Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 6.0.9. It is, therefore, affected by multiple vulnerabilities:

  - Multiple denial of service vulnerabilities in the included OpenSSL component. (CVE-2019-1551, CVE-2020-1967,     CVE-2020-1971, CVE-2021-3449, CVE-2021-23840)

  - Multiple cross site scripting vulnerabilities in the included JQuery component. (CVE-2020-11022, CVE-2020-11023)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle E-Business Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - A vulnerability exists in the Oracle Applications Framework product of Oracle E-Business Suite (component:
    Home page). The supported version that is affected is 12.2.10. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Applications Framework accessible data as well as unauthorized     access to critical data or complete access to all Oracle Applications Framework accessible data.
    (CVE-2021-2200)

  - A vulnerability exists in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing     Administration). Supported versions that are affected are 12.2.7-12.2.10. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Oracle Marketing accessible data as well as unauthorized access to critical data or     complete access to all Oracle Marketing accessible data. (CVE-2021-2205)

  - A vulnerability exists in the Oracle Email Center product of Oracle E-Business Suite (component: Message     Display). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Email     Center. While the vulnerability is in Oracle Email Center, attacks may significantly impact additional     products. Successful attacks of this vulnerability can result in unauthorized access to critical data or     complete access to all Oracle Email Center accessible data as well as unauthorized update, insert or     delete access to some of Oracle Email Center accessible data. (CVE-2021-2209)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The X.509 GeneralName type is a generic type for     representing different types of names. One of those     name types is known as EDIPartyName. OpenSSL provides a     function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or     not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer     dereference and a crash may occur leading to a possible     denial of service attack. OpenSSL itself uses the     GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an     available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp     response token signer matches the timestamp authority     name (exposed via the API functions     TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then     that attacker could trigger a crash. For example if the     attacker can trick a client or server into checking a     malicious certificate against a malicious CRL then this     may occur. Note that some applications automatically     download CRLs based on a URL embedded in a certificate.
    This checking happens prior to the signatures on the     certificate and CRL being verified. OpenSSL's s_server,     s_client and verify tools have support for the     '-crl_download' option which implements automatic CRL     downloading and this attack has been demonstrated to     work against those tools. Note that an unrelated bug     means that affected versions of OpenSSL cannot parse or     construct correct encodings of EDIPARTYNAME. However it     is possible to construct a malformed EDIPARTYNAME that     OpenSSL's parser will accept and hence trigger this     attack. All OpenSSL 1.1.1 and 1.0.2 versions are     affected by this issue. Other OpenSSL releases are out     of support and have not been checked. Fixed in OpenSSL     1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x     (Affected 1.0.2-1.0.2w).(CVE-2020-1971)

  - A NULL pointer dereference flaw was found in the way     OpenSSL handled certain TLS handshake messages. This     flaw allows an unauthenticated attacker to cause a     server application compiled with OpenSSL to crash,     causing a denial of service. In some cases a malicious     server could also cause a client compiled with OpenSSL     to crash.(CVE-2020-1967)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is earlier than 5.17.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues nor the stand-alone patch but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host is affected by the following vulnerabilities as referenced in the October 2020 CPU advisory:

  - A denial of service (DoS) vulnerability exists in the SSL Module (OpenSSL). An unauthenticated, remote     attacker with network access via HTTPS, can exploit this issue to cause a hang or frequently repeatable     crash (complete DoS) of Oracle HTTP Server. (CVE-2020-1967)

  - An unspecified vulnerability exists in the Apache HTTP Server Core component.  A authenticated, remote     attacker with network access via HTTP, can exploit this issue to compromise the Oracle HTTP Server.     Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2019-10097)

  - An unspecified vulnerability exists in Web Listener (cURL). An unauthenticated, remote attacker with     network access via TFTP can exploit this issue to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2019-5482)   Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The 13.3.0.0, 13.3.1.0 and 13.4.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2020 CPU advisory.

  - Vulnerability in the Enterprise Manager for Storage Management product of Oracle Enterprise Manager     (component: Privilege Management (OpenSSL)). Supported versions that are affected are 13.3.0.0 and     13.4.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     HTTPS to compromise Enterprise Manager for Storage Management. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Enterprise Manager for Storage Management. (CVE-2020-1967)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Event Management). Supported versions that are affected are 13.3.0.0 and 13.4.0.0. Easily exploitable     vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager     Base Platform. While the vulnerability is in Enterprise Manager Base Platform, attacks may significantly     impact additional products. Successful attacks of this vulnerability can result in unauthorized update,     insert or delete access to some of Enterprise Manager Base Platform accessible data as well as     unauthorized read access to a subset of Enterprise Manager Base Platform accessible data. (CVE-2019-2897)

  - Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component:
    Connector Framework (Apache CXF)). The supported version that is affected is 13.2.1.0. Difficult to     exploit vulnerability allows unauthenticated attacker with access to the physical communication segment     attached to the hardware where the Enterprise Manager Base Platform executes to compromise Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to     critical data or complete access to all Enterprise Manager Base Platform accessible data. (CVE-2020-1954)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for rust, rust-cbindgen fixes the following issues :

  - Updated openssl-src to 1.1.1g for CVE-2020-1967.

The 8.0.20 and prior versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the July 2020 CPU advisory. A vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)). Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. (CVE-2020-1967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.6.x prior to and including 5.6.48. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2020 Critical Patch Update advisory:

  -  A vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions   that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable   vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14539)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are   affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows   low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful   attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash   (complete DOS) of MySQL Client. (CVE-2020-14550)

  - Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/C++ (OpenSSL)).
  Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows unauthenticated   attacker with network access via TLS to compromise MySQL Connectors. Successful attacks of this vulnerability can   result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL   Connectors. (CVE-2020-1967)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 5.7.x prior to and including 5.7.30. It is, therefore, affected by multiple vulnerabilities, as noted in the July 2020 Critical Patch Update advisory:

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions   that are affected are 5.7.30 and prior and 8.0.17 and prior. Easily exploitable vulnerability allows high   privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of   this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete   DOS) of MySQL Server. (CVE-2021-2160)

  - A vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions   that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Easily exploitable   vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently   repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14539)

 - A vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are   affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows   low privileged attacker with network access via multiple protocols to compromise MySQL Client. Successful   attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash   (complete DOS) of MySQL Client. (CVE-2020-14550)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 4.0.x prior to 4.0.13.5349 or 8.0.x prior to 8.0.21.1240. It is, therefore, affected by multiple vulnerabilities:
  - A buffer overflow condition exists in the Montgomery squaring procedure due to unsufficient validation   of user-supplied input. An unauthenticated, remote attacker can exploit this, to cause a denial of service   condition or the execution of arbitrary code. (CVE-2019-1551).

  - A denial of service (DoS) vulnerability exists in the SSL_check_chain() function due to a NULL pointer   dereference. An unauthenticated, remote attacker can exploit this issue, to cause the application   to stop responding (CVE-2020-1967).

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of MySQL running on the remote host is 8.0.x prior to and including 8.0.20. It is, therefore, affected by multiple vulnerabilities, including the following, as noted in the July 2020 Critical Patch Update advisory:

  -  Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges).
  Supported versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged   attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in takeover of MySQL Server. (CVE-2020-14697, CVE-2020-14678)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions   that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with   network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can   result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-14680)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Roles). Supported   versions that are affected are 8.0.20 and prior. Easily exploitable vulnerability allows high privileged   attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this   vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL   Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. (CVE-2020-14651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Nessus Agent leverages third-party software to help provide underlying functionality. One of the third-party components (OpenSSL) was found to contain a multiple vulnerabilities, and updated versions have been made available by the providers.

Out of caution and in line with good practice, Tenable opted to upgrade the bundled library to address the potential impact of these issues in Nessus Agent. Nessus Agent 7.6.3 updates OpenSSL to version 1.1.1g to address the identified vulnerabilities.

According to the version of the openssl111d packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Server or client applications that call the     SSL_check_chain() function during or after a TLS 1.3     handshake may crash due to a NULL pointer dereference     as a result of incorrect handling of the     'signature_algorithms_cert' TLS extension. The crash     occurs if an invalid or unrecognised signature     algorithm is received from the peer. This could be     exploited by a malicious peer in a Denial of Service     attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are     affected by this issue. This issue did not affect     OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL     1.1.1g (Affected 1.1.1d-1.1.1f).(CVE-2020-1967)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to version 1.1.1g from upstream fixing possible remote DoS security issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gitlab reports :

Path Traversal in NuGet Package Registry

Workhorse Bypass Leads to File Disclosure

OAuth Application Client Secrets Revealed

Code Owners Approval Rules Are Not Updated for Existing Merge Requests When Source Branch Changes

Code Owners Protection Not Enforced from Web UI

Repository Mirror Passwords Exposed To Maintainers

Admin Audit Log Page Denial of Service

Private Project ID Revealed Through Group API

Elasticsearch Credentials Logged to ELK

GitHub Personal Access Token Exposed on Integrations Page

Update Nokogiri dependency

Update OpenSSL Dependency

Update git

The remote host is affected by the vulnerability described in GLSA-202004-10 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could perform a malicious crafted TLS 1.3 handshake       against an application using OpenSSL, possibly resulting in a Denial of       Service condition.
    In addition, it&rsquo;s feasible that an attacker might attack DH512.
  Workaround :

    There is no known workaround at this time.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1.1.1g advisory.

  - Server or client applications that call the     SSL_check_chain() function during or after a TLS 1.3     handshake may crash due to a NULL pointer dereference as     a result of incorrect handling of the     signature_algorithms_cert TLS extension. The crash     occurs if an invalid or unrecognised signature algorithm     is received from the peer. This could be exploited by a     malicious peer in a Denial of Service attack. OpenSSL     version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this     issue. This issue did not affect OpenSSL versions prior     to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected     1.1.1d-1.1.1f). (CVE-2020-1967)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for openssl-1_1 fixes the following issues :

CVE-2020-1967: Fixed a denial of service via NULL pointer dereference in SSL_check_chain (bsc#1169407).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the 'signature_algorithms_cert' TLS extension. The crash occurs if an invalid or unrecognized signature algorithm is received from the peer.
Impact : A malicious peer could exploit the NULL pointer dereference crash, causing a denial of service attack.

Bernd Edlinger discovered that malformed data passed to the SSL_check_chain() function during or after a TLS 1.3 handshake could cause a NULL dereference, resulting in denial of service.

The oldstable distribution (stretch) is not affected.

An update of the nxtgn package has been released.

ID	Name	Product	Family	Severity
150139	Tenable Log Correlation Engine (LCE) < 6.0.9 (TNS-2021-10)	Nessus	Misc.	medium
148952	Oracle E-Business Suite Multiple Vulnerabilities (April 2021 CPU)	Nessus	Misc.	critical
147537	EulerOS Virtualization 2.9.1 : openssl (EulerOS-SA-2021-1619)	Nessus	Huawei Local Security Checks	high
144584	Tenable SecurityCenter < 5.17.0 Multiple Vulnerabilities (TNS-2020-11)	Nessus	Misc.	high
142212	Oracle Fusion Middleware Oracle HTTP Server (Oct 2020 CPU)	Nessus	Web Servers	critical
141809	Oracle Enterprise Manager Cloud Control (Oct 2020 CPU)	Nessus	Misc.	medium
138995	SUSE SLED15 / SLES15 Security Update : rust, rust-cbindgen (SUSE-SU-2020:2041-1)	Nessus	SuSE Local Security Checks	high
138732	openSUSE Security Update : rust / rust-cbindgen (openSUSE-2020-945)	Nessus	SuSE Local Security Checks	high
138725	openSUSE Security Update : rust / rust-cbindgen (openSUSE-2020-933)	Nessus	SuSE Local Security Checks	high
138607	Oracle MySQL Connectors (Jul 2020 CPU)	Nessus	Misc.	high
138571	MySQL 5.6.x < 5.6.49 Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	medium
138570	MySQL 5.7.x < 5.7.31 Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	medium
138568	MySQL Enterprise Monitor 4.0.x < 4.0.13.5349 / 8.0.x < 8.0.21.1240 (Jul 2020 CPU)	Nessus	CGI abuses	medium
138560	MySQL 8.0.x < 8.0.21 Multiple Vulnerabilities (Jul 2020 CPU)	Nessus	Databases	high
137757	Tenable Nessus Agent < 7.6.3 Third Party Vulnerability (OpenSSL) (TNS-2020-03)	Nessus	Misc.	medium
137031	EulerOS 2.0 SP5 : openssl111d (EulerOS-SA-2020-1613)	Nessus	Huawei Local Security Checks	high
136439	Fedora 31 : 1:openssl (2020-d7b29838f6)	Nessus	Fedora Local Security Checks	medium
136304	FreeBSD : Gitlab -- Multiple Vulnerabilities (e8483115-8b8e-11ea-bdcf-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
136155	Fedora 30 : 1:openssl (2020-da2d1ef2d7)	Nessus	Fedora Local Security Checks	medium
135946	GLSA-202004-10 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
135919	OpenSSL 1.1.1 < 1.1.1g Vulnerability	Nessus	Web Servers	high
135893	SUSE SLES12 Security Update : openssl-1_1 (SUSE-SU-2020:1058-1)	Nessus	SuSE Local Security Checks	high
135880	FreeBSD : OpenSSL remote denial of service vulnerability (012809ce-83f3-11ea-92ab-00163e433440)	Nessus	FreeBSD Local Security Checks	high
135879	Debian DSA-4661-1 : openssl - security update	Nessus	Debian Local Security Checks	high
135873	Photon OS 3.0: Nxtgn PHSA-2020-3.0-0082	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2020-1967

high

Tenable Plugins

medium

critical

high

high

critical

medium

high

high

high

high

medium

medium

medium

high

medium

high

medium

high

medium

medium

high

high

high

high

high