Vulnerabilities > CVE-2019-3888 - Information Exposure Through Log Files vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Fuzzing and observing application log data/errors for application mapping An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-2439.NASL description An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.3). (BZ#1669364, BZ#1684987, BZ#1697231, BZ#1720255) Security Fix(es) : * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881) * openssl: 0-byte record padding oracle (CVE-2019-1559) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 127830 published 2019-08-13 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127830 title RHEL 7 : Virtualization Manager (RHSA-2019:2439) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:2439. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(127830); script_version("1.6"); script_cvs_date("Date: 2020/01/02"); script_cve_id("CVE-2018-16881", "CVE-2019-1559", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:2439"); script_name(english:"RHEL 7 : Virtualization Manager (RHSA-2019:2439)"); script_summary(english:"Checks the rpm output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing a security update." ); script_set_attribute( attribute:"description", value: "An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.3). (BZ#1669364, BZ#1684987, BZ#1697231, BZ#1720255) Security Fix(es) : * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881) * openssl: 0-byte record padding oracle (CVE-2019-1559) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:2439" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-16881" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-1559" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute( attribute:"solution", value:"Update the affected rhvm-appliance package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3888"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rhvm-appliance"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/25"); script_set_attribute(attribute:"patch_publication_date", value:"2019/08/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/13"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:2439"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rhvm-appliance-4.3-20190722.0.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rhvm-appliance"); } }
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-1421.NASL description An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 125842 published 2019-06-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125842 title RHEL 8 : JBoss EAP (RHSA-2019:1421) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1421. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125842); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1421"); script_name(english:"RHEL 8 : JBoss EAP (RHSA-2019:1421)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1421" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1421"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL8", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL8", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }
NASL family CGI abuses NASL id JBOSS_EAP_RHSA-2019-1424.NASL description The version of Red Hat JBoss Enterprise Application Platform (EAP) installed on the remote host is 7.x prior to 7.2.2. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:1424 advisory: - picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) - picketlink: URL injection via xinclude parameter (CVE-2019-3873) - undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 132312 published 2019-12-19 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/132312 title Red Hat JBoss Enterprise Application Platform 7.x < 7.2.2 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(132312); script_version("1.2"); script_cvs_date("Date: 2019/12/20"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_bugtraq_id(108732, 108738, 108739); script_xref(name:"RHSA", value:"2019:1424"); script_name(english:"Red Hat JBoss Enterprise Application Platform 7.x < 7.2.2 Multiple Vulnerabilities"); script_summary(english:"Checks version of JBoss EAP."); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat JBoss Enterprise Application Platform installation is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Red Hat JBoss Enterprise Application Platform (EAP) installed on the remote host is 7.x prior to 7.2.2. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:1424 advisory: - picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) - picketlink: URL injection via xinclude parameter (CVE-2019-3873) - undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1424"); script_set_attribute(attribute:"solution", value: "Update to Red Hat JBoss Enterprise Application Platform 7.2.2 or later."); script_set_attribute(attribute:"agent", value:"unix"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/19"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:jboss_enterprise_application_platform"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("jboss_detect.nbin"); script_require_keys("installed_sw/JBoss"); exit(0); } include('lists.inc'); include('vcf.inc'); include('vcf_extras.inc'); vcf::jboss::eap::initialize(); app_info = vcf::jboss::eap::get_app_info(); vcf::check_granularity(app_info:app_info, sig_segments:3); constraints = [ { 'min_version' : '7', 'fixed_version' : '7.2.2' } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING, flags:{xss:TRUE});
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-1420.NASL description An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 125841 published 2019-06-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125841 title RHEL 7 : JBoss EAP (RHSA-2019:1420) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1420. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125841); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1420"); script_name(english:"RHEL 7 : JBoss EAP (RHSA-2019:1420)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1420" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1420"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL7", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL7", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-java-jdk11-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-java-jdk8-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2019-1419.NASL description An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 125840 published 2019-06-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125840 title RHEL 6 : JBoss EAP (RHSA-2019:1419) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1419. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125840); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1419"); script_name(english:"RHEL 6 : JBoss EAP (RHSA-2019:1419)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1419" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1419"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL6", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL6", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el6")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }
Redhat
advisories |
| ||||||||||||
rpms |
|
References
- http://www.securityfocus.com/bid/108739
- http://www.securityfocus.com/bid/108739
- https://access.redhat.com/errata/RHSA-2019:2439
- https://access.redhat.com/errata/RHSA-2019:2439
- https://access.redhat.com/errata/RHSA-2019:2998
- https://access.redhat.com/errata/RHSA-2019:2998
- https://access.redhat.com/errata/RHSA-2020:0727
- https://access.redhat.com/errata/RHSA-2020:0727
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888
- https://security.netapp.com/advisory/ntap-20220210-0019/
- https://security.netapp.com/advisory/ntap-20220210-0019/