CentOS 8：java-1.8.0-openjdk (CESA-2022: 0307)
medium Nessus 插件 ID 157205
语言：
简介
远程 CentOS 主机缺少一个或多个安全更新。描述
远程 CentOS Linux 8 主机上安装的多个程序包受到 CESA-2022: 0307 公告中提及的漏洞的影响。- OpenJDK：ObjectInputStream 未完整过滤反序列化类 (Serialization, 8264934) (CVE-2022-21248)
- OpenJDK：XSLT TransformerImpl 未充分检查 URI (JAXP, 8270492) (CVE-2022-21282)
- OpenJDK：regex 模式下抛出意外异常 (Libraries, 8268813) (CVE-2022-21283)
- OpenJDK：反序列化期间未完整检查 StringBuffer 和 StringBuilder (Libraries, 8270392) (CVE-2022-21293)
- OpenJDK：反序列化期间未正确检查 IdentityHashMap 大小 (Libraries, 8270416) (CVE-2022-21294)
- OpenJDK：XMLEntityManager 未正确检查访问权限 (JAXP, 8270498) (CVE-2022-21296)
- OpenJDK：因 XMLEntityScanner 未正确处理换行符而造成无限循环 (JAXP, 8270646) (CVE-2022-21299)
- OpenJDK：LIRGenerator 中存在数组索引问题 (Hotspot, 8272014) (CVE-2022-21305)
- OpenJDK：读取 JAR 清单属性时过量使用资源问题 (Libraries, 8272026) (CVE-2022-21340)
- OpenJDK：ObjectInputStream 在反序列化异常期间未进行充分检查 (Serialization, 8272236) (CVE-2022-21341)
- OpenJDK：BMPImageReader 中分配的内存过多 (ImageIO, 8273756) (CVE-2022-21360)
- OpenJDK：BMPImageReader 中存在整数溢出 (ImageIO, 8273838) (CVE-2022-21365)
请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。
解决方案
更新受影响的程序包。另见
插件详情
严重性: Medium
ID: 157205
文件名: centos8_RHSA-2022-0307.nasl
版本: 1.4
类型: local
代理: unix
发布时间: 2022/1/28
最近更新时间: 2024/4/10
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Agentless Assessment, Nessus
风险信息
VPR
风险因素: Low
分数: 2.2
CVSS v2
风险因素: Medium
基本分数: 5
时间分数: 3.9
矢量: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS 分数来源: CVE-2022-21305
CVSS v3
风险因素: Medium
基本分数: 5.3
时间分数: 4.8
矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:centos:centos:java-1.8.0-openjdk-javadoc-zip, p-cpe:/a:centos:centos:java-1.8.0-openjdk-slowdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-src, p-cpe:/a:centos:centos:java-1.8.0-openjdk-src-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-src-slowdebug, cpe:/o:centos:centos:8-stream, p-cpe:/a:centos:centos:java-1.8.0-openjdk, p-cpe:/a:centos:centos:java-1.8.0-openjdk-accessibility, p-cpe:/a:centos:centos:java-1.8.0-openjdk-accessibility-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-accessibility-slowdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-demo, p-cpe:/a:centos:centos:java-1.8.0-openjdk-demo-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-demo-slowdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-devel, p-cpe:/a:centos:centos:java-1.8.0-openjdk-devel-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-devel-slowdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-headless, p-cpe:/a:centos:centos:java-1.8.0-openjdk-headless-fastdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-headless-slowdebug, p-cpe:/a:centos:centos:java-1.8.0-openjdk-javadoc
必需的 KB 项: Host/local_checks_enabled, Host/cpu, Host/CentOS/release, Host/CentOS/rpm-list
可利用: true
易利用性: Exploits are available
补丁发布日期: 2022/1/27
漏洞发布日期: 2022/1/18
参考资料信息
CVE: CVE-2022-21248, CVE-2022-21282, CVE-2022-21283, CVE-2022-21293, CVE-2022-21294, CVE-2022-21296, CVE-2022-21299, CVE-2022-21305, CVE-2022-21340, CVE-2022-21341, CVE-2022-21360, CVE-2022-21365
IAVA: 2022-A-0031-S
RHSA: 2022:0307