Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0109 advisory.

  - Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags     which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled     through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. (CVE-2023-29404)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - The go command may generate unexpected code at build time when using cgo. This may result in unexpected     behavior when running a go program which uses cgo. This may occur when running an untrusted module which     contains directories with newline characters in their names. Modules which are retrieved using the go     command, i.e. via go get, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off,     may be affected). (CVE-2023-29402)

  - On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid     bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of     standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors     closed, opening any files can result in unexpected content being read or written with elevated privileges.
    Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents     of its registers. (CVE-2023-29403)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the fence- agents-4.10.0-56.el9 build changelog.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7528 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-0133 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0133 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0133 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7753 advisory.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7753 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7753 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7523 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7435 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7407 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7385 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7378 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6812 advisory.

  - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

  - python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2018.2.22-65.1.31. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1817 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2224 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-297 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b88b72e3e1 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195655	RHEL 6 : python-certifi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195632	RHEL 7 : python-certifi (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194920	Splunk Enterprise 9.0.0 < 9.0.8, 9.1.0 < 9.1.3 (SVD-2024-0109)	Nessus	CGI abuses	critical
191191	CentOS 9 : fence-agents-4.10.0-56.el9	Nessus	CentOS Local Security Checks	critical
189667	RHEL 8 : fence-agents (RHSA-2023:7528)	Nessus	Red Hat Local Security Checks	critical
187980	Oracle Linux 8 : fence-agents (ELSA-2024-0133)	Nessus	Oracle Linux Local Security Checks	critical
187888	RHEL 8 : fence-agents (RHSA-2024:0133)	Nessus	Red Hat Local Security Checks	critical
187872	CentOS 8 : fence-agents (CESA-2024:0133)	Nessus	CentOS Local Security Checks	critical
187089	Oracle Linux 9 : fence-agents (ELSA-2023-7753)	Nessus	Oracle Linux Local Security Checks	critical
187055	AlmaLinux 9 : fence-agents (ALSA-2023:7753)	Nessus	Alma Linux Local Security Checks	critical
186798	RHEL 9 : fence-agents (RHSA-2023:7753)	Nessus	Red Hat Local Security Checks	critical
186371	RHEL 8 : fence-agents (RHSA-2023:7523)	Nessus	Red Hat Local Security Checks	critical
186068	RHEL 8 : fence-agents (RHSA-2023:7435)	Nessus	Red Hat Local Security Checks	critical
186067	RHEL 8 : fence-agents (RHSA-2023:7407)	Nessus	Red Hat Local Security Checks	critical
186061	RHEL 9 : fence-agents (RHSA-2023:7385)	Nessus	Red Hat Local Security Checks	critical
186044	RHEL 9 : fence-agents (RHSA-2023:7378)	Nessus	Red Hat Local Security Checks	critical
185362	RHEL 8 : fence-agents (RHSA-2023:6812)	Nessus	Red Hat Local Security Checks	critical
181219	Amazon Linux AMI : ca-certificates (ALAS-2023-1817)	Nessus	Amazon Linux Local Security Checks	critical
181145	Amazon Linux 2 : ca-certificates (ALAS-2023-2224)	Nessus	Amazon Linux Local Security Checks	critical
180117	Amazon Linux 2023 : ca-certificates (ALAS2023-2023-297)	Nessus	Amazon Linux Local Security Checks	critical
179726	Fedora 38 : mingw-python-certifi (2023-b88b72e3e1)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2023-37920

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical