Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0036 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-14560:
    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: DO NOT     USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not     assigned to any issues during 2019. Notes: none.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1415 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230)

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    * edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0408 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236066	Alibaba Cloud Linux 3 : 0036: edk2 (ALINUX3-SA-2024:0036)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
192272	RHEL 8 : edk2 (RHSA-2024:1415)	Nessus	Red Hat Local Security Checks	high
189566	RHEL 8 : edk2 (RHSA-2024:0408)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-14560

No Score

Tenable Plugins

medium

high

critical