A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM) attacks.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's     certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM)     attacks. (CVE-2022-2996)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's
    certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle (MITM)
    attacks. (CVE-2022-2996)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:0276 advisory.

    Python ServerView Common Command Interface (SCCI) Client Library

    Security Fix(es):

    * missing server certificate verification (CVE-2022-2996)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2022:7399

    Security Fix(es):

    * go-yaml: Denial of Service in go-yaml (CVE-2021-4235)
    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
    * kubernetes: Unauthorized read of Custom Resources (CVE-2022-3162)
    * kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
    * cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)
    * OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)
    * cri-o: Security regression of CVE-2022-27652 (CVE-2022-3466)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

  - go-yaml: Denial of Service in go-yaml (CVE-2021-4235)

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers     (CVE-2022-2879)

  - golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

  - cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8868 advisory.

    Python ServerView Common Command Interface (SCCI) Client Library

    Security Fix(es):

    * missing server certificate verification (CVE-2022-2996)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3180 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3180-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Dominik George     November 07, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-scciclient     Version        : 0.7.2-2+deb10u1     CVE ID         : CVE-2022-2996     Debian Bug     : 1018213

    It was discovered that scciclient did not verify server TLS     certificates when making requests.

    For Debian 10 buster, this problem has been fixed in version     0.7.2-2+deb10u1.

    We recommend that you upgrade your python-scciclient packages.

    For the detailed security status of python-scciclient please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-scciclient

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224668	Linux Distros Unpatched Vulnerability : CVE-2022-2996	Nessus	Misc.	high
418683	SCA: security update for python-scciclient (GHSA-rf3f-3p37-2qh4)	Tenable Cloud Security	SCA Checks	critical
418683	SCA: security update for python-scciclient (GHSA-rf3f-3p37-2qh4)	Tenable Self-Hosted Container Security	SCA Checks	critical
194328	RHEL 9 : Red Hat OpenStack Platform 17.0 (python-scciclient) (RHSA-2023:0276)	Nessus	Red Hat Local Security Checks	high
194196	RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	high
189448	RHCOS 4 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	critical
170382	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (python-scciclient) (RHSA-2022:8868)	Nessus	Red Hat Local Security Checks	high
167092	Debian dla-3180 : python-scciclient-doc - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2022-2996

critical

Tenable Plugins

high

critical

critical

high

high

critical

high

high