164 lines
6.2 KiB
Markdown
164 lines
6.2 KiB
Markdown
# Informe Ejecutivo de Vulnerabilidades
|
||
|
||
**Generado en:** 2026-08-11T15:40:58.463Z | **Fuentes:** ENISA
|
||
|
||
**Grupo de Software Libre - Área de Plataformas**
|
||
|
||
* **Informes consolidados:** 10
|
||
* **Vulnerabilidades analizadas:** 13
|
||
* **Aplicables:** 13
|
||
* **No aplicables:** 0
|
||
* **Revisión manual:** 0
|
||
|
||
## Resumen por objetivo
|
||
|
||
| Fuente | Producto | Versión | Analizadas | Aplicables | No aplicables | Revisión manual |
|
||
|---|---|---|---|---|---|---|
|
||
| ENISA | Tomcat | 9.0.119 | 4 | 4 | 0 | 0 |
|
||
| ENISA | Tomcat | 11.0.23 | 4 | 4 | 0 | 0 |
|
||
| ENISA | Jenkins | 2.504.3 | 0 | 0 | 0 | 0 |
|
||
| ENISA | Harbor | 2.11.0 | 0 | 0 | 0 | 0 |
|
||
| ENISA | Openjdk | 21.0.21 | 1 | 1 | 0 | 0 |
|
||
| ENISA | Openjdk | 1.8.0 | 1 | 1 | 0 | 0 |
|
||
| ENISA | GitLab CE | 19.1.1 | 2 | 2 | 0 | 0 |
|
||
| ENISA | Nginx | 1.30.3 | 0 | 0 | 0 | 0 |
|
||
| ENISA | Artemis | 2.54.0 | 0 | 0 | 0 | 0 |
|
||
| ENISA | JasperReports | 10.0.0 | 1 | 1 | 0 | 0 |
|
||
|
||
## Detalle de Vulnerabilidades Aplicables
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-49849 - CVE-2026-66713
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`9.0.119`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.8 3.1
|
||
* **Regla versión:** Afecta rama v9.x
|
||
* **Justificación / Descripción:**
|
||
> Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
|
||
|
||
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
|
||
|
||
(only when...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-49849 - CVE-2026-66713
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`11.0.23`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.8 3.1
|
||
* **Regla versión:** Afecta rama v11.x
|
||
* **Justificación / Descripción:**
|
||
> Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component
|
||
|
||
in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat
|
||
|
||
(only when...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-55673 - CVE-2026-47754
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`9.0.119`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.3 3.1
|
||
* **Regla versión:** Afecta rama v9.x
|
||
* **Justificación / Descripción:**
|
||
> Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path trav...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-55673 - CVE-2026-47754
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`11.0.23`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.3 3.1
|
||
* **Regla versión:** Afecta rama v11.x
|
||
* **Justificación / Descripción:**
|
||
> Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path trav...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-55694 - GHSA-p2q7-r6vq-359j
|
||
|
||
* **Producto / Versión:** `JasperReports` (v`10.0.0`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.3 4.0
|
||
* **Regla versión:** Afecta rama v10.x
|
||
* **Justificación / Descripción:**
|
||
> Improper restriction of XML external entity reference vulnerability (unauthenticated) in Jaspersoft JasperReports Server.
|
||
|
||
This issue affects JasperReports Server: from 9.0.0 befor...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-43640 - CVE-2026-59084
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`9.0.119`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.1 3.1
|
||
* **Regla versión:** Afecta rama v9.x
|
||
* **Justificación / Descripción:**
|
||
> Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.
|
||
|
||
This issue aff...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-43638 - GHSA-hcjr-322h-429r
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`9.0.119`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.1 3.1
|
||
* **Regla versión:** Afecta rama v9.x
|
||
* **Justificación / Descripción:**
|
||
> Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
|
||
|
||
This issue affects Apac...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-43640 - CVE-2026-59084
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`11.0.23`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.1 3.1
|
||
* **Regla versión:** Afecta rama v11.x
|
||
* **Justificación / Descripción:**
|
||
> Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.
|
||
|
||
This issue aff...
|
||
|
||
|
||
### [**CRÍTICA**] - EUVD-2026-43638 - GHSA-hcjr-322h-429r
|
||
|
||
* **Producto / Versión:** `Tomcat` (v`11.0.23`) | **Fuente:** ENISA
|
||
* **BaseScore:** 9.1 3.1
|
||
* **Regla versión:** Afecta rama v11.x
|
||
* **Justificación / Descripción:**
|
||
> Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.
|
||
|
||
This issue affects Apac...
|
||
|
||
|
||
### [**ALTA**] - EUVD-2026-50484 - CVE-2026-6267
|
||
|
||
* **Producto / Versión:** `GitLab CE` (v`19.1.1`) | **Fuente:** ENISA
|
||
* **BaseScore:** 8.5 3.1
|
||
* **Regla versión:** Afecta rama v19.x
|
||
* **Justificación / Descripción:**
|
||
> GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have...
|
||
|
||
|
||
### [**ALTA**] - EUVD-2026-50482 - GHSA-94p8-87ff-w336
|
||
|
||
* **Producto / Versión:** `GitLab CE` (v`19.1.1`) | **Fuente:** ENISA
|
||
* **BaseScore:** 8.4 3.1
|
||
* **Regla versión:** Afecta rama v19.x
|
||
* **Justificación / Descripción:**
|
||
> GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have a...
|
||
|
||
|
||
### [**ALTA**] - EUVD-2026-55984 - CVE-2026-15560
|
||
|
||
* **Producto / Versión:** `Openjdk` (v`21.0.21`) | **Fuente:** ENISA
|
||
* **BaseScore:** 8.1 3.1
|
||
* **Regla versión:** Afecta rama v21.x
|
||
* **Justificación / Descripción:**
|
||
> when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to lo...
|
||
|
||
|
||
### [**ALTA**] - EUVD-2026-55984 - CVE-2026-15560
|
||
|
||
* **Producto / Versión:** `Openjdk` (v`1.8.0`) | **Fuente:** ENISA
|
||
* **BaseScore:** 8.1 3.1
|
||
* **Regla versión:** Afecta rama v1.x
|
||
* **Justificación / Descripción:**
|
||
> when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to lo...
|