A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing     when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular     Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is     the result of an incomplete fix for CVE-2024-49761. (CVE-2025-10990)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:17693 advisory.

    Red Hat Satellite is a system management solution that allows organizations to     configure and maintain their systems without the necessity to provide public     Internet access to their servers or other client systems. It performs     provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)

    Users of Red Hat Satellite are advised to upgrade to these updated packages,     which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17613 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)

    * Fail to upgrade to Satellite 6.16 when Satellite has more than 520 users (SAT-38406)

    * Ensure host key cleanup of /usr/share/foreman-proxy/.ssh/known_hosts on the Satellite (or Capsule)     server when first remote execution is using Ansible (SAT-38408)

    * Installer loads plugins from /opt/puppetlabs/puppet/cache/lib/, breaking PostgreSQL config updates and     thus upgrades from 6.15 to 6.16 (max_connections is not updated) (SAT-38410)

    * Second container push set manifest size fields to -1, which breaks bootc (SAT-38411)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:17606 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * puppet-agent: incomplete fix for CVE-2024-49761 (CVE-2025-10990)
    * python-django: Django SQL injection in FilteredRelation column aliases (CVE-2025-57833)
    * cjson: out-of-bounds access in decode_array_index_from_pointer() in cJSON_Utils.c via crafted JSON     pointer strings (CVE-2025-57052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
300826	Linux Distros Unpatched Vulnerability : CVE-2025-10990	Nessus	Misc.	high
269948	RHEL 8 / 9 : Satellite 6 Client Bug Fix Update (Moderate) (RHSA-2025:17693)	Nessus	Red Hat Local Security Checks	high
269754	RHEL 8 / 9 : Satellite 6.16.5.4 Async Update (Important) (RHSA-2025:17613)	Nessus	Red Hat Local Security Checks	critical
269753	RHEL 9 : Satellite 6.17.5 Async Update (Important) (RHSA-2025:17606)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2025-10990

high

Tenable Plugins

high

high

critical

critical