In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2769 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2711 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous security updates, bug fixes, and a known issue. Space precludes     documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release     Notes for information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

    ==========================================     IMPORTANT:
    The Red Hat Ceph Storage team has migrated our defect tracking from Bugzilla to an internal Jira system.
    Bug fixes and CVE information that was previously listed in the errata releases are now listed in the     Release Notes.

    During the migration period, some defect details might still appear temporarily in the Errata. However,     the release notes contain the most current and authoritative information, including the complete list of     fixes and security updates.

    Refer to the release notes going forward for the latest and most accurate fix and CVE information.
    ==========================================

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can     involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic     backtracking. (CVE-2022-34749)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can
    involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic
    backtracking. (CVE-2022-34749)

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-e4f5866111 advisory.

    - updates `mistune` to 2.0.4
    - `m2r` updated to pin dependency to `mistune < 2`
    - new package: `python-mistune08` compatibility package, to be used by dependents that cannot use the new     mistune (namely `nbconvert`)
    - new package: `python-sphinx-typlog-theme`, needed to build `mistune` 2.x documentation

    ----

    Compatibility package for mistune 0.8, so we can update mistune to 2x without breaking unported dependents     like nbconvert


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299273	RHEL 8 / 9 : Red Hat Ceph Storage 7.1 (RHSA-2026:2769)	Nessus	Red Hat Local Security Checks	high
299162	RHEL 9 : Red Hat Ceph Storage 8.1 (RHSA-2026:2711)	Nessus	Red Hat Local Security Checks	high
224789	Linux Distros Unpatched Vulnerability : CVE-2022-34749	Nessus	Misc.	high
414722	SCA: security update for mistune (GHSA-fw3v-x4f2-v673)	Tenable Cloud Security	SCA Checks	high
414722	SCA: security update for mistune (GHSA-fw3v-x4f2-v673)	Tenable Self-Hosted Container Security	SCA Checks	high
211000	Fedora 37 : python-m2r / python-mistune / python-mistune08 / etc (2022-e4f5866111)	Nessus	Fedora Local Security Checks	high
406680	Alpine: multiple py3-mistune packages: security update to 2.0.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406680	Alpine: multiple py3-mistune packages: security update to 2.0.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high

Detections

Analytics

CVE-2022-34749

high

Tenable Plugins

high

high

high

high

high

high

high

high