RHEL 9:Red Hat JBoss Enterprise Application Platform 7.4.9 安全性更新 (重要) (RHSA-2023: 0554)

critical Nessus Plugin ID 170911

概要

遠端 Red Hat 主機缺少一個或多個安全性更新。

說明

遠端 Redhat Enterprise Linux 9 主機上安裝的套件受到 RHSA-2023: 0554 公告中提及的多個弱點影響。

- jquery:透過跨網域 ajax 要求發起跨網站指令碼攻擊 (CVE-2015-9251)

- bootstrap:data-target 屬性中存在 XSS (CVE-2016-10735)

- nodejs-moment:規則運算式拒絕服務 (CVE-2017-18214)

- bootstrap:折疊 data-parent 屬性中存在跨網站指令碼 (XSS) 弱點 (CVE-2018-14040)

- bootstrap:scrollspy 的 data-target 屬性中存在跨網站指令碼 (XSS) 弱點 (CVE-2018-14041)

- bootstrap:工具提示的 data-container 屬性中存在跨網站指令碼 (XSS) 弱點 (CVE-2018-14042)

- jquery:物件原型中存在原型污染,會導致拒絕服務、遠端程式碼執行或屬性插入 (CVE-2019-11358)

- bootstrap:工具提示或彈出框 data-template 屬性中存在 XSS 弱點 (CVE-2019-8331)

- jquery:存在跨網站指令碼,這是 injQuery.htmlPrefilter 方法不當所致 (CVE-2020-11022)

- jquery:透過傳遞給 DOM 操作方法的 HTML 中的 <option> 標記,進行不受信任的程式碼執行 (CVE-2020-11023)

- wildfly-elytron:可能透過使用不安全的比較器進行計時攻擊 (

解決方案

更新受影響的套件。

另請參閱

http://www.nessus.org/u?23640cf6

http://www.nessus.org/u?327e7d12

http://www.nessus.org/u?95a15247

https://bugzilla.redhat.com/show_bug.cgi?id=2135771

https://bugzilla.redhat.com/show_bug.cgi?id=2145194

https://bugzilla.redhat.com/show_bug.cgi?id=2155682

https://bugzilla.redhat.com/show_bug.cgi?id=2155970

https://issues.redhat.com/browse/JBEAP-23864

https://issues.redhat.com/browse/JBEAP-23865

https://issues.redhat.com/browse/JBEAP-23866

https://access.redhat.com/security/updates/classification/#important

https://access.redhat.com/errata/RHSA-2023:0554

https://bugzilla.redhat.com/show_bug.cgi?id=1399546

https://bugzilla.redhat.com/show_bug.cgi?id=1553413

https://bugzilla.redhat.com/show_bug.cgi?id=1601614

https://bugzilla.redhat.com/show_bug.cgi?id=1601616

https://bugzilla.redhat.com/show_bug.cgi?id=1601617

https://bugzilla.redhat.com/show_bug.cgi?id=1668097

https://bugzilla.redhat.com/show_bug.cgi?id=1686454

https://bugzilla.redhat.com/show_bug.cgi?id=1701972

https://bugzilla.redhat.com/show_bug.cgi?id=1828406

https://bugzilla.redhat.com/show_bug.cgi?id=1850004

https://bugzilla.redhat.com/show_bug.cgi?id=2124682

https://bugzilla.redhat.com/show_bug.cgi?id=2134291

https://bugzilla.redhat.com/show_bug.cgi?id=2135244

https://issues.redhat.com/browse/JBEAP-23928

https://issues.redhat.com/browse/JBEAP-24055

https://issues.redhat.com/browse/JBEAP-24081

https://issues.redhat.com/browse/JBEAP-24095

https://issues.redhat.com/browse/JBEAP-24100

https://issues.redhat.com/browse/JBEAP-24127

https://issues.redhat.com/browse/JBEAP-24128

https://issues.redhat.com/browse/JBEAP-24132

https://issues.redhat.com/browse/JBEAP-24147

https://issues.redhat.com/browse/JBEAP-24167

https://issues.redhat.com/browse/JBEAP-24191

https://issues.redhat.com/browse/JBEAP-24195

https://issues.redhat.com/browse/JBEAP-24207

https://issues.redhat.com/browse/JBEAP-24248

https://issues.redhat.com/browse/JBEAP-24426

https://issues.redhat.com/browse/JBEAP-24427

https://bugzilla.redhat.com/show_bug.cgi?id=2135247

https://bugzilla.redhat.com/show_bug.cgi?id=2135770

Plugin 詳細資訊

嚴重性: Critical

ID: 170911

檔案名稱: redhat-RHSA-2023-0554.nasl

版本: 1.4

類型: local

代理程式: unix

已發布: 2023/1/31

已更新: 2024/4/28

支援的感應器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

風險資訊

VPR

風險因素: Medium

分數: 6.7

CVSS v2

風險因素: Medium

基本分數: 4.3

時間分數: 3.4

媒介: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS 評分資料來源: CVE-2020-11023

CVSS v3

風險因素: Critical

基本分數: 9.8

時間分數: 8.8

媒介: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

時間媒介: CVSS:3.0/E:P/RL:O/RC:C

CVSS 評分資料來源: CVE-2022-46364

弱點資訊

CPE: cpe:/o:redhat:enterprise_linux:9, p-cpe:/a:redhat:enterprise_linux:eap7-apache-sshd, p-cpe:/a:redhat:enterprise_linux:eap7-elytron-web, p-cpe:/a:redhat:enterprise_linux:eap7-hal-console, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search-backend-jgroups, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search-backend-jms, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search-engine, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search-orm, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-search-serialization-avro, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-annotations, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-core, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-databind, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-datatype-jdk8, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-datatype-jsr310, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-jaxrs-base, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-jaxrs-json-provider, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-jaxrs-providers, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-module-jaxb-annotations, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-modules-base, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-modules-java8, p-cpe:/a:redhat:enterprise_linux:eap7-javaee-security-soteria, p-cpe:/a:redhat:enterprise_linux:eap7-javaee-security-soteria-enterprise, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-jsf-api_2.3_spec, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-jsp-api_2.3_spec, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core, p-cpe:/a:redhat:enterprise_linux:eap7-jettison, p-cpe:/a:redhat:enterprise_linux:eap7-undertow, p-cpe:/a:redhat:enterprise_linux:eap7-undertow-server, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-elytron, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-elytron-tool, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules, p-cpe:/a:redhat:enterprise_linux:eap7-woodstox-core

必要的 KB 項目: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

可被惡意程式利用: true

可輕鬆利用: Exploits are available

修補程式發佈日期: 2023/1/31

弱點發布日期: 2018/1/18

參考資訊

CVE: CVE-2015-9251, CVE-2016-10735, CVE-2017-18214, CVE-2018-14040, CVE-2018-14041, CVE-2018-14042, CVE-2019-11358, CVE-2019-8331, CVE-2020-11022, CVE-2020-11023, CVE-2022-3143, CVE-2022-40149, CVE-2022-40150, CVE-2022-40152, CVE-2022-42003, CVE-2022-42004, CVE-2022-45047, CVE-2022-45693, CVE-2022-46364

CWE: 208, 400, 502, 787, 79, 918

RHSA: 2023:0554