The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0246 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1313 advisory.

  - rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection     responses (CVE-2015-1820)

  - rubygem-rest-client: unsanitized application logging (CVE-2015-3448)

  - foreman: Managing repositories with their id via hammer does not respect the role filters (CVE-2017-2662)

  - rack-protection: Timing attack in authenticity_token.rb (CVE-2018-1000119)

  - rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

  - netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)

  - foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)

  - rubygem-activeview: Cross-site scripting in translation helpers (CVE-2020-15169)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - rubygem-activestorage: circumvention of file size limits in ActiveStorage (CVE-2020-8162)

  - rubygem-actionpack: possible strong parameters bypass (CVE-2020-8164)

  - rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and     RedisCacheStore (CVE-2020-8165)

  - rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token (CVE-2020-8166)

  - rubygem-actionview: CSRF vulnerability in rails-ujs (CVE-2020-8167)

  - rubygem-rails: untrusted users able to run pending migrations in production (CVE-2020-8185)

  - django: potential SQL injection via tolerance parameter in GIS functions and aggregates on Oracle     (CVE-2020-9402)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0247 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0248 advisory.

  - apache-httpclient: incorrect handling of malformed authority component in request URIs (CVE-2020-13956)

  - resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's     WebApplicationException handling (CVE-2020-25633)

  - wildfly: resource adapter logs plaintext JMS password at warning level on connection error     (CVE-2020-25640)

  - wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-     controller (CVE-2020-25689)

  - undertow: special character in query results in server errors (CVE-2020-27782)

  - wildfly: Potential Memory leak in Wildfly when using OpenTracing (CVE-2020-27822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
145408	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0246)	Nessus	Red Hat Local Security Checks	1/25/2021	1/26/2024	medium
148903	RHEL 7 : Satellite 6.9 Release (Moderate) (RHSA-2021:1313)	Nessus	Red Hat Local Security Checks	4/21/2021	1/23/2023	high
145405	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0247)	Nessus	Red Hat Local Security Checks	1/25/2021	1/26/2024	medium
145407	RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.3.5 (RHSA-2021:0248)	Nessus	Red Hat Local Security Checks	1/25/2021	1/26/2024	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium