[Linux-PowerEdge] srvadmin-jre-9.4.0-3787.15943.el7.x86_64.rpm vulnerable
Spike_White at Dell.com
Spike_White at Dell.com
Mon Mar 16 12:14:48 CDT 2020
I am an OMSA consumer -- same as you.
Because we do not routinely update the OMSA versions on our older server builds, our cybersecurity team identifies a lot of java vulnerabilities as well. To avoid this maintenance nightmare, our team now has a policy of doing the OMSA install minus the GUI (which also means minus java and minus tomcat). Now We have also retrofitted our old OMSA builds -- removed the GUI, java and tomcat.
Occasionally, the cybersecurity team picked up tomcat vulnerabilities in the older OMSA installs, but it's far more frequent that they picked up java vulnerabilities.
To install OMSA w/o the CLI isn't quite as easy as installing the full OMSA. To install the full OMSA, you merely do a:
yum install srvadmin-all
At least for OMSA 9.4, a colleague has gone through the list of RPMs and determined this was the min set to install OMSA functions, but without java/GUI:
yum install dell-system-update srvadmin-base srvadmin-storageservices srvadmin-idrac srvadmin-server-snmp srvadmin-server-cli
Date: Fri, 13 Mar 2020 10:18:31 +0100
From: "mr.zbiggy" <mr.zbiggy at upcpoczta.pl>
To: linux-poweredge at dell.com
Subject: [Linux-PowerEdge] [Security Alert] Latest Dell's
Message-ID: <ef5ce32c-97c2-80a9-642f-e2e5fe6098ba at upcpoczta.pl>
Content-Type: text/plain; charset="utf-8"
Nessus Security Scanner found your package:
srvadmin-jre-9.4.0-3787.15943.el7.x86_64.rpm vulnerable. Please update.
Java JRE 1.11.0_4 from Dell's package:
has several vulnerabilities. Please update to fixed Java JRE 1.11.0_6 or stop distributing Java JRE and start using Java from Operating System which is faster maintained.
Package : srvadmin-jre-9.4.0-3787.15943.el7.x86_64.rpm
Path : /opt/dell/srvadmin/lib64/openmanage/
Installed version : 1.11.0_4
Fixed version : 1.11.0_6
The version of Oracle (formerly Sun) Java SE or Java for Business installed on the remote host is prior to 11 Update 6. It is, therefore, affected by multiple vulnerabilities related to the following components:
Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
- Oracle Java SE and Java SE Embedded are prone to a severe division by zero, over 'Multiple' protocol. This issue affects the 'SQLite'
- Oracle Java SE and Java SE Embedded are prone to format string vulnerability, leading to a read uninitialized stack data over 'Multiple' protocol. This issue affects the 'libxst' component.
- Oracle Java SE and Java SE Embedded are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit this over 'Kerberos' protocol. This issue affects the 'Security' component.
- Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit this overmultiple protocols. This issue affects the 'Serialization'
component. (CVE-2020-2604, CVE-2020-2583)
- Oracle Java SE/Java SE Embedded are prone to a remote security vulnerability. Tn unauthenticated remote attacker can exploit this over multiple protocols. This issue affects the 'Networking' component.
- Oracle Java SE are prone to a remote security vulnerability. An unauthenticated remote attacker can exploit this over multiple protocols. This issue affects the 'Libraries' component. (CVE-2020-2654)
- Oracle Java SE are prone to a multiple security vulnerability. An unauthenticated remote attacker can exploit this over multiple protocols. This issue affects the 'JavaFX' component. (CVE-2020-2585)
- Oracle Java SE are prone to a multiple security vulnerability. An unauthenticate remote attacker can exploit this over 'HTTPS' protocols.
This issue affects the 'JSSE' component. (CVE-2020-2655)
More information about the Linux-PowerEdge