Lucene search
Copyright (C) 2022 Greenbone AGOPENVAS:13614125623114202215131HistoryMay 03, 2022 - 12:00 a.m.
SUSE: Security Advisory (SUSE-SU-2022:1513-1)
2022-05-0300:00:00
Copyright (C) 2022 Greenbone AG
plugins.openvas.org
13
suse
security
advisory
java-11-openjdk
cve-2022-21426
cve-2022-21434
cve-2022-21443
cve-2022-21476
cve-2022-21496
caas platform 4.0
enterprise storage 6
enterprise storage 7
linux enterprise high performance computing 15
sp1
sp2
sp3
sp4
module for basesystem
module for packagehub subpackages
realtime extension
server
sap
manager proxy 4.1
manager retail branch server 4.1
manager server 4.1
vendorfix
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.3
Confidence
High
EPSS
0.003
Percentile
66.7%
The remote host is missing an update for the
# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.1.4.2022.1513.1");
script_cve_id("CVE-2022-21426", "CVE-2022-21434", "CVE-2022-21443", "CVE-2022-21476", "CVE-2022-21496");
script_tag(name:"creation_date", value:"2022-05-03 20:12:37 +0000 (Tue, 03 May 2022)");
script_version("2024-02-02T14:37:51+0000");
script_tag(name:"last_modification", value:"2024-02-02 14:37:51 +0000 (Fri, 02 Feb 2024)");
script_tag(name:"cvss_base", value:"5.0");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:P/A:N");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2022-04-28 15:49:21 +0000 (Thu, 28 Apr 2022)");
script_name("SUSE: Security Advisory (SUSE-SU-2022:1513-1)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2022 Greenbone AG");
script_family("SuSE Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/suse_sles", "ssh/login/rpms", re:"ssh/login/release=(SLES15\.0SP3|SLES15\.0SP4|SLES15\.0|SLES15\.0SP1|SLES15\.0SP2)");
script_xref(name:"Advisory-ID", value:"SUSE-SU-2022:1513-1");
script_xref(name:"URL", value:"https://www.suse.com/support/update/announcement/2022/suse-su-20221513-1/");
script_tag(name:"summary", value:"The remote host is missing an update for the 'java-11-openjdk' package(s) announced via the SUSE-SU-2022:1513-1 advisory.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");
script_tag(name:"insight", value:"This update for java-11-openjdk fixes the following issues:
CVE-2022-21426: Fixed Oracle Java SE compromission via unauthenticated
attacker with network access via multiple protocols (bsc#1198672).
CVE-2022-21434: Fixed Oracle Java SE compromission via unauthenticated
attacker with network access via multiple protocols (bsc#1198674).
CVE-2022-21496: Fixed Oracle Java SE compromission via unauthenticated
attacker with network access via multiple protocols (bsc#1198673).
CVE-2022-21443: Fixed Oracle Java SE compromission via unauthenticated
attacker with network access via multiple protocols (bsc#1198675).
CVE-2022-21476: Fixed Oracle Java SE compromission via unauthenticated
attacker with network access via multiple protocols (bsc#1198671).");
script_tag(name:"affected", value:"'java-11-openjdk' package(s) on SUSE CaaS Platform 4.0, SUSE Enterprise Storage 6, SUSE Enterprise Storage 7, SUSE Linux Enterprise High Performance Computing 15, SUSE Linux Enterprise High Performance Computing 15-SP1, SUSE Linux Enterprise High Performance Computing 15-SP2, SUSE Linux Enterprise Module for Basesystem 15-SP3, SUSE Linux Enterprise Module for Basesystem 15-SP4, SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3, SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4, SUSE Linux Enterprise Realtime Extension 15-SP2, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15-SP1, SUSE Linux Enterprise Server 15-SP2, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Linux Enterprise Server for SAP 15-SP2, SUSE Manager Proxy 4.1, SUSE Manager Retail Branch Server 4.1, SUSE Manager Server 4.1.");
script_tag(name:"solution", value:"Please install the updated package(s).");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"package");
exit(0);
}
include("revisions-lib.inc");
include("pkg-lib-rpm.inc");
release = rpm_get_ssh_release();
if(!release)
exit(0);
res = "";
report = "";
if(release == "SLES15.0SP3") {
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk", rpm:"java-11-openjdk~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-debugsource", rpm:"java-11-openjdk-debugsource~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-demo", rpm:"java-11-openjdk-demo~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-devel", rpm:"java-11-openjdk-devel~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-headless", rpm:"java-11-openjdk-headless~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-javadoc", rpm:"java-11-openjdk-javadoc~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-jmods", rpm:"java-11-openjdk-jmods~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP3"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES15.0SP4") {
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk", rpm:"java-11-openjdk~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-debugsource", rpm:"java-11-openjdk-debugsource~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-demo", rpm:"java-11-openjdk-demo~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-devel", rpm:"java-11-openjdk-devel~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-headless", rpm:"java-11-openjdk-headless~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-javadoc", rpm:"java-11-openjdk-javadoc~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP4"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES15.0") {
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk", rpm:"java-11-openjdk~11.0.15.0~150000.3.80.1", rls:"SLES15.0"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-debugsource", rpm:"java-11-openjdk-debugsource~11.0.15.0~150000.3.80.1", rls:"SLES15.0"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-demo", rpm:"java-11-openjdk-demo~11.0.15.0~150000.3.80.1", rls:"SLES15.0"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-devel", rpm:"java-11-openjdk-devel~11.0.15.0~150000.3.80.1", rls:"SLES15.0"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-headless", rpm:"java-11-openjdk-headless~11.0.15.0~150000.3.80.1", rls:"SLES15.0"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES15.0SP1") {
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk", rpm:"java-11-openjdk~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP1"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-debugsource", rpm:"java-11-openjdk-debugsource~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP1"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-demo", rpm:"java-11-openjdk-demo~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP1"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-devel", rpm:"java-11-openjdk-devel~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP1"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-headless", rpm:"java-11-openjdk-headless~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP1"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
if(release == "SLES15.0SP2") {
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk", rpm:"java-11-openjdk~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-debugsource", rpm:"java-11-openjdk-debugsource~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-demo", rpm:"java-11-openjdk-demo~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-devel", rpm:"java-11-openjdk-devel~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP2"))) {
report += res;
}
if(!isnull(res = isrpmvuln(pkg:"java-11-openjdk-headless", rpm:"java-11-openjdk-headless~11.0.15.0~150000.3.80.1", rls:"SLES15.0SP2"))) {
report += res;
}
if(report != "") {
security_message(data:report);
} else if(__pkg_match) {
exit(99);
}
exit(0);
}
exit(0);
Related
openvas
openvas
CentOS: Security Advisory for java (CESA-2022:1487)
2022-05-14 00:00:00
openSUSE: Security Advisory for java-11-openjdk (SUSE-SU-2022:1513-1)
2022-05-17 00:00:00
Ubuntu: Security Advisory (USN-5388-1)
2022-04-27 00:00:00
nessus
nessus
Oracle Linux 9 : java-1.8.0-openjdk (ELSA-2022-2137)
2022-07-07 00:00:00
RHEL 7 : java-11-openjdk (RHSA-2022:1440)
2022-04-20 00:00:00
Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2022-002)
2022-05-02 00:00:00
redhat
redhat
(RHSA-2022:1492) Important: OpenJDK 8u332 Windows builds release and security update
2022-04-28 18:57:15
(RHSA-2022:1488) Important: java-1.8.0-openjdk security update
2022-04-25 14:35:47
(RHSA-2022:1489) Important: java-1.8.0-openjdk security update
2022-04-25 14:33:34
amazon
amazon
Important: java-11-amazon-corretto
2022-04-25 22:55:00
Important: java-11-amazon-corretto
2022-04-25 23:48:00
Important: java-17-amazon-corretto
2022-04-25 23:54:00
debian
debian
[SECURITY] [DLA 3006-1] openjdk-8 security update
2022-05-14 09:20:52
[SECURITY] [DSA 5131-1] openjdk-11 security update
2022-05-05 17:16:55
[SECURITY] [DSA 5128-1] openjdk-17 security update
2022-05-03 21:01:53
rocky
rocky
java-1.8.0-openjdk security update
2022-04-25 15:17:09
java-11-openjdk security update
2022-04-20 12:24:01
java-17-openjdk security and bug fix update
2022-04-20 12:21:21
centos
centos
java security update
2022-05-13 17:34:53
java security update
2022-05-13 17:30:46
osv
osv
openjdk-8 - security update
2022-05-14 00:00:00
Important: java-11-openjdk security update
2022-04-20 12:24:01
openjdk-lts vulnerabilities
2022-04-26 11:49:20
oraclelinux
oraclelinux
java-11-openjdk security update
2022-04-20 00:00:00
java-11-openjdk security, bug fix, and enhancement update
2022-04-20 00:00:00
java-1.8.0-openjdk security update
2022-06-30 00:00:00
suse
suse
Security update for java-1_8_0-openjdk (important)
2022-07-22 00:00:00
Security update for java-11-openjdk (important)
2022-05-03 00:00:00
Security update for java-1_8_0-ibm (important)
2022-08-03 00:00:00
almalinux
almalinux
Important: java-11-openjdk security update
2022-04-20 12:24:01
Important: java-1.8.0-openjdk security update
2022-04-25 15:17:09
Important: java-17-openjdk security and bug fix update
2022-04-20 12:21:21
cloudlinux
cloudlinux
mageia
mageia
Updated java packages fix security vulnerability
2022-07-16 22:58:20
altlinux
altlinux
ubuntu
ubuntu
OpenJDK vulnerabilities
2022-04-26 00:00:00
OpenJDK vulnerabilities
2022-04-26 00:00:00
ibm
ibm
f5
f5
kaspersky
kaspersky
KLA12516 Multiple vulnerabilities in Oracle Java SE and GraalVM
2022-04-19 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
6.3
Confidence
High
EPSS
0.003
Percentile
66.7%
Related for OPENVAS:13614125623114202215131