The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:0055 advisory.

  - Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix     (CVE-2014-3577)

  - jenkins-2-plugins/git: stored XSS vulnerability (CVE-2021-21684)

  - opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

  - golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)

  - golang: net/http: limit growth of header canonicalization cache (CVE-2021-44716)

  - golang: syscall: don't close fd 0 on ForkExec error (CVE-2021-44717)

  - cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe     sysctls to be applied to the host (CVE-2022-0532)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 / 8 : OpenShift Container Platform 4.10.3 (RHSA-2022:0055)

medium Nessus Plugin ID 158870

Version 1.11