Detections
Analytics
MiracleLinux 8 : idm:DL1 (AXSA:2024-8410:01)
high Nessus Plugin ID 293162
Synopsis
The remote MiracleLinux host is missing one or more security updates.Description
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8410:01 advisory.* JWCrypto: denail of service Via specifically crafted JWE (CVE-2023-6681)
* python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102) CVE-2023-50387 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.
CVE-2023-6681 A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result in a large amount of computational consumption, causing a denial of service attack.
CVE-2024-28102 JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography.
Prior to version 1.5.6, an attacker can cause a denial of service attack by passing in a malicious JWE Token with a high compression ratio. When the server processes this token, it will consume a lot of memory and processing time.
Version 1.5.6 fixes this vulnerability by limiting the maximum token length.
Modularity name: idm Stream name: DL1
Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 293162
File Name: miracle_linux_AXSA-2024-8410.nasl
Version: 1.1
Type: local
Published: 1/20/2026
Updated: 1/20/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
Vendor
Vendor Severity: Moderate
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2023-50387
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:miracle:linux:ipa-healthcheck, p-cpe:/a:miracle:linux:softhsm, p-cpe:/a:miracle:linux:bind-dyndb-ldap-debugsource, p-cpe:/a:miracle:linux:python3-ipaserver, p-cpe:/a:miracle:linux:python3-yubico, p-cpe:/a:miracle:linux:opendnssec, p-cpe:/a:miracle:linux:python3-custodia, p-cpe:/a:miracle:linux:python3-jwcrypto, p-cpe:/a:miracle:linux:slapi-nis, p-cpe:/a:miracle:linux:ipa-client, p-cpe:/a:miracle:linux:python3-ipalib, p-cpe:/a:miracle:linux:ipa-client-epn, p-cpe:/a:miracle:linux:ipa-python-compat, p-cpe:/a:miracle:linux:ipa-server-common, p-cpe:/a:miracle:linux:softhsm-devel, p-cpe:/a:miracle:linux:opendnssec-debugsource, p-cpe:/a:miracle:linux:python3-qrcode-core, p-cpe:/a:miracle:linux:slapi-nis-debugsource, p-cpe:/a:miracle:linux:ipa-debugsource, p-cpe:/a:miracle:linux:python3-ipatests, p-cpe:/a:miracle:linux:ipa-client-samba, p-cpe:/a:miracle:linux:ipa-server-dns, p-cpe:/a:miracle:linux:python3-qrcode, cpe:/o:miracle:linux:8, p-cpe:/a:miracle:linux:ipa-server-trust-ad, p-cpe:/a:miracle:linux:python3-ipaclient, p-cpe:/a:miracle:linux:custodia, p-cpe:/a:miracle:linux:bind-dyndb-ldap, p-cpe:/a:miracle:linux:ipa-common, p-cpe:/a:miracle:linux:softhsm-debugsource, p-cpe:/a:miracle:linux:python3-kdcproxy, p-cpe:/a:miracle:linux:ipa-healthcheck-core, p-cpe:/a:miracle:linux:ipa-server, p-cpe:/a:miracle:linux:ipa-selinux, p-cpe:/a:miracle:linux:python3-pyusb, p-cpe:/a:miracle:linux:ipa-client-common
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/20/2024
Vulnerability Publication Date: 12/28/2023