因此，它受到 ALAS2023-2025-841 公告中提及的一个漏洞影响。

    读取特别构建的 ZIP 存档时，可以进行压缩以分配大量内存，最终造成内存不足错误，即使对于非常小的输入也是如此。此漏洞可用于对使用 Compress' zip 程序包的服务发动拒绝服务攻击。(CVE-2021-36090)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 Oracle JDeveloper 版本缺少一个安全修补程序。因此，其会受到 2024 年 1 月 CPU 公告中提及的多个漏洞影响。 
  - Oracle Fusion Middleware 的 Oracle JDeveloper 产品中的漏洞（组件：Oracle JDeveloper (Apache Commons Compress)）。支持的版本中受影响的是 12.2.1.4.0。此漏洞很容易被利用，其允许未经身份验证的攻击者通过 HTTP 进行网络访问，从而破坏 Oracle JDeveloper。若攻击成功，攻击者在未经授权的情况下可造成 Oracle JDeveloper 挂起或频繁崩溃（完全 DOS）。(CVE-2021-36090)

  - Oracle Fusion Middleware 的 Oracle JDeveloper 产品中的漏洞（组件：ADF Faces (Google Guava)）。支持的版本中受影响的是 12.2.1.4.0。可轻松利用的漏洞允许低权限攻击者登录 Oracle JDeveloper 执行的基础结构，从而破坏 Oracle JDeveloper。若攻击成功，攻击者可在未经授权的情况下创建、删除或修改关键数据或所有的 Oracle JDeveloper 可访问数据，并且未经授权即可访问关键数据或完整访问所有的 Oracle JDeveloper 可访问数据。(CVE-2023-2976)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 和 7.0.0.0 版本受到 2023 年 7 月 CPU 公告中提及的一个漏洞影响。 

  - Oracle Analytics 的 Oracle Business Intelligence Enterprise Edition 产品中的漏洞（组件：Analytics Server (Apache Hive)）。支持的版本中受影响的是 6.4.0.0.0、7.0.0.0.0 和  12.2.1.4.0。利用漏洞此漏洞的难度较低，通过 HTTP 访问网络的未经验证的攻击者可以借此入侵 Oracle Business Intelligence Enterprise Edition。成功利用此漏洞进行攻击可导致在未经授权的情况下创建、删除或修改关键数据或所有 Oracle Business Intelligence Enterprise Edition 可访问数据的访问权限，以及未经授权即可访问关键数据或完整访问所有 Oracle Business Intelligence Enterprise Edition 可访问数据。
    (CVE-2018-1282)

  - Oracle Analytics 的 Oracle Business Intelligence Enterprise Edition 产品中的漏洞（组件：Visual Analyzer (jackson-databind)）。支持的版本中受影响的是 6.4.0.0.0 和 7.0.0.0.0。利用漏洞此漏洞的难度较低，通过 HTTP 访问网络的未经验证的攻击者可以借此入侵 Oracle Business Intelligence Enterprise Edition。若攻击成功，攻击者可在未经授权的情况下造成 Oracle Business Intelligence Enterprise Edition 挂起或频繁出现崩溃（完整 DOS）。(CVE-2022-33980)

  - Oracle Analytics 的 Oracle Business Intelligence Enterprise Edition 产品中的漏洞（组件：Visual Analyzer (CKEditor)）。支持的版本中受影响的是 6.4.0.0.0 和 7.0.0.0.0。利用漏洞此漏洞的难度较低，通过 HTTP 访问网络的未经验证的攻击者可以借此入侵 Oracle Business Intelligence Enterprise Edition。若要成功发动攻击，必须与攻击者以外的其他人进行人工交互；虽然该漏洞存在于 Oracle Business Intelligence Enterprise Edition 中，但攻击可能对其他产品造成重大影响（范围更改）。若成功利用此漏洞，攻击者未经授权即可对 Oracle Business Intelligence Enterprise Edition 可访问的部分数据执行更新、插入或删除操作，并且未经授权即可读取 Oracle Business Intelligence Enterprise Edition 可访问数据中的部分数据。(CVE-2023-28439)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The versions of Oracle Siebel CRM installed on the remote host are affected by a vulnerability as referenced in the July 2024 CPU advisory.

  - Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation (Apache     Commons Compress)). Supported versions that are affected are 22.3 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM     Deployment. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel CRM Deployment. (CVE-2021-36090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' zip package. (CVE-2021-36090)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Primavera Unifier installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory, including the following:

  - An easily exploitable vulnerability in the File Management component of Primavera Unifier that allows an     unauthenticated, remote attacker to compromise availability. (CVE-2021-36090)

  - An easily exploitable vulnerability in the Platform, UI (Lodash) component of Primavera Unifier that     allows a remote, high privileged attacker to compromise confidentiality, integrity, and availability.
    (CVE-2021-23337)

  - An easily exploitable vulnerability in the Platform (Apache Tika) component of Primavera unifier that     allows an unauthenticated attacker to compromise availability. (CVE-2021-28657)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GoldenGate installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in Oracle GoldenGate (component: Oracle GoldenGate Microservices (Dell BSAFE Micro Edition     Suite)).   The supported version that is affected is 19c. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful     attacks of this vulnerability can result in takeover of Oracle GoldenGate. (CVE-2020-35169)

  - Vulnerability in the Oracle Goldengate product of Oracle GoldenGate (component: Stream Analytics     (JinJava)). The supported version that is affected is 19c. Easily exploitable vulnerability allows low     privileged attacker with network access via HTTP to compromise Oracle Goldengate.  Successful attacks of     this vulnerability can result in  unauthorized read access to a subset of Oracle Goldengate accessible     data. (CVE-2018-18893)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5555 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623)

    * apache-commons-compress: infinite loop when reading a specially crafted 7Z archive (CVE-2021-35515)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive     (CVE-2021-35516)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive     (CVE-2021-35517)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive     (CVE-2021-36090)

    * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes     (CVE-2021-3807)

    * spring-expression: Denial of service via specially crafted SpEL expression (CVE-2022-22950)

    * semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri     encoding (CVE-2022-31051)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    A list of bugs fixed in this update is available in the Technical Notes book:
    https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程主机上运行的 Atlassian Confluence Server 版本受到 CONFSERVER-96103 公告中提及的一个漏洞影响。

  - 读取特别构建的 ZIP 存档时，可以进行压缩以分配大量内存，最终造成内存不足错误，即使对于非常小的输入也是如此。此漏洞可用于对使用 Compress' zip 程序包的服务发动拒绝服务攻击。(CVE-2021-36090)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

远程主机上安装的 apache-commons-compress 版本低于 1.5-4。因此，它受到 ALAS2-2024-2627 公告中提及的一个漏洞影响。

    读取特别构建的 ZIP 存档时，可以进行压缩以分配大量内存，最终造成内存不足错误，即使对于非常小的输入也是如此。此漏洞可用于对使用 Compress' zip 程序包的服务发动拒绝服务攻击。(CVE-2021-36090)

Tenable 已直接从测试产品的安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Oracle Fusion Middleware 的 Oracle Business Process Management Suite  产品中的漏洞（组件：Installer (Apache Commons Compress)）。支持的版本中受影响的是 12.2.1.3.0 和 12.2.1.4.0。
此漏洞较容易攻击，允许未经身份验证的攻击者通过 HTTPS 进行网络访问，从而入侵 Oracle Business Process Management Suite 。成功攻击此漏洞可导致在未经授权的情况下造成 Oracle Solaris 挂起或频繁出现崩溃（完整 DOS）。

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程主机上安装的 Primavera Gateway 版本受到 2021 年 10 月 CPU 公告中提及的以下多个漏洞的影响：

  - Oracle Retail Applications 的 Oracle Retail Store Inventory Management 产品中存在漏洞（组件：SIM 集成 (JDBC)）。支持的版本中受影响的是 14.1、15.0 和  16.0。
    难以利用的漏洞允许未经身份验证的攻击者通过 Oracle Net 进行网络访问，从而破坏 Oracle Retail Store Inventory Management。与攻击者以外的人员进行人工交互是成功攻击的必要条件，尽管漏洞存在于 Oracle Retail Store Inventory Management 中，但攻击也可能会严重影响其他产品。成功攻击此漏洞可导致接管 Oracle Retail Store Inventory Management。(CVE-2021-2351)

  - Oracle Construction and Engineering 的 Primavera Unifier 产品存在漏洞（组件：文件管理 (Apache Commons Compress)）。支持的版本中受影响的是 17.7-17.12、18.8、19.12 和 20.12。可轻松利用的漏洞允许未经身份验证的攻击者通过 HTTP 进行网络访问，从而破坏 Primavera Unifier。成功攻击此漏洞可导致在未经授权的情况下使 Primavera Unifier 挂起或频繁崩溃（完全 DOS）。(CVE-2021-36090)

  - Oracle Construction and Engineering 的 Primavera Unifier 产品存在漏洞（组件：
    平台、UI (Lodash)）。支持的版本中受影响的是 17.7-17.12、18.8、19.12 和 20.12。可轻松利用的漏洞允许高权限攻击者通过 HTTP 进行网络访问，从而危害 Primavera Unifier。(CVE-2021-23337)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-841 advisory.

    When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' zip package. (CVE-2021-36090)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle JDeveloper installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. 
  - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper     (Apache Commons Compress)). The supported version that is affected is 12.2.1.4.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle JDeveloper. (CVE-2021-36090)

  - Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces (Google Guava)).     The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.     Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access     to critical data or all Oracle JDeveloper accessible data as well as unauthorized access to critical data or     complete access to all Oracle JDeveloper accessible data. (CVE-2023-2976)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2612-1 advisory.

  - When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an     entry can result in an infinite loop. This could be used to mount a denial of service attack against     services that use Compress' sevenz package. (CVE-2021-35515)

  - When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that     finally leads to an out of memory error even for very small inputs. This could be used to mount a denial     of service attack against services that use Compress' sevenz package. (CVE-2021-35516)

  - When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' tar package. (CVE-2021-35517)

  - When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' zip package. (CVE-2021-36090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1115-1 advisory.

  - When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an     entry can result in an infinite loop. This could be used to mount a denial of service attack against     services that use Compress' sevenz package. (CVE-2021-35515)

  - When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that     finally leads to an out of memory error even for very small inputs. This could be used to mount a denial     of service attack against services that use Compress' sevenz package. (CVE-2021-35516)

  - When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' tar package. (CVE-2021-35517)

  - When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory     that finally leads to an out of memory error even for very small inputs. This could be used to mount a     denial of service attack against services that use Compress' zip package. (CVE-2021-36090)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 and 7.0.0.0 installed on the remote host are affected by a vulnerability as referenced in the July 2023 CPU advisory. 

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Hive)). Supported versions that are affected are 6.4.0.0.0,     7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of     this vulnerability can result in unauthorized creation, deletion or modification access to critical data     or all Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized access to     critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.
    (CVE-2018-1282)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (jackson-databind)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of     Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Visual Analyzer (CKEditor)). Supported versions that are affected are 6.4.0.0.0 and     7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Oracle Business     Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).     Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to     some of Oracle Business Intelligence Enterprise Edition accessible data as well as unauthorized read     access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2023-28439)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
216815	Amazon Linux 2023：apache-commons-compress、apache-commons-compress-javadoc (ALAS2023-2025-841)	Nessus	Amazon Linux Local Security Checks	2025/2/26	2025/2/26	high
189243	Oracle JDeveloper 多个漏洞（2024 年 1 月 CPU）	Nessus	Misc.	2024/1/19	2025/2/26	high
178710	Oracle Business Intelligence Enterprise Edition (OAS)（2023 年 7 月 CPU）	Nessus	Misc.	2023/7/21	2024/7/19	critical
212445	Oracle Siebel Server <= 22.3 (July 2024 CPU)	Nessus	Misc.	2024/12/11	2024/12/12	high
223980	Linux Distros Unpatched Vulnerability : CVE-2021-36090	Nessus	Misc.	2025/3/5	2025/9/14	high
154262	Oracle Primavera Unifier (Oct 2021 CPU)	Nessus	CGI abuses	2021/10/20	2023/11/28	high
166440	Oracle GoldenGate (Oct 2022 CPU)	Nessus	Misc.	2022/10/25	2023/10/24	critical
163260	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022:5555)	Nessus	Red Hat Local Security Checks	2022/7/15	2024/11/7	high
202692	Atlassian Confluence 7.19.23 < 7.19.25/8.5.x < 8.5.12/8.9.x < 8.9.4 (CONFSERVER-96103)	Nessus	CGI abuses	2024/7/19	2024/7/19	high
206019	Amazon Linux 2 : apache-commons-compress (ALAS-2024-2627)	Nessus	Amazon Linux Local Security Checks	2024/8/21	2024/12/11	high
156931	Oracle Business Process Management Suite（2022 年 1 月 CPU）	Nessus	Misc.	2022/1/21	2023/11/20	high
154297	Oracle Primavera Gateway（2021 年 10 月 CPU）	Nessus	CGI abuses	2021/10/21	2023/10/24	high
216815	Amazon Linux 2023 : apache-commons-compress, apache-commons-compress-javadoc (ALAS2023-2025-841)	Nessus	Amazon Linux Local Security Checks	2025/2/26	2025/2/26	high
189243	Oracle JDeveloper Multiple Vulnerabilities (January 2024 CPU)	Nessus	Misc.	2024/1/19	2025/2/26	high
152256	openSUSE 15 Security Update : apache-commons-compress (openSUSE-SU-2021:2612-1)	Nessus	SuSE Local Security Checks	2021/8/6	2023/12/6	high
152463	openSUSE 15 Security Update : apache-commons-compress (openSUSE-SU-2021:1115-1)	Nessus	SuSE Local Security Checks	2021/8/11	2023/12/4	high
178710	Oracle Business Intelligence Enterprise Edition (OAS) (July 2023 CPU)	Nessus	Misc.	2023/7/21	2024/7/19	critical

偵測

搜尋 Plugin

high

high

critical

high

high

high

critical

high

high

high

high

high

high

high

high

high

critical