The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1687 advisory.

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)
    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)
    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)
    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1690 advisory.

    * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1719 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1688 advisory.

    * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)     (CVE-2023-46809)
    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)
    * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892)
    * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896)
    * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization     (CVE-2024-21891)
    * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890)
    * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1691 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1692 advisory.

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1608 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1644 advisory.

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1646 advisory.

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1601 advisory.

  - An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might     erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the     `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request     which used that callback. This flaw may surprise the application and cause it to misbehave and either send     off the wrong data or use memory after free or similar in the second transfer. The problem exists in the     logic for a reused handle when it is (expected to be) changed from a PUT to a POST. (CVE-2023-28322)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl     that duplicates easy handles.  When duplicating an easy handle, if cookies are enabled, the duplicated     easy handle will not duplicate the cookies themselves, but would instead set the filename to none.'     Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies,     libcurl would attempt to load them from the file named none' on the disk.  This vulnerability is rated     low, as the various conditions required for exploitation are unlikely.  (CVE-2023-38546)

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1576 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)
    * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    Bug Fix(es):

    * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-29048)
    * ruby: Ruby cannot read private key in FIPS mode on AlmaLinux 9 (AlmaLinux-12437)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1610 advisory.

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1462 advisory.

  - A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function     uses named return parameters to free pkey and ctx if there is an error initializing the context or     setting the different properties. All return statements related to error cases follow the return nil,     nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred function that should     free them. (CVE-2024-1394)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1427 advisory.

  - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice     allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the     embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary     gstreamer plugins depending on what plugins are installed on the target system. (CVE-2023-6185)

  - Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to     execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro     or similar built-in command targets that can be executed when activated without warning the user.
    (CVE-2023-6186)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1472 advisory.

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1444 advisory.

    * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks     (CVE-2024-22019)
    * nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1431 advisory.

    * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621)
    * ruby: ReDoS vulnerability in URI (CVE-2023-28755)
    * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617)
    * ruby: ReDoS vulnerability in Time (CVE-2023-28756)

    Bug Fix(es):

    * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (AlmaLinux-28569)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1435 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1436 advisory.

  - pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note     this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value     must be immediately preceded by a minus. There must be a second placeholder for a string value after the     first placeholder; both must be on the same line. By constructing a matching string payload, the attacker     can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL     Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.
    (CVE-2024-1597)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1438 advisory.

  - A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with     chunked encoding, leading to resource exhaustion and denial of service (DoS). The server reads an     unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension     bytes. The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like     timeouts and body size limits. (CVE-2024-22019)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1334 advisory.

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1335 advisory.

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1310 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1309 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1308 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1311 advisory.

  - .NET and Visual Studio Denial of Service Vulnerability (CVE-2024-21392)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1239 advisory.

  - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA     PKCS#1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption     or signing, even without access to the corresponding private key. (CVE-2024-0914)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1134 advisory.

  - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from     10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly     parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to     treat a single request as multiple requests leading to the possibility of request smuggling when behind a     reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83     onwards or 8.5.96 onwards, which fix the issue. (CVE-2023-46589)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1130 advisory.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

  - In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell     metacharacters, and this name is referenced by an expansion token in certain situations. For example, an     untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
    (CVE-2023-51385)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1150 advisory.

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1131 advisory.

  - A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response     body to read many more bytes from the network than are in the body. A malicious HTTP client can further     exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a     handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which     permit including additional metadata in a request or response body sent using the chunked encoding. The     net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large     metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real     body to encoded bytes grows too small. (CVE-2023-39326)

  - Using go get to fetch a module with the .git suffix may unexpectedly fallback to the insecure git://     protocol if the module is unavailable via the secure https:// and git+ssh:// protocols, even if     GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are     fetching modules directly (i.e. GOPROXY=off). (CVE-2023-45285)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:1147 advisory.

  - Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This     allows local attackers to gain access to system secrets otherwise only readable by root. (CVE-2024-23301)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:1142 advisory.

  - HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x     before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers,     violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the     payload as an extra request. (CVE-2023-40225)

  - HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain     sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as     routing index.html#.png to a static server. (CVE-2023-45539)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1149 advisory.

  - A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response     body to read many more bytes from the network than are in the body. A malicious HTTP client can further     exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a     handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which     permit including additional metadata in a request or response body sent using the chunked encoding. The     net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large     metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real     body to encoded bytes grows too small. (CVE-2023-39326)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1139 advisory.

  - A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote     as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an     error in the log without flagging the device as untrusted. (CVE-2023-3674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1129 advisory.

  - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more     origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get     sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in     curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a     cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though     `co.uk` is listed as a PSL domain. (CVE-2023-46218)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1075 advisory.

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:1063 advisory.

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0973 advisory.

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:0963 advisory.

  - When storing and re-accessing data on a networking channel, the length of buffers may have been confused,     resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8,     and Thunderbird < 115.8. (CVE-2024-1546)

  - Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed     on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1547)

  - A website could have obscured the fullscreen notification by using a dropdown select input element. This     could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1548)

  - If a website set a large custom cursor, portions of the cursor could have overlapped with the permission     dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability     affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1549)

  - A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to     cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and     inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1550)

  - Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker     could control the Content-Type response header, as well as control part of the response body, they could     inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects     Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1551)

  - Incorrect code generation could have led to unexpected numeric conversions and potential undefined     behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1552)

  - Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and     Thunderbird < 115.8. (CVE-2024-1553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0951 advisory.

  - Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to     execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the     owner of the materialized view, enabling safe refresh of untrusted materialized views. The victim is a     superuser or member of one of the attacker's roles. The attack requires luring the victim into running     REFRESH MATERIALIZED VIEW CONCURRENTLY on the attacker's materialized view. As part of exploiting this     vulnerability, the attacker creates functions that use CREATE RULE to convert the internally-built     temporary table to a view. Versions before PostgreSQL 15.6, 14.11, 13.14, and 12.18 are affected. The only     known exploit does not work in PostgreSQL 16 and later. For defense in depth, PostgreSQL 16.2 adds the     protections that older branches are using to fix their vulnerability. (CVE-2024-0985)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2024:0964 advisory.

  - When storing and re-accessing data on a networking channel, the length of buffers may have been confused,     resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8,     and Thunderbird < 115.8. (CVE-2024-1546)

  - Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed     on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1547)

  - A website could have obscured the fullscreen notification by using a dropdown select input element. This     could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1548)

  - If a website set a large custom cursor, portions of the cursor could have overlapped with the permission     dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability     affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1549)

  - A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to     cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and     inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1550)

  - Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker     could control the Content-Type response header, as well as control part of the response body, they could     inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects     Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1551)

  - Incorrect code generation could have led to unexpected numeric conversions and potential undefined     behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1552)

  - Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and     Thunderbird < 115.8. (CVE-2024-1553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0950 advisory.

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0952 advisory.

  - When storing and re-accessing data on a networking channel, the length of buffers may have been confused,     resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8,     and Thunderbird < 115.8. (CVE-2024-1546)

  - Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed     on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1547)

  - A website could have obscured the fullscreen notification by using a dropdown select input element. This     could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1548)

  - If a website set a large custom cursor, portions of the cursor could have overlapped with the permission     dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability     affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1549)

  - A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to     cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and     inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1550)

  - Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker     could control the Content-Type response header, as well as control part of the response body, they could     inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects     Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1551)

  - Incorrect code generation could have led to unexpected numeric conversions and potential undefined     behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123,     Firefox ESR < 115.8, and Thunderbird < 115.8. (CVE-2024-1552)

  - Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs     showed evidence of memory corruption and we presume that with enough effort some of these could have been     exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and     Thunderbird < 115.8. (CVE-2024-1553)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0977 advisory.

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:0966 advisory.

  - A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-     channel resistant. This issue may result in the potential leak of private data. (CVE-2023-5992)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:0956 advisory.

    * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2024:0967 advisory.

  - A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-     channel resistant. This issue may result in the potential leak of private data. (CVE-2023-5992)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
193169	AlmaLinux 8 : nodejs:20 (ALSA-2024:1687)	critical
193167	AlmaLinux 8 : varnish (ALSA-2024:1690)	high
193166	AlmaLinux 8 : rear (ALSA-2024:1719)	medium
193158	AlmaLinux 9 : nodejs:20 (ALSA-2024:1688)	critical
193157	AlmaLinux 9 : varnish (ALSA-2024:1691)	high
193156	AlmaLinux 9 : less (ALSA-2024:1692)	high
192914	AlmaLinux 8 : opencryptoki (ALSA-2024:1608)	medium
192913	AlmaLinux 8 : grafana-pcp (ALSA-2024:1644)	high
192912	AlmaLinux 8 : grafana (ALSA-2024:1646)	high
192896	AlmaLinux 8 : curl (ALSA-2024:1601)	medium
192895	AlmaLinux 8 : expat (ALSA-2024:1615)	high
192894	AlmaLinux 9 : ruby:3.1 (ALSA-2024:1576)	high
192893	AlmaLinux 8 : less (ALSA-2024:1610)	high
192477	AlmaLinux 9 : golang (ALSA-2024:1462)	high
192476	AlmaLinux 9 : libreoffice (ALSA-2024:1427)	high
192467	AlmaLinux 8 : go-toolset:rhel8 (ALSA-2024:1472)	high
192402	AlmaLinux 8 : nodejs:16 (ALSA-2024:1444)	critical
192401	AlmaLinux 8 : ruby:3.1 (ALSA-2024:1431)	high
192400	AlmaLinux 8 : postgresql-jdbc (ALSA-2024:1435)	critical
192394	AlmaLinux 9 : postgresql-jdbc (ALSA-2024:1436)	critical
192393	AlmaLinux 9 : nodejs (ALSA-2024:1438)	high
192192	AlmaLinux 9 : dnsmasq (ALSA-2024:1334)	high
192191	AlmaLinux 8 : dnsmasq (ALSA-2024:1335)	high
192122	AlmaLinux 9 : .NET 8.0 (ALSA-2024:1310)	high
192121	AlmaLinux 9 : .NET 7.0 (ALSA-2024:1309)	high
192112	AlmaLinux 8 : .NET 7.0 (ALSA-2024:1308)	high
192111	AlmaLinux 8 : .NET 8.0 (ALSA-2024:1311)	high
191788	AlmaLinux 9 : opencryptoki (ALSA-2024:1239)	medium
191718	AlmaLinux 9 : mysql (ALSA-2024:1141)	high
191694	AlmaLinux 9 : tomcat (ALSA-2024:1134)	high
191693	AlmaLinux 9 : openssh (ALSA-2024:1130)	medium
191692	AlmaLinux 9 : buildah (ALSA-2024:1150)	medium
191691	AlmaLinux 9 : golang (ALSA-2024:1131)	high
191690	AlmaLinux 9 : rear (ALSA-2024:1147)	medium
191687	AlmaLinux 9 : haproxy (ALSA-2024:1142)	high
191686	AlmaLinux 9 : skopeo (ALSA-2024:1149)	medium
191685	AlmaLinux 9 : keylime (ALSA-2024:1139)	low
191684	AlmaLinux 9 : curl (ALSA-2024:1129)	medium
191636	AlmaLinux 9 : edk2 (ALSA-2024:1075)	high
191632	AlmaLinux 8 : edk2 (ALSA-2024:1063)	high
191120	AlmaLinux 8 : postgresql:15 (ALSA-2024:0973)	high
191119	AlmaLinux 9 : thunderbird (ALSA-2024:0963)	high
191118	AlmaLinux 9 : postgresql (ALSA-2024:0951)	high
191117	AlmaLinux 8 : thunderbird (ALSA-2024:0964)	high
191116	AlmaLinux 9 : postgresql:15 (ALSA-2024:0950)	high
191115	AlmaLinux 9 : firefox (ALSA-2024:0952)	high
191114	AlmaLinux 9 : unbound (ALSA-2024:0977)	high
191113	AlmaLinux 9 : opensc (ALSA-2024:0966)	medium
191112	AlmaLinux 8 : postgresql:10 (ALSA-2024:0956)	high
191111	AlmaLinux 8 : opensc (ALSA-2024:0967)	medium

Detections

Analytics

Alma Linux Local Security Checks Family for Nessus

critical

high

medium

critical

high

high

medium

high

high

medium

high

high

high

high

high

high

critical

high

critical

critical

high

high

high

high

high

high

high

medium

high

high

medium

medium

high

medium

high

medium

low

medium

high

high

high

high

high

high

high

high

high

medium

high

medium