The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1337 advisory.

  - openssl: side-channel weak encryption vulnerability (CVE-2019-1547)

  - openssl: information disclosure in fork() (CVE-2019-1549)

  - openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 (RHSA-2020:1337)

critical Nessus Plugin ID 135235

Version 1.8