The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6840 advisory.

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

  - golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

  - golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

  - golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

  - golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHCOS 4 : OpenShift Container Platform 4.14.2 (RHSA-2023:6840)

medium Nessus Plugin ID 189455

Version 1.2

Version 1.1

Version 1.0

Version 1.2 May 5, 2026, 5:46 AM CVSS metrics ("Cvssv4 score" set to 6.9) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:A") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N") CVSSv4 severity (based on CVE-2023-44487, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202605050546
Version 1.1 Feb 9, 2024, 11:26 PM CEA reference Plugin Feed: 202402092326
Version 1.0 Jan 24, 2024, 7:17 PM New Plugin Feed: 202401241917