The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of tomcat7 installed on the remote host is prior to 7.0.109-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1738 advisory.

  - When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security     constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a     specially crafted request. (CVE-2017-12616)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

リモートホストにインストールされているtomcat7のバージョンは7.0.109-1.42以前のです。したがって、ALAS-2023-1738 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Apache Tomcat 7.0.0 から 7.0.80 で VirtualDirContext を使用する場合、特別に細工されたリクエストを介して、セキュリティ制約をバイパスしたり、VirtualDirContext から提供されたリソースの JSP ソースコードを表示させたりする可能性がありました。(CVE-2017-12616)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端主機上安裝的 tomcat7 版本早於 7.0.109-1.42。因此，會受到 ALAS-2023-1738 公告中所提及的多個弱點影響。

  - VirtualDirContext 與 Apache Tomcat 7.0.0 至 7.0.80 一起使用時，可藉由特製的要求繞過安全性限制，並/或檢視 VirtualDirContext 所服務資源的 JSP 原始程式碼。(CVE-2017-12616)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

远程主机上安装的 tomcat7 版本低于 7.0.109-1.42。因此，如公告 ALAS-2023-1738 所述，受到多个漏洞的影响。

  - 如果 Apache Tomcat 7.0.0 至 7.0.80 版中使用了 VirtualDirContext，则攻击者可利用特制的请求绕过安全限制，且/或查看 VirtualDirContext 所服务资源的 JSP 源代码。(CVE-2017-12616)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - jss: Memory leak on TLS connections (CVE-2022-4132)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
199820	RHEL 9 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
175088	Amazon Linux AMI : tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	2023/5/4	2023/9/15	high
199885	RHEL 7 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
175088	Amazon Linux AMI : tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	2023/5/4	2023/9/15	high
175088	Amazon Linux AMI：tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	2023/5/4	2023/9/15	high
175088	Amazon Linux AMI：tomcat7 (ALAS-2023-1738)	Nessus	Amazon Linux Local Security Checks	2023/5/4	2023/9/15	high
199900	RHEL 8 : jss (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium

偵測

搜尋 Plugin

medium

high

medium

high

high

high

medium