Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.REDHAT-RHSA-2023-7638.NASL
HistoryDec 04, 2023 - 12:00 a.m.

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 (RHSA-2023:7638)

2023-12-0400:00:00
This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
21
red hat jboss
rhel 8
vulnerabilities
rhsa-2023:7638
nessus
application version
ddos attack
insecure directory
http invoker
stackoverflow
outofmemoryerror
information exposure
apache avro
http/2
rapid reset attack

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.4

Confidence

High

EPSS

0.813

Percentile

98.4%

JSON

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7638 advisory.

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

This release of Red Hat JBoss Enterprise Application Platform 7.4.14 serves as a replacement for Red Hat     JBoss Enterprise Application Platform 7.4.13, and includes bug fixes and enhancements.

See the Red Hat JBoss Enterprise Application Platform 7.4.14 Release Notes for information about the most     significant bug fixes and enhancements included in this release.

Security Fix(es):

* undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset     Attack) (CVE-2023-44487)

* avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK     (CVE-2023-39410)

* guava: insecure temporary directory creation (CVE-2023-2976)

* eap-galleon: custom provisioning creates unsecured http-invoker (CVE-2023-4503)

* jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()     (CVE-2023-26048)

* jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)

* sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)

A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the     References section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2023:7638. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(186543);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/06/03");

  script_cve_id(
    "CVE-2023-2976",
    "CVE-2023-4503",
    "CVE-2023-5685",
    "CVE-2023-26048",
    "CVE-2023-26049",
    "CVE-2023-35887",
    "CVE-2023-39410",
    "CVE-2023-44487"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/10/31");
  script_xref(name:"RHSA", value:"2023:7638");
  script_xref(name:"CEA-ID", value:"CEA-2024-0004");

  script_name(english:"RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 (RHSA-2023:7638)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates for Red Hat JBoss Enterprise Application Platform 7.4.14
on RHEL 8.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2023:7638 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly
    application runtime.

    This release of Red Hat JBoss Enterprise Application Platform 7.4.14 serves as a replacement for Red Hat
    JBoss Enterprise Application Platform 7.4.13, and includes bug fixes and enhancements.

    See the Red Hat JBoss Enterprise Application Platform 7.4.14 Release Notes for information about the most
    significant bug fixes and enhancements included in this release.

    Security Fix(es):

    * undertow: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset
    Attack) (CVE-2023-44487)

    * avro: apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
    (CVE-2023-39410)

    * guava: insecure temporary directory creation (CVE-2023-2976)

    * eap-galleon: custom provisioning creates unsecured http-invoker (CVE-2023-4503)

    * jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
    (CVE-2023-26048)

    * jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies (CVE-2023-26049)

    * sshd-common: apache-mina-sshd: information exposure in SFTP server implementations (CVE-2023-35887)

    A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the
    References section.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and
    other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?327e7d12");
  # https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95a15247");
  # https://access.redhat.com/security/data/csaf/v2/advisories/2023/rhsa-2023_7638.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d31b48ee");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2023:7638");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/updates/classification/#important");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2184751");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2215229");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2236340");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2236341");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2240036");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2242521");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2242803");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25004");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25085");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25086");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25378");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25380");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25419");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25451");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25457");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25541");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25547");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25576");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25594");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25627");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25657");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25685");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25700");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25716");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25726");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25772");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25779");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25803");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-25838");
  script_set_attribute(attribute:"see_also", value:"https://issues.redhat.com/browse/JBEAP-26041");
  script_set_attribute(attribute:"solution", value:
"Update the RHEL Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 package based on the guidance in
RHSA-2023:7638.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-4503");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(22, 400, 502, 552, 665, 770, 1286);
  script_set_attribute(attribute:"vendor_severity", value:"Important");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/04/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/12/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/12/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-commons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-core-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-dto");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-hornetq-protocol");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-hqclient-protocol");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jdbc-store");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jms-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jms-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-journal");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-ra");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-selector");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-service-extensions");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-sshd");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-avro");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-guava");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-guava-libraries");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-cachestore-jdbc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-cachestore-remote");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-client-hotrod");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-commons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-component-annotations");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-hibernate-cache-commons");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-hibernate-cache-spi");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-infinispan-hibernate-cache-v53");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jandex");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-jsp-api_2.3_spec");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jbossws-cxf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk11");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk17");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-transaction-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-yasson");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'repo_relative_urls': [
      'content/dist/layered/rhel8/x86_64/jbeap/7.4/debug',
      'content/dist/layered/rhel8/x86_64/jbeap/7.4/os',
      'content/dist/layered/rhel8/x86_64/jbeap/7.4/source/SRPMS'
    ],
    'pkgs': [
      {'reference':'eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-core-client-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-dto-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-hornetq-protocol-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-hqclient-protocol-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-jdbc-store-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-jms-client-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-jms-server-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-journal-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-ra-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-selector-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-server-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-service-extensions-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-activemq-artemis-tools-2.16.0-17.redhat_00051.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-apache-sshd-2.9.3-1.redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-avro-1.11.3-1.redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-39410']},
      {'reference':'eap7-guava-32.1.1-2.jre_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-2976', 'CVE-2023-26048']},
      {'reference':'eap7-guava-libraries-32.1.1-2.jre_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-2976', 'CVE-2023-26048']},
      {'reference':'eap7-hal-console-3.3.20-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-hibernate-5.3.32-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-hibernate-core-5.3.32-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-hibernate-entitymanager-5.3.32-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-hibernate-envers-5.3.32-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-hibernate-java8-5.3.32-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-infinispan-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-cachestore-jdbc-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-cachestore-remote-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-client-hotrod-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-commons-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-component-annotations-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-core-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-hibernate-cache-commons-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-hibernate-cache-spi-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-infinispan-hibernate-cache-v53-11.0.18-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-jandex-2.4.4-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-jsp-api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-marshalling-2.0.14-1.SP1_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-marshalling-river-2.0.14-1.SP1_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-server-migration-1.10.0-33.Final_redhat_00032.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-server-migration-cli-1.10.0-33.Final_redhat_00032.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-server-migration-core-1.10.0-33.Final_redhat_00032.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-jboss-xnio-base-3.8.11-1.SP1_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-5685', 'CVE-2023-26048']},
      {'reference':'eap7-jbossws-cxf-5.4.9-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-44487']},
      {'reference':'eap7-jgroups-4.2.23-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-undertow-2.2.28-1.SP1_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-weld-core-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-core-impl-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-core-jsf-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-ejb-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-jta-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-probe-core-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-weld-web-3.1.10-2.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']},
      {'reference':'eap7-wildfly-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-java-jdk11-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-java-jdk17-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-java-jdk8-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-javadocs-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-modules-7.4.14-5.GA_redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-4503', 'CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-35887', 'CVE-2023-44487']},
      {'reference':'eap7-wildfly-transaction-client-1.1.16-1.Final_redhat_00001.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048', 'CVE-2023-26049', 'CVE-2023-44487']},
      {'reference':'eap7-yasson-1.0.11-4.redhat_00002.1.el8eap', 'release':'8', 'el_string':'el8eap', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'eap7', 'cves':['CVE-2023-26048']}
    ]
  }
];

var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);

var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];
  foreach var pkg ( constraint_array['pkgs'] ) {
    var reference = NULL;
    var _release = NULL;
    var sp = NULL;
    var _cpu = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var epoch = NULL;
    var allowmaj = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        _release &&
        rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
        (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&
        rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  if (isnull(applicable_repo_urls) || !applicable_repo_urls) extra = rpm_report_get() + redhat_report_repo_caveat();
  else extra = rpm_report_get();
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : extra
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'eap7-activemq-artemis / eap7-activemq-artemis-cli / etc');
}

References

Related

redhat 12
nessus 20
ibm 53
openvas 4
redos 2
osv 25
debian 2
ubuntucve 4
cgr 4
atlassian 6
github 6
veracode 6
githubexploit 4
redhatcve 7
cve 7
nvd 7
prion 6
cvelist 7
cnvd 1
broadcom 1
debiancve 4
wolfi 4
vulnrichment 3
alpinelinux 1
gitlab 1
cbl_mariner 2
redhat
redhat
(RHSA-2023:7637) Important: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
2023-12-04 17:37:49
(RHSA-2023:7641) Important: Red Hat JBoss Enterprise Application Platform 7.4.14 security update
2023-12-04 18:00:34
(RHSA-2023:7639) Important: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
2023-12-04 17:38:29
nessus
nessus
RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 (RHSA-2023:7637)
2023-12-04 00:00:00
RHEL 9 : Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 (RHSA-2023:7639)
2023-12-04 00:00:00
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jetty-minimal (SUSE-SU-2023:2539-1)
2023-06-20 00:00:00
ibm
ibm
Security Bulletin: There is a vulnerability in jetty-server-9.4.48.v20220622.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-26049)
2023-11-21 13:18:42
Security Bulletin: Multiple Vulnerabilities in Rational Change 5.3.2 Fix Pack 05 and earlier versions.
2023-08-01 07:13:05
Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester
2023-07-05 17:30:53
openvas
openvas
Eclipse Jetty Multiple Vulnerabilities (GHSA-qw69-rqj8-6qw8, GHSA-p26g-97m4-6q7c) - Linux
2023-04-21 00:00:00
Eclipse Jetty Multiple Vulnerabilities (GHSA-qw69-rqj8-6qw8, GHSA-p26g-97m4-6q7c) - Windows
2023-04-21 00:00:00
Debian: Security Advisory (DLA-3592-1)
2023-10-02 00:00:00
redos
redos
ROS-20240729-10
2024-07-29 00:00:00
ROS-20240507-03
2024-05-07 00:00:00
osv
osv
jetty9 - security update
2023-09-30 00:00:00
CVE-2023-26048
2023-04-18 21:15:08
OutOfMemoryError for large multipart without filename in Eclipse Jetty
2023-04-19 18:15:45
debian
debian
[SECURITY] [DLA 3592-1] jetty9 security update
2023-09-30 12:35:53
[SECURITY] [DSA 5507-1] jetty9 security update
2023-09-28 22:37:26
ubuntucve
ubuntucve
CVE-2023-26048
2023-04-18 00:00:00
CVE-2023-26049
2023-04-18 00:00:00
CVE-2023-5685
2024-03-22 00:00:00
cgr
cgr
CVE-2023-39410 vulnerabilities
2024-05-19 03:07:16
CVE-2023-26049 vulnerabilities
2024-05-19 03:07:16
CVE-2023-26048 vulnerabilities
2024-05-19 03:07:16
atlassian
atlassian
DoS (Denial of Service) org.apache.avro:avro Dependency in Bamboo Data Center and Server
2023-12-19 06:45:44
DoS (Denial of Service) org.apache.avro:avro Dependency in Jira Software Data Center and Server
2024-03-06 04:53:11
DoS (Denial of Service) org.apache.avro:avro Dependency in Confluence Data Center and Server
2024-01-17 06:46:26
github
github
Apache Avro Java SDK vulnerable to Improper Input Validation
2023-09-29 18:30:22
XNIO denial of service vulnerability
2024-03-22 21:30:56
Apache MINA SSHD information disclosure vulnerability
2023-07-10 18:30:49
veracode
veracode
Denial Of Service (DOS)
2023-04-20 14:24:08
Information Disclosure
2023-04-24 04:51:24
Denial Of Service (DoS)
2024-03-27 10:22:38
githubexploit
githubexploit
Exploit for Allocation of Resources Without Limits or Throttling in Eclipse Jetty
2023-11-01 06:57:10
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Eclipse Jetty
2023-11-27 07:25:34
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Eclipse Jetty
2023-11-01 09:55:19
redhatcve
redhatcve
CVE-2023-26048
2023-08-31 01:30:14
CVE-2023-35887
2023-09-21 13:24:39
CVE-2023-39410
2023-10-09 19:55:01
cve
cve
CVE-2023-26048
2023-04-18 21:15:08
CVE-2023-26049
2023-04-18 21:15:09
CVE-2023-39410
2023-09-29 17:15:46
nvd
nvd
CVE-2023-26048
2023-04-18 21:15:08
CVE-2023-35887
2023-07-10 16:15:53
CVE-2023-39410
2023-09-29 17:15:46
prion
prion
Design/Logic Flaw
2023-07-10 16:15:00
Input validation
2024-02-06 09:15:00
Design/Logic Flaw
2023-09-29 17:15:00
cvelist
cvelist
CVE-2023-35887 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
2023-07-10 09:28:54
CVE-2023-26048 OutOfMemoryError for large multipart without filename in Eclipse Jetty
2023-04-18 20:30:20
CVE-2023-5685 Xnio: stackoverflowexception when the chain of notifier states becomes problematically big
2024-03-22 18:24:42
cnvd
cnvd
Apache MINA Information Disclosure Vulnerability
2023-07-12 00:00:00
broadcom
broadcom
Apache Avro Java SDK vulnerable to Improper Input Validation (CVE-2023-39410)
2024-04-16 00:00:00
debiancve
debiancve
CVE-2023-26048
2023-04-18 21:15:08
CVE-2023-5685
2024-03-22 19:15:07
CVE-2023-26049
2023-04-18 21:15:09
wolfi
wolfi
CVE-2023-26048 vulnerabilities
2024-09-17 21:56:33
CVE-2023-39410 vulnerabilities
2024-09-17 21:56:33
CVE-2023-26049 vulnerabilities
2024-09-17 21:56:33
vulnrichment
vulnrichment
CVE-2023-5685 Xnio: stackoverflowexception when the chain of notifier states becomes problematically big
2024-03-22 18:24:42
CVE-2023-4503 Eap-galleon: custom provisioning creates unsecured http-invoker
2024-02-06 08:39:01
CVE-2023-39410 Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
2023-09-29 16:23:34
alpinelinux
alpinelinux
CVE-2023-39410
2023-09-29 17:15:46
gitlab
gitlab
Deserialization of Untrusted Data
2023-09-29 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-2976 affecting package guava for versions less than 25.0-8
2024-06-28 17:07:09
CVE-2023-2976 affecting package javapackages-bootstrap for versions less than 1.5.0-5
2024-04-09 20:48:36

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.4

Confidence

High

EPSS

0.813

Percentile

98.4%

JSON
Related for REDHAT-RHSA-2023-7638.NASL
redhat12nessus20ibm53openvas4redos2osv25debian2ubuntucve4cgr4atlassian6github6veracode6githubexploit4redhatcve7cve7nvd7prion6cvelist7cnvd1broadcom1debiancve4wolfi4vulnrichment3alpinelinux1gitlab1cbl_mariner2