The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8840 advisory.

  - openssl: c_rehash script allows command injection (CVE-2022-1292)

  - openssl: the c_rehash script allows command injection (CVE-2022-2068)

  - httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)

  - httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

  - httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

  - curl: CERTINFO never-ending busy-loop (CVE-2022-27781)

  - httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614)

  - httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

  - httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

  - httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)

  - curl: HTTP compression denial of service (CVE-2022-32206)

  - curl: Unpreserved file permissions (CVE-2022-32207)

  - curl: FTP-KRB bad message verification (CVE-2022-32208)

  - curl: POST following PUT confusion (CVE-2022-32221)

  - curl: Incorrect handling of control code characters in cookies (CVE-2022-35252)

  - curl: HTTP proxy double-free (CVE-2022-42915)

  - curl: HSTS bypass via IDN (CVE-2022-42916)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 (RHSA-2022:8840)

critical Nessus Plugin ID 168498

Version 1.9

Version 1.8

Version 1.7

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.3

Version 1.2

Version 1.9 Apr 28, 2024, 2:25 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.8 Jan 26, 2024, 11:18 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262318
Version 1.7 Sep 20, 2023, 4:09 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:F/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:F/RL:O/RC:C") CVSSv3 score source (changed from "CVE-2022-42915" to "CVE-2022-32221") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309201609
Version 1.7 Jan 26, 2024, 9:00 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401262100
Version 1.6 Jan 24, 2023, 1:51 AM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301240151
Version 1.5 Jan 23, 2023, 9:47 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301232147
Version 1.4 Jan 18, 2023, 10:23 PM Regenerated based on advisory update Plugin Feed: 202301182223
Version 1.3 Jan 4, 2023, 9:48 PM CVE (set "CVE" coverage to "CVE-2022-1292,CVE-2022-2068,CVE-2022-22721,CVE-2022-23943,CVE-2022-26377,CVE-2022-28614,CVE-2022-28615,CVE-2022-30522,CVE-2022-31813,CVE-2022-32206,CVE-2022-32207,CVE-2022-32208,CVE-2022-32221,CVE-2022-35252,CVE-2022-42915,CVE-2022-42916") Plugin metadata Plugin Feed: 202301042148
Version 1.3 Jan 18, 2023, 8:44 PM Regenerated based on advisory update Plugin Feed: 202301182044
Version 1.2 Dec 8, 2022, 7:52 PM New Plugin Feed: 202212081952