The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3354 advisory.

  - httpd: mod_dav: out-of-bounds read/write of zero byte (CVE-2006-20001)

  - openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

  - openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)

  - apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

  - curl: HSTS bypass via IDN (CVE-2022-43551)

  - curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)

  - openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

  - openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

  - curl: HSTS ignored on multiple requests (CVE-2023-23914)

  - curl: HSTS amnesia with --parallel (CVE-2023-23915)

  - curl: HTTP multi-header compression denial of service (CVE-2023-23916)

  - httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)

  - curl: TELNET option IAC injection (CVE-2023-27533)

  - curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 (RHSA-2023:3354)

critical Nessus Plugin ID 176683

Version 1.1

Version 1.0

Version 1.1 Apr 28, 2024, 2:25 PM CVE (set "CVE" coverage to "CVE-2006-20001,CVE-2022-4304,CVE-2022-4450,CVE-2022-25147,CVE-2022-43551,CVE-2022-43552,CVE-2023-0215,CVE-2023-0286,CVE-2023-23914,CVE-2023-23915,CVE-2023-23916,CVE-2023-25690,CVE-2023-27533,CVE-2023-27534") CVSSv2 score source (changed from "CVE-2023-25690" to "CVE-2023-27533") CVSSv3 score source (set to "CVE-2023-25690") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202404281425
Version 1.0 Jun 6, 2023, 2:04 AM New Plugin Feed: 202306060204