The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3466 advisory.

– jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)

– apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425)

– undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597)

– wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644)

– undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.Read More