The instance of McAfee ePolicy Orchestrator installed on the remote host is affected by multiple vulnerabilities including the following:

  - Multiple denial of service (DoS) vulnerabilities exist in McAfee ePolicy Orchestrator's bundled component Apache   Tomcat due to insufficient validation of user input. An unauthenticated, remote attacker can exploit these issues,   by sending specially crafted requests to an affected host, to impose DoS conditions (CVE-2020-9484, CVE-2020-13935). 

  - An authentication bypass vulnerability exists in McAfee ePolicy Orchestrator. An unauthenticated, remote attacker   can exploit this, to bypass authentication and access / update sensitive data (CVE-2020-14621).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

An update of the openjdk8 package has been released.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1506 advisory.

  - OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

  - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)     (CVE-2020-2773)

  - OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Further information about this update can be found in the Corretto 11 change log (https://github.com/corretto/corretto-11/blob/develop/CHANGELOG.md)

From Red Hat Security Advisory 2020:1515 :

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1515 advisory.

  - OpenJDK: Misplaced regular expression syntax error check     in RegExpScanner (Scripting, 8223898) (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in     regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to     uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in     ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

  - OpenJDK: Unexpected exceptions raised by     DOMKeyInfoFactory and DOMXMLSignatureFactory (Security,     8231415) (CVE-2020-2773)

  - OpenJDK: Re-use of single TLS session for new     connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer     (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Incorrect bounds checks in NIO Buffers     (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in     MethodType.readObject() (Libraries, 8235274)     (CVE-2020-2805)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency,     8236201) (CVE-2020-2830)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2241 advisory.

  - OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

  - OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

  - OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

  - OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for java-11-openjdk fixes the following issues :

Java was updated to jdk-11.0.7+10 (April 2020 CPU, bsc#1169511).

Security issues fixed :

CVE-2020-2754: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511).

CVE-2020-2755: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511).

CVE-2020-2756: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511).

CVE-2020-2757: Fixed an object deserialization issue that could have resulted in denial of service via crafted serialized input (bsc#1169511).

CVE-2020-2767: Fixed an incorrect handling of certificate messages during TLS handshakes (bsc#1169511).

CVE-2020-2773: Fixed the incorrect handling of exceptions thrown by unmarshalKeyInfo() and unmarshalXMLSignature() (bsc#1169511).

CVE-2020-2778: Fixed the incorrect handling of SSLParameters in setAlgorithmConstraints(), which could have been abused to override the defined systems security policy and lead to the use of weak crypto algorithms (bsc#1169511).

CVE-2020-2781: Fixed the incorrect re-use of single null TLS sessions (bsc#1169511).

CVE-2020-2800: Fixed an HTTP header injection issue caused by mishandling of CR/LF in header values (bsc#1169511).

CVE-2020-2803: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511).

CVE-2020-2805: Fixed a boundary check and type check issue that could have led to a sandbox bypass (bsc#1169511).

CVE-2020-2816: Fixed an incorrect handling of application data packets during TLS handshakes (bsc#1169511).

CVE-2020-2830: Fixed an incorrect handling of regular expressions that could have resulted in denial of service (bsc#1169511).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1514 advisory.

  - OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

  - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

  - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

  - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

  - OpenJDK: Incorrect handling of Certificate messages during TLS handshake (JSSE, 8232581) (CVE-2020-2767)

  - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)     (CVE-2020-2773)

  - OpenJDK: Incomplete enforcement of algorithm restrictions for TLS (JSSE, 8232424) (CVE-2020-2778)

  - OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

  - OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825) (CVE-2020-2800)

  - OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

  - OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

  - OpenJDK: Application data accepted before TLS handshake completion (JSSE, 8235691) (CVE-2020-2816)

  - OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE Embedded.
    Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed     Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in     the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such     as through a web service.(CVE-2020-14779)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JNDI). Supported versions     that are affected are Java SE: 7u271, 8u261, 11.0.8 and     15 Java SE Embedded: 8u261. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed     Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in     the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such     as through a web service.(CVE-2020-14781)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Hotspot). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data as well as unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: Applies to client and server deployment of Java.
    This vulnerability can be exploited through sandboxed     Java Web Start applications and sandboxed Java applets.
    It can also be exploited by supplying data to APIs in     the specified Component without using sandboxed Java     Web Start applications or sandboxed Java applets, such     as through a web service.(CVE-2020-14792)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized update, insert     or delete access to some of Java SE, Java SE Embedded     accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply     to Java deployments, typically in servers, that load     and run only trusted code (e.g., code installed by an     administrator).(CVE-2020-14798)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible data. Note:
    Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java     Web Start applications and sandboxed Java applets. It     can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web     Start applications or sandboxed Java applets, such as     through a web service.(CVE-2020-14782)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks require human interaction from a person other     than the attacker. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible data.
    Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and     run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security.
    This vulnerability does not apply to Java deployments,     typically in servers, that load and run only trusted     code (e.g., code installed by an     administrator).(CVE-2020-14796)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Libraries). Supported     versions that are affected are Java SE: 7u271, 8u261,     11.0.8 and 15 Java SE Embedded: 8u261. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized update, insert or delete access to some of     Java SE, Java SE Embedded accessible data. Note:
    Applies to client and server deployment of Java. This     vulnerability can be exploited through sandboxed Java     Web Start applications and sandboxed Java applets. It     can also be exploited by supplying data to APIs in the     specified Component without using sandboxed Java Web     Start applications or sandboxed Java applets, such as     through a web service.(CVE-2020-14797)

  - Vulnerability in the Java SE product of Oracle Java SE     (component: Libraries). Supported versions that are     affected are Java SE: 11.0.8 and 15. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE. Successful attacks of this vulnerability can     result in unauthorized read access to a subset of Java     SE accessible data. Note: This vulnerability applies to     Java deployments, typically in clients running     sandboxed Java Web Start applications or sandboxed Java     applets, that load and run untrusted code (e.g., code     that comes from the internet) and rely on the Java     sandbox for security. This vulnerability does not apply     to Java deployments, typically in servers, that load     and run only trusted code (e.g., code installed by an     administrator).(CVE-2020-14803)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6     and 14 Java SE Embedded: 8u241. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2020-2754)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Scripting). Supported     versions that are affected are Java SE: 8u241, 11.0.6     and 14 Java SE Embedded: 8u241. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Java     SE, Java SE Embedded.(CVE-2020-2755)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u251, 8u241,     11.0.6 and 14 Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2756)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Serialization). Supported     versions that are affected are Java SE: 7u251, 8u241,     11.0.6 and 14 Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2757)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Security). Supported     versions that are affected are Java SE: 7u251, 8u241,     11.0.6 and 14 Java SE Embedded: 8u241. Difficult to     exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2773)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: JSSE). Supported versions     that are affected are Java SE: 7u251, 8u241, 11.0.6 and     14 Java SE Embedded: 8u241. Easily exploitable     vulnerability allows unauthenticated attacker with     network access via HTTPS to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized ability to cause a partial     denial of service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2781)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Lightweight HTTP Server).
    Supported versions that are affected are Java SE:
    7u251, 8u241, 11.0.6 and 14 Java SE Embedded: 8u241.
    Difficult to exploit vulnerability allows     unauthenticated attacker with network access via     multiple protocols to compromise Java SE, Java SE     Embedded. Successful attacks of this vulnerability can     result in unauthorized update, insert or delete access     to some of Java SE, Java SE Embedded accessible data as     well as unauthorized read access to a subset of Java     SE, Java SE Embedded accessible data.(CVE-2020-2800)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: Concurrency). Supported     versions that are affected are Java SE: 7u251, 8u241,     11.0.6 and 14 Java SE Embedded: 8u241. Easily     exploitable vulnerability allows unauthenticated     attacker with network access via multiple protocols to     compromise Java SE, Java SE Embedded. Successful     attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of     service (partial DOS) of Java SE, Java SE     Embedded.(CVE-2020-2830)

  - Vulnerability in the Java SE, Java SE Embedded product     of Oracle Java SE (component: 2D). Supported versions     that are affected are Java SE: 8u251, 11.0.7 and 14.0.1     Java SE Embedded: 8u251. Difficult to exploit     vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise     Java SE, Java SE Embedded. Successful attacks of this     vulnerability can result in unauthorized read access to     a subset of Java SE, Java SE Embedded accessible     data.(CVE-2020-14581)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
141833	McAfee ePolicy Orchestrator (SB10332)	Nessus	Windows	10/23/2020	12/5/2022	high
136334	Photon OS 2.0: Openjdk8 PHSA-2020-2.0-0235	Nessus	PhotonOS Local Security Checks	5/5/2020	5/13/2022	high
135776	RHEL 6 : java-1.8.0-openjdk (RHSA-2020:1506)	Nessus	Red Hat Local Security Checks	4/21/2020	4/28/2024	high
135595	Amazon Linux 2 : java-11-amazon-corretto (ALAS-2020-1410)	Nessus	Amazon Linux Local Security Checks	4/16/2020	5/13/2022	high
135956	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2020-1515)	Nessus	Oracle Linux Local Security Checks	4/24/2020	5/13/2022	high
136738	RHEL 8 : java-1.8.0-ibm (RHSA-2020:2241)	Nessus	Red Hat Local Security Checks	5/20/2020	5/25/2023	high
137552	SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2020:1511-1)	Nessus	SuSE Local Security Checks	6/17/2020	5/13/2022	high
146027	CentOS 8 : java-11-openjdk (CESA-2020:1514)	Nessus	CentOS Local Security Checks	2/1/2021	5/10/2022	high
145111	EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2021-1078)	Nessus	Huawei Local Security Checks	1/20/2021	12/5/2022	medium
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	9/1/2022	3/5/2024	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

medium

critical