024-21145 (boo#1228051)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.46/

    - Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine
    - Including Oracle April 2024 CPU changes
      * CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986),         CVE-2024-21011 (boo#1222979), CVE-2024-21068 (boo#1222983)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.44/

    - Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine
    - Including Oracle January 2024 CPU changes
      * CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903),         CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908),         CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.43/

    - Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine
    - Including Oracle October 2023 CPU changes
      * CVE-2023-22081, boo#1216374
      * CVE-2023-22025, boo#1216339
    - Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214
      * For other OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.41

    - Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine
      * JDK-8313765: Invalid CEN header (invalid zip64 extra data         field size)

    - Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine
    - Including Oracle July 2023 CPU changes
      * CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474),         CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479),         CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482),         CVE-2023-25193 (boo#1207922)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.40

    - Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine
    - Including Oracle April 2023 CPU changes
      * CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631),         CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634),         CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636),         CVE-2023-21968 (boo#1210637)
      * OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.38

    - Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine
      * including Oracle January 2023 CPU changes
        - CVE-2023-21835, boo#1207246
        - CVE-2023-21843, boo#1207248
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.36

    - Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine
      * Including Oracle October 2022 CPU changes         CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473),         CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475),         CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
      * Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.35

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170444	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2023-1918)	Nessus	Amazon Linux Local Security Checks	1/24/2023	12/11/2024	low
170861	CentOS 7 : java-11-openjdk (RHSA-2023:0195)	Nessus	CentOS Local Security Checks	1/30/2023	12/22/2023	low
170995	Fedora 36 : java-11-openjdk (2023-327768681a)	Nessus	Fedora Local Security Checks	2/4/2023	11/14/2024	low
170996	Fedora 37 : java-11-openjdk (2023-d6bd6ec00b)	Nessus	Fedora Local Security Checks	2/4/2023	11/14/2024	low
170131	RHEL 8 : java-11-openjdk (RHSA-2023:0200)	Nessus	Red Hat Local Security Checks	1/18/2023	11/7/2024	low
170132	RHEL 8 : java-11-openjdk (RHSA-2023:0196)	Nessus	Red Hat Local Security Checks	1/18/2023	11/7/2024	low
170138	RHEL 8 : java-11-openjdk (RHSA-2023:0199)	Nessus	Red Hat Local Security Checks	1/18/2023	11/7/2024	low
170139	RHEL 8 : java-17-openjdk (RHSA-2023:0192)	Nessus	Red Hat Local Security Checks	1/18/2023	11/8/2024	low
170141	RHEL 8 : java-17-openjdk (RHSA-2023:0190)	Nessus	Red Hat Local Security Checks	1/18/2023	11/7/2024	low
170142	RHEL 8 : java-11-openjdk (RHSA-2023:0198)	Nessus	Red Hat Local Security Checks	1/18/2023	11/7/2024	low
170154	Oracle Linux 8 : java-17-openjdk (ELSA-2023-0192)	Nessus	Oracle Linux Local Security Checks	1/18/2023	10/22/2024	low
171969	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : OpenJDK vulnerabilities (USN-5897-1)	Nessus	Ubuntu Local Security Checks	2/28/2023	8/29/2024	low
216569	openSUSE 15 Security Update : java-17-openj9 (openSUSE-SU-2025:0067-1)	Nessus	SuSE Local Security Checks	2/21/2025	2/21/2025	critical

Detections

Analytics

Plugins Search

low

low

low

low

low

low

low

low

low

low

low

low

critical