远程主机受到 GLSA-202007-34 中所述漏洞的影响（Apache Ant：多个漏洞）

    发现 Apache Ant 正在使用多个不安全的临时文件，这可能会从不安全的本地位置泄露敏感信息或执行代码。
  影响：

    本地攻击者可能以该进程的权限执行任意代码或造成拒绝服务情况。
  变通方案：

    目前无任何已知的变通方案。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2021: 0637 公告中提及的漏洞的影响。

  - ant：不安全的临时文件 (CVE-2020-11979)

  - ant：不安全的临时文件漏洞 (CVE-2020-1945)

  - jenkins-2-plugins/subversion: XML 解析器未阻止 XML 外部实体 (XXE) 攻击 (CVE-2020-2304)

  - jenkins-2-plugins/mercurial: XML 解析器未阻止 XML 外部实体 (XXE) 攻击 (CVE-2020-2305)

  - jenkins-2-plugins/mercurial: HTTP 端点中缺少权限检查可导致信息泄露 (CVE-2020-2306)

  - jenkins-2-plugins/kubernetes: 可在 Kubernetes 插件中访问 Jenkins 控制器环境变量 (CVE-2020-2307)

  - jenkins-2-plugins/kubernetes: Kubernetes 插件中缺少权限检查可列出 pod 模板 (CVE-2020-2308)

  - jenkins-2-plugins/kubernetes: Kubernetes 插件中缺少权限检查允许枚举凭据 ID (CVE-2020-2309)

  - python-rsa：针对 RSA 解密发起 bleichenbacher Timing oracle 攻击 (CVE-2020-25658)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 7 / 8 主机上安装的程序包受到 RHSA-2021: 0429 公告中提及的多个漏洞的影响。

  - ant：不安全的临时文件 (CVE-2020-11979)

  - ant：不安全的临时文件漏洞 (CVE-2020-1945)

  - jenkins：工作区浏览器中的任意文件读取漏洞 (CVE-2021-21602)

  - jenkins：通知栏中的 XSS 漏洞 (CVE-2021-21603)

  - jenkins：不当处理 REST API XML 反序列化错误 (CVE-2021-21604)

  - jenkins：代理名称中的路径遍历漏洞 (CVE-2021-21605)

  - jenkins：文件指纹中的任意文件存在性检查 (CVE-2021-21606)

  - jenkins：在图形 URL 中过度分配内存导致拒绝服务 (CVE-2021-21607)

  - jenkins：按钮标签中的存储型 XSS 漏洞 (CVE-2021-21608)

  - jenkins：缺少对具有特定前缀的路径的权限检查 (CVE-2021-21609)

  - jenkins：标记格式化程序预览中的反射型 XSS 漏洞 (CVE-2021-21610)

  - jenkins：新项目页面上的存储的 XSS 漏洞 (CVE-2021-21611)

  - jenkins：特权用户执行的文件系统遍历 (CVE-2021-21615)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 Enterprise Manager Ops Center 12.4.0.0 版本受到 2020 年 7 月 CPU 公告中提及的多个漏洞的影响。

  - Oracle Enterprise Manager 的 Enterprise Manager Ops Center 产品中存在漏洞（组件：
    Apache Log4j）。支持的版本中受影响的是 12.4.0.0。可轻松利用的漏洞允许未经身份验证的攻击者进行网络访问，从而破坏 Oracle Enterprise Manager Ops Center。
    成功攻击此漏洞可导致接管 Oracle Enterprise Manager Ops Center。
    (CVE-2017-5645)

  - Oracle Enterprise Manager 的 Enterprise Manager Ops Center 产品中存在漏洞（组件：
    Networking (Apache Ant)）。支持的版本中受影响的是 12.4.0.0。轻松利用的漏洞允许未经身份验证的攻击者通过 HTTP 进行网络访问，从而破坏 Enterprise Manager Ops Center。成功利用此漏洞进行攻击可导致在未经授权的情况下创建、删除或修改关键数据或所有 Enterprise Manager Ops Center 可访问数据的访问权限，以及未经授权即可访问关键数据或完整访问所有 Enterprise Manager Ops Center 可访问数据。(CVE-2020-1945)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

    * jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

    * ant: Insecure temporary file vulnerability (CVE-2020-1945)

    * jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

    * jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes     plug-in (CVE-2020-2307)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating     credentials IDs (CVE-2020-2309)

    * ant: Insecure temporary file (CVE-2020-11979)

    * python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 3.11.394. See the following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:0638

    Space precludes documenting all of the container images in this advisory. See the following Release Notes     documentation, which will be updated shortly for this release, for details about these changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    This update fixes the following bugs among others:

    * Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters.
    This was causing come clusters to never complete their restart. This bug fix passes the logging ops     cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)

    * Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file     during cluster installation. This caused the check to fail during initial installation because the `ca-     bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the     `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)

    * Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of     the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered     before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml`     file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set,     allowing for successful node upgrades. (BZ#1921353)

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.33. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:0428

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Apache Log4j). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access to compromise Oracle Enterprise Manager Ops Center.
    Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Ops Center.
    (CVE-2017-5645)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Apache Ant)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Enterprise Manager Ops Center accessible data as     well as unauthorized access to critical data or complete access to all Enterprise Manager Ops Center     accessible data (CVE-2020-1945).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote host is affected by the vulnerability described in GLSA-202007-34 (Apache Ant: Multiple vulnerabilities)

    Apache Ant was found to be using multiple insecure temporary files which       may disclose sensitive information or execute code from an unsafe local       location.
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
138957	GLSA-202007-34 ：Apache Ant：多个漏洞	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	medium
147013	RHEL 7：OpenShift Container Platform 3.11.394 错误修复和 (RHSA-2021: 0637)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147015	RHEL 7 / 8：OpenShift Container Platform 4.5.33 程序包和 (RHSA-2021: 0429)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
169979	Oracle Enterprise Manager Ops Center UI 和其他补丁（2020 年 7 月 CPU）	Nessus	Misc.	2023/1/12	2023/9/7	critical
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147015	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
169979	Oracle Enterprise Manager Ops Center UI and Other Patches (Jul 2020 CPU)	Nessus	Misc.	2023/1/12	2023/9/7	critical
202893	Photon OS 2.0: Apache PHSA-2020-2.0-0247	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/23	medium
137317	Photon OS 1.0: Apache PHSA-2020-1.0-0298	Nessus	PhotonOS Local Security Checks	2020/6/10	2022/12/5	high
138957	GLSA-202007-34 : Apache Ant: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	medium

偵測

搜尋 Plugin

medium

high

high

critical

high

high

critical

medium

high

medium