Vulnerabilities > CVE-2019-3888 - Information Exposure Through Log Files vulnerability in multiple products

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

redhat

netapp

CWE-532

nessus

NVD

Published: 2019-06-12

Updated: 2022-02-20

Summary

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

Vulnerable Configurations

Part	Description	Count
Application	Redhat Redhat Undertow - Redhat Undertow 1.0.0 Redhat Undertow 1.0.1 Redhat Undertow 1.0.2 Redhat Undertow 1.0.3 Redhat Undertow 1.0.4 Redhat Undertow 1.0.5 Redhat Undertow 1.0.6 Redhat Undertow 1.0.7 Redhat Undertow 1.0.8 Redhat Undertow 1.0.9 Redhat Undertow 1.0.10 Redhat Undertow 1.0.11 Redhat Undertow 1.0.12 Redhat Undertow 1.0.13 Redhat Undertow 1.0.14 Redhat Undertow 1.0.15 Redhat Undertow 1.0.16 Redhat Undertow 1.0.17 Redhat Undertow 1.0.18 Redhat Undertow 1.0.19 Redhat Undertow 1.1.0 Redhat Undertow 1.1.1 Redhat Undertow 1.1.2 Redhat Undertow 1.1.3 Redhat Undertow 1.1.4 Redhat Undertow 1.1.5 Redhat Undertow 1.1.6 Redhat Undertow 1.1.7 Redhat Undertow 1.1.8 Redhat Undertow 1.1.9 Redhat Undertow 1.2.0 Redhat Undertow 1.2.1 Redhat Undertow 1.2.2 Redhat Undertow 1.2.3 Redhat Undertow 1.2.4 Redhat Undertow 1.2.5 Redhat Undertow 1.2.6 Redhat Undertow 1.2.7 Redhat Undertow 1.2.8 Redhat Undertow 1.2.9 Redhat Undertow 1.2.10 Redhat Undertow 1.2.11 Redhat Undertow 1.2.12 Redhat Undertow 1.3.0 Redhat Undertow 1.3.1 Redhat Undertow 1.3.2 Redhat Undertow 1.3.3 Redhat Undertow 1.3.4 Redhat Undertow 1.3.5 Redhat Undertow 1.3.6 Redhat Undertow 1.3.7 Redhat Undertow 1.3.8 Redhat Undertow 1.3.9 Redhat Undertow 1.3.10 Redhat Undertow 1.3.11 Redhat Undertow 1.3.12 Redhat Undertow 1.3.13 Redhat Undertow 1.3.14 Redhat Undertow 1.3.15 Redhat Undertow 1.3.16 Redhat Undertow 1.3.17 Redhat Undertow 1.3.18 Redhat Undertow 1.3.19 Redhat Undertow 1.3.20 Redhat Undertow 1.3.21 Redhat Undertow 1.3.22 Redhat Undertow 1.3.23 Redhat Undertow 1.3.24 Redhat Undertow 1.3.25 Redhat Undertow 1.3.26 Redhat Undertow 1.3.27 Redhat Undertow 1.3.28 Redhat Undertow 1.3.29 Redhat Undertow 1.3.30 Redhat Undertow 1.3.31 Redhat Undertow 1.3.32 Redhat Undertow 1.3.33 Redhat Undertow 1.4.0 Redhat Undertow 1.4.1 Redhat Undertow 1.4.2 Redhat Undertow 1.4.3 Redhat Undertow 1.4.4 Redhat Undertow 1.4.5 Redhat Undertow 1.4.6 Redhat Undertow 1.4.7 Redhat Undertow 1.4.8 Redhat Undertow 1.4.10 Redhat Undertow 1.4.11 Redhat Undertow 1.4.12 Redhat Undertow 1.4.13 Redhat Undertow 1.4.14 Redhat Undertow 1.4.15 Redhat Undertow 1.4.16 Redhat Undertow 1.4.17 Redhat Undertow 1.4.18 Redhat Undertow 1.4.19 Redhat Undertow 1.4.20 Redhat Undertow 1.4.21 Redhat Undertow 1.4.22 Redhat Undertow 1.4.23 Redhat Undertow 1.4.24 Redhat Undertow 1.4.25 Redhat Undertow 1.4.26 Redhat Undertow 1.4.27 Redhat Undertow 1.4.28 Redhat Undertow 2.0.0 Redhat Undertow 2.0.1 Redhat Undertow 2.0.2 Redhat Undertow 2.0.3 Redhat Undertow 2.0.4 Redhat Undertow 2.0.5 Redhat Undertow 2.0.6 Redhat Undertow 2.0.7 Redhat Undertow 2.0.8 Redhat Undertow 2.0.9 Redhat Undertow 2.0.10 Redhat Undertow 2.0.11 Redhat Undertow 2.0.12 Redhat Undertow 2.0.13 Redhat Undertow 2.0.14 Redhat Undertow 2.0.15 Redhat Undertow 2.0.16 Redhat Undertow 2.0.17 Redhat Undertow 2.0.18 Redhat Undertow 2.0.19 Redhat Undertow 2.0.20 Redhat Virtualization 4.0 Redhat Virtualization Host 4.0 Redhat Jboss Data Grid - Redhat Openshift Application Runtimes -	231
Application	Netapp Netapp Active IQ Unified Manager -	3
OS	Redhat Redhat Enterprise Linux 7.0	1

Common Weakness Enumeration (CWE)

CWE-532 - Information Exposure Through Log Files

Common Attack Pattern Enumeration and Classification (CAPEC)

Fuzzing and observing application log data/errors for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. By observing logs and error messages, the attacker can learn details about the configuration of the target application and might be able to cause the target to disclose sensitive information.

Nessus

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-2439.NASL
description	An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.3). (BZ#1669364, BZ#1684987, BZ#1697231, BZ#1720255) Security Fix(es) : * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881) * openssl: 0-byte record padding oracle (CVE-2019-1559) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	127830
published	2019-08-13
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127830
title	RHEL 7 : Virtualization Manager (RHSA-2019:2439)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:2439. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(127830); script_version("1.6"); script_cvs_date("Date: 2020/01/02"); script_cve_id("CVE-2018-16881", "CVE-2019-1559", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:2439"); script_name(english:"RHEL 7 : Virtualization Manager (RHSA-2019:2439)"); script_summary(english:"Checks the rpm output for the updated package"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing a security update." ); script_set_attribute( attribute:"description", value: "An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.3). (BZ#1669364, BZ#1684987, BZ#1697231, BZ#1720255) Security Fix(es) : * rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled (CVE-2018-16881) * openssl: 0-byte record padding oracle (CVE-2019-1559) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:2439" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2018-16881" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-1559" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute( attribute:"solution", value:"Update the affected rhvm-appliance package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3888"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:rhvm-appliance"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/25"); script_set_attribute(attribute:"patch_publication_date", value:"2019/08/12"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/13"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:2439"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"rhvm-appliance-4.3-20190722.0.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "rhvm-appliance"); } }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1421.NASL
description	An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	125842
published	2019-06-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125842
title	RHEL 8 : JBoss EAP (RHSA-2019:1421)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1421. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125842); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1421"); script_name(english:"RHEL 8 : JBoss EAP (RHSA-2019:1421)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1421" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^8([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1421"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL8", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL8", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el8")) flag++; if (rpm_check(release:"RHEL8", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el8")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }

NASL family	CGI abuses
NASL id	JBOSS_EAP_RHSA-2019-1424.NASL
description	The version of Red Hat JBoss Enterprise Application Platform (EAP) installed on the remote host is 7.x prior to 7.2.2. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:1424 advisory: - picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) - picketlink: URL injection via xinclude parameter (CVE-2019-3873) - undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) Note that Nessus has not tested for this issue but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	132312
published	2019-12-19
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132312
title	Red Hat JBoss Enterprise Application Platform 7.x < 7.2.2 Multiple Vulnerabilities
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(132312); script_version("1.2"); script_cvs_date("Date: 2019/12/20"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_bugtraq_id(108732, 108738, 108739); script_xref(name:"RHSA", value:"2019:1424"); script_name(english:"Red Hat JBoss Enterprise Application Platform 7.x < 7.2.2 Multiple Vulnerabilities"); script_summary(english:"Checks version of JBoss EAP."); script_set_attribute(attribute:"synopsis", value: "The remote Red Hat JBoss Enterprise Application Platform installation is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Red Hat JBoss Enterprise Application Platform (EAP) installed on the remote host is 7.x prior to 7.2.2. It is therefore, affected my multiple vulnerabilities as referenced in the RHSA-2019:1424 advisory: - picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) - picketlink: URL injection via xinclude parameter (CVE-2019-3873) - undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1424"); script_set_attribute(attribute:"solution", value: "Update to Red Hat JBoss Enterprise Application Platform 7.2.2 or later."); script_set_attribute(attribute:"agent", value:"unix"); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/19"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:jboss_enterprise_application_platform"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("jboss_detect.nbin"); script_require_keys("installed_sw/JBoss"); exit(0); } include('lists.inc'); include('vcf.inc'); include('vcf_extras.inc'); vcf::jboss::eap::initialize(); app_info = vcf::jboss::eap::get_app_info(); vcf::check_granularity(app_info:app_info, sig_segments:3); constraints = [ { 'min_version' : '7', 'fixed_version' : '7.2.2' } ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING, flags:{xss:TRUE});

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1420.NASL
description	An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	125841
published	2019-06-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125841
title	RHEL 7 : JBoss EAP (RHSA-2019:1420)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1420. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125841); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1420"); script_name(english:"RHEL 7 : JBoss EAP (RHSA-2019:1420)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1420" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-java-jdk8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^7([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1420"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL7", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL7", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-java-jdk11-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-java-jdk8-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el7")) flag++; if (rpm_check(release:"RHEL7", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el7")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1419.NASL
description	An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
last seen	2020-06-01
modified	2020-06-02
plugin id	125840
published	2019-06-12
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125840
title	RHEL 6 : JBoss EAP (RHSA-2019:1419)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2019:1419. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(125840); script_version("1.6"); script_cvs_date("Date: 2020/01/10"); script_cve_id("CVE-2019-3872", "CVE-2019-3873", "CVE-2019-3888"); script_xref(name:"RHSA", value:"2019:1419"); script_name(english:"RHEL 6 : JBoss EAP (RHSA-2019:1419)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on JBoss Application Server 7. This release of Red Hat JBoss Enterprise Application Platform 7.2.2 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.2 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es) : * picketlink: reflected XSS in SAMLRequest via RelayState parameter (CVE-2019-3872) * picketlink: URL injection via xinclude parameter (CVE-2019-3873) * undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/documentation/en-us/" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2019:1419" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3872" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3873" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2019-3888" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-3873"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-commons-codec"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hal-console"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-commons"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-core-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-hornetq-jms-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-javassist"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-marshalling-river"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-openjdk-orb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-remoting"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap6.4-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly10.1-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly11.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly12.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly13.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly14.0-server"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly8.2-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-server-migration-wildfly9.0-to-eap7.2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jboss-xnio-base"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-jgroups"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-atom-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-cdi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-client-microprofile"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-crypto"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jackson2-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxb-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jaxrs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jettison-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jose-jwt"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-jsapi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-binding-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-json-p-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-multipart-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-rxjava2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-spring"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-validator-provider-11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-resteasy-yaml-provider"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-undertow"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-impl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-core-jsf"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-ejb"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-jta"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-probe-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-weld-web"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-discovery-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-client-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-ejb-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-naming-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-http-transaction-client"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-naming-client"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"patch_publication_date", value:"2019/06/10"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^6([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2019:1419"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (! (rpm_exists(release:"RHEL6", rpm:"eap7-jboss"))) audit(AUDIT_PACKAGE_NOT_INSTALLED, "JBoss EAP"); if (rpm_check(release:"RHEL6", reference:"eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-services-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-apache-cxf-tools-3.2.7-2.redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hal-console-3.0.11-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-core-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-entitymanager-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-envers-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hibernate-java8-5.3.10-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-commons-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-core-client-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-hornetq-jms-client-2.4.7-7.Final_redhat_2.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-api-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-impl-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-common-spi-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-core-api-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-core-impl-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-deployers-common-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-jdbc-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-ironjacamar-validator-1.4.16-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-javassist-3.23.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-ejb-client-4.0.18-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-marshalling-2.0.7-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-marshalling-river-2.0.7-2.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-modules-1.8.8-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-openjdk-orb-8.1.3-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-remoting-5.0.9-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-cli-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-core-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap6.4-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.1-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.1-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly11.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly12.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly13.0-server-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly14.0-server-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly8.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly9.0-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-2.Final_redhat_00002.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jboss-xnio-base-3.6.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-jgroups-4.0.19-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-api-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-bindings-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-common-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-config-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-federation-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-api-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-impl-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-idm-simple-schema-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-impl-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-picketlink-wildfly8-2.5.5-17.SP12_redhat_00005.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-atom-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-cdi-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-client-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-client-microprofile-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-crypto-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jackson-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jackson2-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jaxb-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jaxrs-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jettison-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jose-jwt-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-jsapi-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-json-binding-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-json-p-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-multipart-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-rxjava2-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-spring-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-validator-provider-11-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-resteasy-yaml-provider-3.6.1-5.SP5_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-undertow-2.0.20-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-impl-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-core-jsf-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-ejb-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-jta-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-probe-core-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-weld-web-3.0.6-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-common-1.5.1-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-discovery-client-1.1.2-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-client-common-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-ejb-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-naming-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-http-transaction-client-1.0.15-1.Final_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-javadocs-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-modules-7.2.2-2.GA_redhat_00001.1.el6")) flag++; if (rpm_check(release:"RHEL6", reference:"eap7-wildfly-naming-client-1.0.10-1.Final_redhat_00001.1.el6")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "eap7-apache-commons-codec / eap7-apache-cxf / eap7-apache-cxf-rt / etc"); } }

Redhat

advisories

rhsa
id RHSA-2019:2439
rhsa
id RHSA-2019:2998
rhsa
id RHSA-2020:0727

rpms

eap7-apache-commons-codec-0:1.11.0-2.redhat_00001.1.el6eap
eap7-apache-cxf-0:3.2.7-2.redhat_00002.1.el6eap
eap7-apache-cxf-rt-0:3.2.7-2.redhat_00002.1.el6eap
eap7-apache-cxf-services-0:3.2.7-2.redhat_00002.1.el6eap
eap7-apache-cxf-tools-0:3.2.7-2.redhat_00002.1.el6eap
eap7-hal-console-0:3.0.11-1.Final_redhat_00001.1.el6eap
eap7-hibernate-0:5.3.10-1.Final_redhat_00001.1.el6eap
eap7-hibernate-core-0:5.3.10-1.Final_redhat_00001.1.el6eap
eap7-hibernate-entitymanager-0:5.3.10-1.Final_redhat_00001.1.el6eap
eap7-hibernate-envers-0:5.3.10-1.Final_redhat_00001.1.el6eap
eap7-hibernate-java8-0:5.3.10-1.Final_redhat_00001.1.el6eap
eap7-hornetq-0:2.4.7-7.Final_redhat_2.1.el6eap
eap7-hornetq-commons-0:2.4.7-7.Final_redhat_2.1.el6eap
eap7-hornetq-core-client-0:2.4.7-7.Final_redhat_2.1.el6eap
eap7-hornetq-jms-client-0:2.4.7-7.Final_redhat_2.1.el6eap
eap7-ironjacamar-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-common-api-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-common-impl-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-common-spi-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-core-api-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-core-impl-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-deployers-common-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-jdbc-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-ironjacamar-validator-0:1.4.16-2.Final_redhat_00001.1.el6eap
eap7-javassist-0:3.23.2-2.GA_redhat_00001.1.el6eap
eap7-jboss-ejb-client-0:4.0.18-1.Final_redhat_00001.1.el6eap
eap7-jboss-marshalling-0:2.0.7-2.Final_redhat_00001.1.el6eap
eap7-jboss-marshalling-river-0:2.0.7-2.Final_redhat_00001.1.el6eap
eap7-jboss-modules-0:1.8.8-1.Final_redhat_00001.1.el6eap
eap7-jboss-openjdk-orb-0:8.1.3-1.Final_redhat_00001.1.el6eap
eap7-jboss-remoting-0:5.0.9-1.Final_redhat_00001.1.el6eap
eap7-jboss-server-migration-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-cli-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-core-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap6.4-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap6.4-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap7.0-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap7.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap7.1-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap7.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly10.0-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly10.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly10.1-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly10.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly11.0-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly11.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly12.0-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly12.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly13.0-server-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly14.0-server-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly8.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly8.2-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly9.0-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-server-migration-wildfly9.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el6eap
eap7-jboss-xnio-base-0:3.6.6-1.Final_redhat_00001.1.el6eap
eap7-jgroups-0:4.0.19-1.Final_redhat_00001.1.el6eap
eap7-picketlink-api-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-bindings-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-common-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-config-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-federation-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-idm-api-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-idm-impl-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-idm-simple-schema-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-impl-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-picketlink-wildfly8-0:2.5.5-17.SP12_redhat_00005.1.el6eap
eap7-resteasy-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-atom-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-cdi-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-client-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-client-microprofile-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-crypto-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jackson-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jackson2-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jaxb-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jaxrs-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jettison-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jose-jwt-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-jsapi-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-json-binding-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-json-p-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-multipart-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-rxjava2-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-spring-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-validator-provider-11-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-resteasy-yaml-provider-0:3.6.1-5.SP5_redhat_00001.1.el6eap
eap7-undertow-0:2.0.20-1.Final_redhat_00001.1.el6eap
eap7-weld-core-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-core-impl-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-core-jsf-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-ejb-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-jta-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-probe-core-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-weld-web-0:3.0.6-1.Final_redhat_00001.1.el6eap
eap7-wildfly-0:7.2.2-2.GA_redhat_00001.1.el6eap
eap7-wildfly-common-0:1.5.1-1.Final_redhat_00001.1.el6eap
eap7-wildfly-discovery-client-0:1.1.2-1.Final_redhat_00001.1.el6eap
eap7-wildfly-http-client-common-0:1.0.15-1.Final_redhat_00001.1.el6eap
eap7-wildfly-http-ejb-client-0:1.0.15-1.Final_redhat_00001.1.el6eap
eap7-wildfly-http-naming-client-0:1.0.15-1.Final_redhat_00001.1.el6eap
eap7-wildfly-http-transaction-client-0:1.0.15-1.Final_redhat_00001.1.el6eap
eap7-wildfly-javadocs-0:7.2.2-2.GA_redhat_00001.1.el6eap
eap7-wildfly-modules-0:7.2.2-2.GA_redhat_00001.1.el6eap
eap7-wildfly-naming-client-0:1.0.10-1.Final_redhat_00001.1.el6eap
eap7-apache-commons-codec-0:1.11.0-2.redhat_00001.1.el7eap
eap7-apache-cxf-0:3.2.7-2.redhat_00002.1.el7eap
eap7-apache-cxf-rt-0:3.2.7-2.redhat_00002.1.el7eap
eap7-apache-cxf-services-0:3.2.7-2.redhat_00002.1.el7eap
eap7-apache-cxf-tools-0:3.2.7-2.redhat_00002.1.el7eap
eap7-hal-console-0:3.0.11-1.Final_redhat_00001.1.el7eap
eap7-hibernate-0:5.3.10-1.Final_redhat_00001.1.el7eap
eap7-hibernate-core-0:5.3.10-1.Final_redhat_00001.1.el7eap
eap7-hibernate-entitymanager-0:5.3.10-1.Final_redhat_00001.1.el7eap
eap7-hibernate-envers-0:5.3.10-1.Final_redhat_00001.1.el7eap
eap7-hibernate-java8-0:5.3.10-1.Final_redhat_00001.1.el7eap
eap7-hornetq-0:2.4.7-7.Final_redhat_2.1.el7eap
eap7-hornetq-commons-0:2.4.7-7.Final_redhat_2.1.el7eap
eap7-hornetq-core-client-0:2.4.7-7.Final_redhat_2.1.el7eap
eap7-hornetq-jms-client-0:2.4.7-7.Final_redhat_2.1.el7eap
eap7-ironjacamar-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-api-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-impl-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-common-spi-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-core-api-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-core-impl-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-deployers-common-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-jdbc-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-ironjacamar-validator-0:1.4.16-2.Final_redhat_00001.1.el7eap
eap7-javassist-0:3.23.2-2.GA_redhat_00001.1.el7eap
eap7-jboss-ejb-client-0:4.0.18-1.Final_redhat_00001.1.el7eap
eap7-jboss-marshalling-0:2.0.7-2.Final_redhat_00001.1.el7eap
eap7-jboss-marshalling-river-0:2.0.7-2.Final_redhat_00001.1.el7eap
eap7-jboss-modules-0:1.8.8-1.Final_redhat_00001.1.el7eap
eap7-jboss-openjdk-orb-0:8.1.3-1.Final_redhat_00001.1.el7eap
eap7-jboss-remoting-0:5.0.9-1.Final_redhat_00001.1.el7eap
eap7-jboss-server-migration-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-cli-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-core-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap6.4-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap6.4-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap7.0-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap7.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap7.1-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap7.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly10.0-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly10.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly10.1-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly10.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly11.0-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly11.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly12.0-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly12.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly13.0-server-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly14.0-server-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly8.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly8.2-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly9.0-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-server-migration-wildfly9.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el7eap
eap7-jboss-xnio-base-0:3.6.6-1.Final_redhat_00001.1.el7eap
eap7-jgroups-0:4.0.19-1.Final_redhat_00001.1.el7eap
eap7-picketlink-api-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-bindings-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-common-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-config-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-federation-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-idm-api-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-idm-impl-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-idm-simple-schema-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-impl-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-picketlink-wildfly8-0:2.5.5-17.SP12_redhat_00005.1.el7eap
eap7-resteasy-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-atom-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-cdi-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-client-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-client-microprofile-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-crypto-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jackson-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jackson2-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jaxb-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jaxrs-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jettison-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jose-jwt-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-jsapi-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-json-binding-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-json-p-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-multipart-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-rxjava2-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-spring-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-validator-provider-11-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-resteasy-yaml-provider-0:3.6.1-5.SP5_redhat_00001.1.el7eap
eap7-undertow-0:2.0.20-1.Final_redhat_00001.1.el7eap
eap7-weld-core-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-core-impl-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-core-jsf-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-ejb-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-jta-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-probe-core-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-weld-web-0:3.0.6-1.Final_redhat_00001.1.el7eap
eap7-wildfly-0:7.2.2-2.GA_redhat_00001.1.el7eap
eap7-wildfly-common-0:1.5.1-1.Final_redhat_00001.1.el7eap
eap7-wildfly-discovery-client-0:1.1.2-1.Final_redhat_00001.1.el7eap
eap7-wildfly-http-client-common-0:1.0.15-1.Final_redhat_00001.1.el7eap
eap7-wildfly-http-ejb-client-0:1.0.15-1.Final_redhat_00001.1.el7eap
eap7-wildfly-http-naming-client-0:1.0.15-1.Final_redhat_00001.1.el7eap
eap7-wildfly-http-transaction-client-0:1.0.15-1.Final_redhat_00001.1.el7eap
eap7-wildfly-java-jdk11-0:7.2.2-2.GA_redhat_00001.1.el7eap
eap7-wildfly-java-jdk8-0:7.2.2-2.GA_redhat_00001.1.el7eap
eap7-wildfly-javadocs-0:7.2.2-2.GA_redhat_00001.1.el7eap
eap7-wildfly-modules-0:7.2.2-2.GA_redhat_00001.1.el7eap
eap7-wildfly-naming-client-0:1.0.10-1.Final_redhat_00001.1.el7eap
eap7-apache-commons-codec-0:1.11.0-2.redhat_00001.1.el8eap
eap7-apache-cxf-0:3.2.7-2.redhat_00002.1.el8eap
eap7-apache-cxf-rt-0:3.2.7-2.redhat_00002.1.el8eap
eap7-apache-cxf-services-0:3.2.7-2.redhat_00002.1.el8eap
eap7-apache-cxf-tools-0:3.2.7-2.redhat_00002.1.el8eap
eap7-hal-console-0:3.0.11-1.Final_redhat_00001.1.el8eap
eap7-hibernate-0:5.3.10-1.Final_redhat_00001.1.el8eap
eap7-hibernate-core-0:5.3.10-1.Final_redhat_00001.1.el8eap
eap7-hibernate-entitymanager-0:5.3.10-1.Final_redhat_00001.1.el8eap
eap7-hibernate-envers-0:5.3.10-1.Final_redhat_00001.1.el8eap
eap7-hibernate-java8-0:5.3.10-1.Final_redhat_00001.1.el8eap
eap7-hornetq-0:2.4.7-7.Final_redhat_2.1.el8eap
eap7-hornetq-commons-0:2.4.7-7.Final_redhat_2.1.el8eap
eap7-hornetq-core-client-0:2.4.7-7.Final_redhat_2.1.el8eap
eap7-hornetq-jms-client-0:2.4.7-7.Final_redhat_2.1.el8eap
eap7-ironjacamar-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-api-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-impl-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-common-spi-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-core-api-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-core-impl-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-deployers-common-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-jdbc-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-ironjacamar-validator-0:1.4.16-2.Final_redhat_00001.1.el8eap
eap7-javassist-0:3.23.2-2.GA_redhat_00001.1.el8eap
eap7-jboss-ejb-client-0:4.0.18-1.Final_redhat_00001.1.el8eap
eap7-jboss-marshalling-0:2.0.7-2.Final_redhat_00001.1.el8eap
eap7-jboss-marshalling-river-0:2.0.7-2.Final_redhat_00001.1.el8eap
eap7-jboss-modules-0:1.8.8-1.Final_redhat_00001.1.el8eap
eap7-jboss-openjdk-orb-0:8.1.3-1.Final_redhat_00001.1.el8eap
eap7-jboss-remoting-0:5.0.9-1.Final_redhat_00001.1.el8eap
eap7-jboss-server-migration-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-cli-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-core-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap6.4-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap6.4-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap7.0-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap7.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap7.1-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap7.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly10.0-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly10.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly10.1-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly10.1-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly11.0-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly11.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly12.0-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly12.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly13.0-server-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly14.0-server-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly8.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly8.2-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly9.0-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-server-migration-wildfly9.0-to-eap7.2-0:1.3.1-2.Final_redhat_00002.1.el8eap
eap7-jboss-xnio-base-0:3.6.6-1.Final_redhat_00001.1.el8eap
eap7-jgroups-0:4.0.19-1.Final_redhat_00001.1.el8eap
eap7-picketlink-api-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-bindings-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-common-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-config-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-federation-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-idm-api-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-idm-impl-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-idm-simple-schema-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-impl-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-picketlink-wildfly8-0:2.5.5-17.SP12_redhat_00005.1.el8eap
eap7-resteasy-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-atom-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-cdi-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-client-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-client-microprofile-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-crypto-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jackson-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jackson2-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jaxb-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jaxrs-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jettison-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jose-jwt-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-jsapi-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-json-binding-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-json-p-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-multipart-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-rxjava2-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-spring-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-validator-provider-11-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-resteasy-yaml-provider-0:3.6.1-5.SP5_redhat_00001.1.el8eap
eap7-undertow-0:2.0.20-1.Final_redhat_00001.1.el8eap
eap7-weld-core-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-core-impl-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-core-jsf-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-ejb-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-jta-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-probe-core-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-weld-web-0:3.0.6-1.Final_redhat_00001.1.el8eap
eap7-wildfly-0:7.2.2-2.GA_redhat_00001.1.el8eap
eap7-wildfly-common-0:1.5.1-1.Final_redhat_00001.1.el8eap
eap7-wildfly-discovery-client-0:1.1.2-1.Final_redhat_00001.1.el8eap
eap7-wildfly-http-client-common-0:1.0.15-1.Final_redhat_00001.1.el8eap
eap7-wildfly-http-ejb-client-0:1.0.15-1.Final_redhat_00001.1.el8eap
eap7-wildfly-http-naming-client-0:1.0.15-1.Final_redhat_00001.1.el8eap
eap7-wildfly-http-transaction-client-0:1.0.15-1.Final_redhat_00001.1.el8eap
eap7-wildfly-javadocs-0:7.2.2-2.GA_redhat_00001.1.el8eap
eap7-wildfly-modules-0:7.2.2-2.GA_redhat_00001.1.el8eap
eap7-wildfly-naming-client-0:1.0.10-1.Final_redhat_00001.1.el8eap
rhvm-appliance-2:4.3-20190722.0.el7

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References