遠端主機受到 GLSA-202007-34 中所述的弱點影響 (Apache Ant：多個弱點)

    據發現，Apache Ant 使用多個不安全的暫存檔，其可能洩漏敏感資訊或從不安全的本機位置執行程式碼。
  影響：

    本機攻擊者可能以處理程序的權限執行任意程式碼，或造成拒絕服務情況。
  因應措施：

    目前尚無已知的因應措施。

遠端主機上安裝的 Enterprise Manager Ops Center 12.4.0.0 版受到 2020 年 7 月 CPU 公告中提及的多個弱點影響。

  - Oracle Enterprise Manager 之 Enterprise Manager Ops Center 產品中的弱點 (元件：
    Apache Log4j)。受影響的支援版本是 12.4.0.0。如果未經驗證的攻擊者具有網路存取權，則可輕易利用此弱點入侵 Oracle Enterprise Manager Ops Center。
    若成功攻擊此弱點，攻擊者將可接管 Oracle Enterprise Manager Ops Center。
    (CVE-2017-5645)

  - Oracle Enterprise Manager 之 Enterprise Manager Ops Center 產品中的弱點 (元件：
    Networking (Apache Ant)。受影響的支援版本是 12.4.0.0。如果未經驗證的攻擊者具有網路存取權，則可利用易受利用的弱點，透過 HTTP 入侵 Enterprise Manager Ops Center。若成功攻擊此弱點，則可在未經授權的情況下建立、刪除或修改重要資料或所有 Enterprise Manager Ops Center 可存取資料，並在未經授權的情況下存取重要資料或完全存取所有 Enterprise Manager Ops Center 可存取資料。(CVE-2020-1945)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2021: 0637 公告中提及的一個弱點影響。

  - ant：不安全的暫存檔 (CVE-2020-11979)

  - ant：不安全的暫存檔弱點 (CVE-2020-1945)

  - jenkins-2-plugins/subversion: XML 剖析器無法防止 XML 外部實體 (XXE) 攻擊 (CVE-2020-2304)

  - jenkins-2-plugins/mercurial: XML 剖析器無法防止 XML 外部實體 (XXE) 攻擊 (CVE-2020-2305)

  - jenkins-2-plugins/mercurial: HTTP 端點中缺少權限檢查可導致資訊洩漏 (CVE-2020-2306)

  - jenkins-2-plugins/kubernetes: Jenkins 控制器環境變數可在 Kubernetes 外掛程式中存取 (CVE-2020-2307)

  - jenkins-2-plugins/kubernetes: Kubernetes 外掛程式中缺少權限檢查會允許列出 pod 範本 (CVE-2020-2308)

  - jenkins-2-plugins/kubernetes: Kubernetes 外掛程式中缺少權限檢查會允許列舉憑證 ID (CVE-2020-2309)

  - python-rsa：針對 RSA 解密的 bleichenbacher timing oracle 攻擊 (CVE-2020-25658)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 7/8 主機上安裝的套件受到 RHSA-2021: 0429 公告中提及的多個弱點影響。

  - ant：不安全的暫存檔 (CVE-2020-11979)

  - ant：不安全的暫存檔弱點 (CVE-2020-1945)

  - jenkins：工作區瀏覽器中的任意檔案讀取弱點 (CVE-2021-21602)

  - jenkins：通知列中的 XSS 弱點 (CVE-2021-21603)

  - jenkins：不當處理 REST API XML 還原序列化錯誤 (CVE-2021-21604)

  - jenkins：代理程式名稱中的路徑遊走弱點 (CVE-2021-21605)

  - jenkins：檔案指紋中的任意檔案存在性檢查 (CVE-2021-21606)

  - jenkins：圖形 URL 中的記憶體過度配置問題導致拒絕服務 (CVE-2021-21607)

  - jenkins：按鈕標籤中的儲存式 XSS 弱點 (CVE-2021-21608)

  - jenkins：缺少針對具有特定前置詞之路徑的權限檢查 (CVE-2021-21609)

  - jenkins：標記格式器預覽中的反射式 XSS 弱點 (CVE-2021-21610)

  - jenkins：新項目頁面上的儲存式 XSS 弱點 (CVE-2021-21611)

  - jenkins：有權限使用者執行的檔案系統遊走 (CVE-2021-21615)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

    * jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

    * ant: Insecure temporary file vulnerability (CVE-2020-1945)

    * jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

    * jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes     plug-in (CVE-2020-2307)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

    * jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes plug-in allows enumerating     credentials IDs (CVE-2020-2309)

    * ant: Insecure temporary file (CVE-2020-11979)

    * python-rsa: Bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 3.11.394. See the following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:0638

    Space precludes documenting all of the container images in this advisory. See the following Release Notes     documentation, which will be updated shortly for this release, for details about these changes:

    https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html

    This update fixes the following bugs among others:

    * Previously, the restart-cluster playbook did not evaluate the defined cluster size for ops clusters.
    This was causing come clusters to never complete their restart. This bug fix passes the logging ops     cluster size, allowing restarts of ops clusters to complete successfully. (BZ#1879407)

    * Previously, the `openshift_named_certificates` role checked the contents of the `ca-bundle.crt` file     during cluster installation. This caused the check to fail during initial installation because the `ca-     bundle.crt` file is not yet created in that scenario. This bug fix allows the cluster to skip checking the     `ca-bundle.crt` file if it does not exist, resulting in initial installations succeeding. (BZ#1920567)

    * Previously, if the `openshift_release` attribute was not set in the Ansible inventory file, the nodes of     the cluster would fail during an upgrade. This was caused by the `cluster_facts.yml` file being gathered     before the `openshift_release` attribute was defined by the upgrade playbook. Now the `cluster_facts.yml`     file is gathered after the `openshift_version` role runs and the `openshift_release` attribute is set,     allowing for successful node upgrades. (BZ#1921353)

    All OpenShift Container Platform 3.11 users are advised to upgrade to these updated packages and images.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0429 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container     Platform 4.5.33. See the following advisory for the container images for     this release:

    https://access.redhat.com/errata/RHSA-2021:0428

    Security Fix(es):

    * jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

    * jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

    * jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

    * jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

    * jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

    * jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

    * ant: insecure temporary file vulnerability (CVE-2020-1945)

    * ant: insecure temporary file (CVE-2020-11979)

    * jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

    * jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

    * jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

    * jenkins: Filesystem traversal by privileged users (CVE-2021-21615)

    * jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.4.0.0 versions of Enterprise Manager Ops Center installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Apache Log4j). The supported version that is affected is 12.4.0.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access to compromise Oracle Enterprise Manager Ops Center.
    Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Ops Center.
    (CVE-2017-5645)

  - Vulnerability in the Enterprise Manager Ops Center product of Oracle Enterprise Manager (component:
    Networking (Apache Ant)). The supported version that is affected is 12.4.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Enterprise     Manager Ops Center. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Enterprise Manager Ops Center accessible data as     well as unauthorized access to critical data or complete access to all Enterprise Manager Ops Center     accessible data (CVE-2020-1945).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The remote host is affected by the vulnerability described in GLSA-202007-34 (Apache Ant: Multiple vulnerabilities)

    Apache Ant was found to be using multiple insecure temporary files which       may disclose sensitive information or execute code from an unsafe local       location.
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
138957	GLSA-202007-34 : Apache Ant：多個弱點	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	medium
169979	Oracle Enterprise Manager Ops Center UI 和其他修補程式 (2020 年 7 月 CPU)	Nessus	Misc.	2023/1/12	2023/9/7	critical
147013	RHEL 7：OpenShift Container Platform 3.11.394 錯誤修正以及 (RHSA-2021: 0637)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147015	RHEL 7/8：OpenShift 容器平台 4.5.33 套件和 (RHSA-2021: 0429)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
147015	RHEL 7 / 8 : OpenShift Container Platform 4.5.33 (RHSA-2021:0429)	Nessus	Red Hat Local Security Checks	2021/3/3	2024/11/7	high
169979	Oracle Enterprise Manager Ops Center UI and Other Patches (Jul 2020 CPU)	Nessus	Misc.	2023/1/12	2023/9/7	critical
202893	Photon OS 2.0: Apache PHSA-2020-2.0-0247	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/23	medium
137317	Photon OS 1.0: Apache PHSA-2020-1.0-0298	Nessus	PhotonOS Local Security Checks	2020/6/10	2022/12/5	high
138957	GLSA-202007-34 : Apache Ant: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/7/27	2024/2/28	medium

検出

プラグインの検索

medium

critical

high

high

high

high

critical

medium

high

medium