An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0718 advisory.

  - jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact     via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a     valid vulnerability report, because the steps of constructing a cyclic data structure and trying to     serialize it cannot be achieved by an external attacker. (CVE-2023-35116)

  - In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input     string, like //../foo, or \\..\foo, the result would be the same value, thus possibly providing access     to files in the parent directory, but not further above (thus limited path traversal), if the calling     code would use the result to construct a path value. (CVE-2021-29425)

  - snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The     SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data     with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal     error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable     to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4     release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from     trusted sources. (CVE-2023-43642)

  - snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer     overflow may occur in versions prior to 1.1.10.1, causing a fatal error. The function `shuffle(int[]     input)` in the file `BitShuffle.java` receives an array of integers and applies a bit shuffle on it. It     does so by multiplying the length by 4 and passing it to the natively compiled shuffle function. Since the     length is not tested, the multiplication by four can cause an integer overflow and become a smaller value     than the true size, or even zero or negative. In the case of a negative value, a     `java.lang.NegativeArraySizeException` exception will raise, which can crash the program. In a case of a     value that is zero or too small, the code that afterwards references the shuffled array will assume a     bigger size of the array, which might cause exceptions such as `java.lang.ArrayIndexOutOfBoundsException`.
    The same issue exists also when using the `shuffle` functions that receive a double, float, long and     short, each using a different multiplier that may cause the same issue. Version 1.1.10.1 contains a patch     for this vulnerability. (CVE-2023-34453)

  - snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer     overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function     `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It     does so by multiplying the length by 2 and passing it to the rawCompress` function. Since the length is     not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress     function then uses the received length and passes it to the natively compiled maxCompressedLength     function, using the returned value to allocate a byte array. Since the maxCompressedLength function treats     the length as an unsigned integer, it doesn't care that it is negative, and it returns a valid value,     which is casted to a signed integer by the Java engine. If the result is negative, a     `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`.
    On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size     might be too small to use for the compression, causing a fatal Access Violation error. The same issue     exists also when using the `compress` functions that receive double, float, int, long and short, each     using a different multiplier that may cause the same issue. The issue most likely won't occur when using a     byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in     the first place. Version 1.1.10.1 contains a patch for this issue. (CVE-2023-34454)

  - snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an     unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk     in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by     attempting to read 4 bytes. If it wasn't possible to read the 4 bytes, the function returns false.
    Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case     that the `compressed` variable is null, a byte array is allocated with the size given by the input data.
    Since the code doesn't test the legality of the `chunkSize` variable, it is possible to pass a negative     number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a     `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive     value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version     1.1.10.1 contains a patch for this issue. (CVE-2023-34455)

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the     allowed constraints and thus lead to out of memory on the system. This issue affects Java applications     using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3     which addresses this issue. (CVE-2023-39410)

  - Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via     `httpclient_impl` connection property; however, the driver does not verify if the class implements the     expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes     and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have     privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor     with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0     onwards, it will be verified that the class implements the expected interface before invoking its     constructor. (CVE-2022-36364)

  - A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access     to the machine to potentially access data in a temporary directory created by the Guava API     com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is     world-readable (readable by an attacker with access to the system). The method in question has been marked     @Deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend     choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java     developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which     explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property     to point to a location whose permissions are appropriately configured. (CVE-2020-8908)

  - Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava     versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the     machine with access to the default Java temporary directory to be able to access the files created by the     class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version     32.0.1 as version 32.0.0 breaks some functionality under Windows. (CVE-2023-2976)

  - Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to     conduct denial of service attacks against servers that depend on this library and deserialize attacker-     provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the     CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without     appropriate checks on what a client has sent and whether the data size is reasonable. (CVE-2018-10237)

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier     are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when     available which is the default case when installing from a wheel. This vulnerability only affects users of     aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you     are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`). Sending a crafted HTTP request     will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.
    This issue has been addressed in version 3.8.5. Users are advised to upgrade. Users unable to upgrade can     reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP     request parser implementation. The pure Python implementation isn't vulnerable. (CVE-2023-37276)

  - aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP     has numerous problems with header parsing, which could lead to request smuggling. This parser is only used     when AIOHTTP_NO_EXTENSIONS is enabled (or not using a prebuilt wheel). These bugs have been addressed in     commit `d5c12ba89` which has been included in release version 3.8.6. Users are advised to upgrade. There     are no known workarounds for these issues. (CVE-2023-47627)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP     request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method     changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
    Although this behavior is not specified in the section for redirects, it can be inferred by piecing     together information from different sections and we have observed the behavior in other major HTTP client     implementations like curl and web browsers. Because the vulnerability requires a previously trusted     service to become compromised in order to have an impact on confidentiality we believe the exploitability     of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request     bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions     must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information     in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts     redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
    This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve     this issue. Users unable to update should disable redirects for services that aren't expecting to respond     with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle     301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

  - When installing a package from a Mercurial VCS URL (ie pip install hg+...) with pip prior to v23.3, the     specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone     call (ie --config). Controlling the Mercurial configuration can modify how and which repository is     installed. This vulnerability does not affect users who aren't installing from Mercurial. (CVE-2023-5752)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
    (CVE-2022-40896)

  - An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers     to cause a denial of service via attacker controlled input to wheel cli. (CVE-2022-40898)

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()     (CVE-2024-3651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0109 advisory.

  - Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags     which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled     through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. (CVE-2023-29404)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - The go command may generate unexpected code at build time when using cgo. This may result in unexpected     behavior when running a go program which uses cgo. This may occur when running an untrusted module which     contains directories with newline characters in their names. Modules which are retrieved using the go     command, i.e. via go get, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off,     may be affected). (CVE-2023-29402)

  - On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid     bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of     standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors     closed, opening any files can result in unexpected content being read or written with elevated privileges.
    Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents     of its registers. (CVE-2023-29403)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6818 advisory.

    Red Hat Satellite is a systems management tool for Linux-based     infrastructure. It allows for provisioning, remote management, and     monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

    * GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)

    * kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)

    * foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)

    * ruby-git: code injection vulnerability (CVE-2022-46648)

    * ruby-git: code injection vulnerability (CVE-2022-47318)

    * Foreman: Arbitrary code execution through templates (CVE-2023-0118)

    * rubygem-activerecord: SQL Injection (CVE-2023-22794)

    * openssl: c_rehash script allows command injection (CVE-2022-1292)

    * openssl: the c_rehash script allows command injection (CVE-2022-2068)

    * Pulp:Tokens stored in plaintext (CVE-2022-3644)

    * satellite: Blind SSRF via Referer header (CVE-2022-4130)

    * python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious     web server (CVE-2022-40899)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * rubygem-activerecord: Denial of Service (CVE-2022-44566)

    * rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44570)

    * rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44571)

    * rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44572)

    * Foreman: Stored cross-site scripting in host tab (CVE-2023-0119)

    * puppet: Puppet Server ReDoS (CVE-2023-1894)

    * rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22792)

    * rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22795)

    * rubygem-activesupport: Regular Expression Denial of Service (CVE-2023-22796)

    * rubygem-globalid: ReDoS vulnerability (CVE-2023-22799)

    * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)

    * rubygem-rack: denial of service in header parsing (CVE-2023-27539)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    * sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of     Service) (CVE-2023-30608)

    * python-django: Potential bypass of validation when uploading multiple files using one form field     (CVE-2023-31047)

    * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

    * python-django: Potential regular expression denial of service vulnerability in     EmailValidator/URLValidator (CVE-2023-36053)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2101 advisory.

    Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant framework that enables you     to manage repositories and content. It also enables cloud providers to deliver content and updates to Red     Hat Enterprise Linux (RHEL) instances.

    Security Fix(es):
    * Django: Potential denial-of-service vulnerability due to large Accept-Language header values     (CVE-2023-23969)

    * Django: Potential denial-of-service vulnerability when uploading multiple files (CVE-2023-24580)

    * Future: Remote attackers can cause denial-of-service using crafted Set-Cookie header from a malicious     web server (CVE-2022-40899)

    This RHUI update fixes the following bugs:

    * Previously, when the `rhui-services-restart` command was run, it restarted only those `pulpcore-worker`     services that were already running and ignored services that were not running. With this update, the     `rhui-services-restart` command restarts all `pulpcore-worker` services irrespective of their status.

    * Previously, the `rhui-manager status` command returned an incorrect exit status when there was a     problem. With this update, the issue has been fixed and the command now returns the correct exit status.
    (BZ#2174633)

    * Previously, `rhui-installer` ignored the `--rhua-mount-options` parameter and only used the read-write     (`rw`) mount option to set up RHUI remote share. With this update, `rhui-installer` uses the `--rhua-     mount-options` parameter. However, `rhui-installer` still uses the read-write (`rw`) option by default.
    (BZ#2174316)

    * Previously, when you ran `rhui-installer`, it rewrote the `/etc/rhui/rhui-tools.conf` file, resetting     all container-related settings. With this update, the command saves the container-related settings from     the `/etc/rhui/rhui-tools.conf` file and restores them after the file is rewritten.

    This RHUI update introduces the following enhancements:

    * The `rhui-installer` command now supports the `--pulp-workers _COUNT_` argument. RHUI administrators can     use this argument to set up a number of Pulp workers. (BZ#2036408)

    * You can now configure CDS nodes to never fetch non-exported content from the RHUA node. To configure the     node, rerun the `rhui-installer` command with the `--fetch-missing-symlinks False` argument, and then     apply this configuration to all CDS nodes. If you configure your CDS nodes this way, ensure that the     content has been exported before RHUI clients start consuming it. (BZ#2084950)

    * Support for containers in RHUI is disabled by default. If you want to use containers, you must manually     enable container support by rerunning `rhui-installer` with the `--container-support-enabled True`     argument, and then applying this configuration to all CDS nodes.

    * Transport Layer Security (TLS) 1.3 and HTTP Strict Transport Security (HSTS)  is now enabled in RHUI.
    This update improves overall RHUI security and also removes unsafe ciphers from the `nginx` configuration     on CDS nodes. (BZ#1887903)

    * You can now remove packages from custom repositories using the text user interface (TUI) as well as the     command line. For more information, see the release notes or the product documentation.(BZ#2165444)

    * You can now set up the Alternate Content Source (ACS) configuration in RHUI to quickly synchronize new     repositories and content by substituting remote content with matching content that is available locally or     geographically closer to your instance of RHUI. For more information, see the release notes or the product     documentation. (BZ#2001087)

    * You can now use a custom prefix, or no prefix at all, when naming your RHUI repositories. You can change     the prefix by rerunning the `rhui-installer` command with the `--client-repo-prefix <prefix>` argument. To     remove the prefix entirely, use two quotation marks () as the `<prefix>` parameter. For more     information, see the release notes or the product documentation.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4466 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security fix(es):

    foreman: Arbitrary code execution through templates. (CVE-2023-0118)     python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious     web server (CVE-2022-40899)

    This update fixes the following bugs:

    2159659 - CVE-2023-0118 foreman: Arbitrary code execution through templates [rhn_satellite_6.13]     2211954 - nalfassi@redhat.com   Unable to enable callback plugin per-template     2218653 - Unable to enable any repository in network sync     2218659 - Can't rerun a failed content-import task if it was exported using chunks     2218660 - Host-Registered Content Hosts Report gives error while generating - undefined method `nvra'     for nil:NilClass     2218661 - Yet another deadlock during Capsule sync, now when existing content changed     2218954 - satellite6-bugs@redhat.com    [Regression] VMware Image-based and full host boot disk based     Provisioning fails with error-: Could not find virtual machine network interface matching <IP>     2218955 - CVE-2022-40899 python-future: remote attackers can cause denial of service via crafted Set-     Cookie header from malicious web server [rhn_satellite_6-default]     2218979 - Custom repo sync failed  Cannot open     /var/lib/pulp/tmp/89726@satellite.example.com/tmpzmdau7qg/tmpy_kkhu3a: Cannot detect compression type     2224023 - undefined method `event' for nil:NilClass in production.log when trying to remediate insights     issues from CRC.
    2218656 - satellite-maintain packages check-update fails when there are no packages to be updated.
    2218657 - Should not be able to assign LE on the client profile which is not synced on the capsule server

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6818 advisory.

  - A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for     Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure     custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE).
    Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle     attacks (MITM). (CVE-2022-0759)

  - The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This     script is distributed by some operating systems in a manner where it is automatically executed. On such     operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of     the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.
    Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n).
    Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). (CVE-2022-1292)

  - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances     where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection     were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other     places in the script where the file names of certificates being hashed were possibly passed to a command     executed through the shell. This script is distributed by some operating systems in a manner where it is     automatically executed. On such operating systems, an attacker could execute arbitrary commands with the     privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the     OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in     OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). (CVE-2022-2068)

  - The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field     and exposes them in read/write mode via the API () instead of marking it as write only. (CVE-2022-3644)

  - A command injection flaw was found in foreman. This flaw allows an authenticated user with admin     privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations     in templates, possibly resulting in arbitrary command execution on the underlying operating system.
    (CVE-2022-3874)

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to     trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request     of specific resources in the server. (CVE-2022-4130)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When     a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it     will treat the target column type as numeric. Comparing integer values against numeric values can result     in a slow sequential scan resulting in potential Denial of Service. (CVE-2022-44566)

  - A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully     crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time,     possibly resulting in a denial of service attack vector. Any applications that deal with Range requests     (such as streaming applications, or applications that serve files) may be impacted. (CVE-2022-44570)

  - There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in     2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-     Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial     ofservice attack vector. This header is used typically used in multipartparsing. Any applications that     parse multipart posts using Rack (virtuallyall Rails applications) are impacted. (CVE-2022-44571)

  - A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2,     2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary     parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack     vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are     impacted. (CVE-2022-44572)

  - ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby     code by having a user to load a repository containing a specially crafted filename to the product. This     vulnerability is different from CVE-2022-47318. (CVE-2022-46648)

  - ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby     code by having a user to load a repository containing a specially crafted filename to the product. This     vulnerability is different from CVE-2022-46648. (CVE-2022-47318)

  - An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode     in templates and execute arbitrary code on the underlying operating system. (CVE-2023-0118)

  - A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has     incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on     the system can steal another user's session, make requests on behalf of the user, and obtain user     credentials. (CVE-2023-0119)

  - A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate     validation. An issue related to specifically crafted certificate names significantly slowed down server     operations. (CVE-2023-1894)

  - A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.
    Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the     regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use     large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected     release should either upgrade or use one of the workarounds immediately. (CVE-2023-22792)

  - A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.
    If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query     method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the     database withinsufficient sanitization and be able to inject SQL outside of the comment. (CVE-2023-22794)

  - A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-     None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine     to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the     process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running     an affected release should either upgrade or use one of the workarounds immediately. (CVE-2023-22795)

  - A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted     string passed to the underscore method can cause the regular expression engine to enter a state of     catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a     possible DoS vulnerability. (CVE-2023-22796)

  - A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully     crafted input can cause the regular expression engine to take an unexpected amount of time. All users     running an affected release should either upgrade or use one of the workarounds immediately.
    (CVE-2023-22799)

  - A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart     MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart     parsing to take longer than expected. (CVE-2023-27530)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a     regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was     introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has     been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known     workarounds for this issue. (CVE-2023-30608)

  - In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation     when using one form field to upload multiple files. This multiple upload has never been supported by     forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's     Uploading multiple files documentation suggested otherwise. (CVE-2023-31047)

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

  - In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are     subject to a potential ReDoS (regular expression denial of service) attack via a very large number of     domain name labels of emails and URLs. (CVE-2023-36053)

  - A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive     server resource consumption. While the total number of requests is bounded by the     http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create     a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound     the number of simultaneously executing handler goroutines to the stream concurrency limit     (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client     has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows     too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2     for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per     HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the     Server.MaxConcurrentStreams setting and the ConfigureServer function. (CVE-2023-39325)

  - GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this     issue exists because of an incomplete fix for CVE-2022-24439. (CVE-2023-40267)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

  - The Ruby on Rails advisory describes this vulnerability as follows: (CVE-2023-27539)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-173 advisory.

    An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0663-1 advisory.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5833-1 advisory.

    Sebastian Chnelik discovered that python-future incorrectly handled certain HTTP header field. An attacker     could possibly use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0076-1 advisory.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0078-1 advisory.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0080-1 advisory.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0079-1 advisory.

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224975	Linux Distros Unpatched Vulnerability : CVE-2022-40899	Nessus	Misc.	high
201209	Splunk Enterprise 9.0.0 < 9.0.9, 9.1.0 < 9.1.4, 9.2.0 < 9.2.1 (SVD-2024-0718)	Nessus	CGI abuses	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	critical
194920	Splunk Enterprise 9.0.0 < 9.0.8, 9.1.0 < 9.1.3 (SVD-2024-0109)	Nessus	CGI abuses	critical
194436	RHEL 8 : Satellite 6.14 (RHSA-2023:6818)	Nessus	Red Hat Local Security Checks	critical
194312	RHEL 8 : RHUI 4.4.0 - Security Fixes, Bug Fixes, and Enhancements Update (Moderate) (RHSA-2023:2101)	Nessus	Red Hat Local Security Checks	high
194309	RHEL 8 : Satellite 6.13.3 Async Security Update (Important) (RHSA-2023:4466)	Nessus	Red Hat Local Security Checks	critical
185473	Rocky Linux 8 : Satellite 6.14 (RLSA-2023:6818)	Nessus	Rocky Linux Local Security Checks	critical
175076	Amazon Linux 2023 : python3-future (ALAS2023-2023-173)	Nessus	Amazon Linux Local Security Checks	high
172424	SUSE SLES12 Security Update : python3 (SUSE-SU-2023:0663-1)	Nessus	SuSE Local Security Checks	high
170898	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : python-future vulnerability (USN-5833-1)	Nessus	Ubuntu Local Security Checks	high
170022	SUSE SLES12 Security Update : python3 (SUSE-SU-2023:0076-1)	Nessus	SuSE Local Security Checks	high
170020	SUSE SLES12 Security Update : python-future (SUSE-SU-2023:0078-1)	Nessus	SuSE Local Security Checks	high
170019	SUSE SLES12 Security Update : python-future (SUSE-SU-2023:0080-1)	Nessus	SuSE Local Security Checks	high
170008	SUSE SLES15 / openSUSE 15 Security Update : python-future (SUSE-SU-2023:0079-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-40899

high

Tenable Plugins

high

critical

critical

critical

critical

high

critical

critical

high

high

high

high

high

high

high