The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3354 advisory.

  - httpd: mod_dav: out-of-bounds read/write of zero byte (CVE-2006-20001)

  - openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

  - openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)

  - apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)

  - curl: HSTS bypass via IDN (CVE-2022-43551)

  - curl: Use-after-free triggered by an HTTP proxy deny response (CVE-2022-43552)

  - openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

  - openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

  - curl: HSTS ignored on multiple requests (CVE-2023-23914)

  - curl: HSTS amnesia with --parallel (CVE-2023-23915)

  - curl: HTTP multi-header compression denial of service (CVE-2023-23916)

  - httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)

  - curl: TELNET option IAC injection (CVE-2023-27533)

  - curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 (RHSA-2023:3354)

critical Nessus Plugin ID 176683

Version 1.1