The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4526 advisory.

  - glib: integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a     64-bit platform (CVE-2021-27218)

  - glib: integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to     32 bits (CVE-2021-27219)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4451 advisory.

  - gnutls: Use after free in client key_share extension (CVE-2021-20231)

  - gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

  - nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4235 advisory.

  - jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)

  - jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)

  - jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)

  - jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4373 advisory.

  - pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1     (CVE-2019-20838)

  - pcre: Integer overflow when parsing callout numeric arguments (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4151 advisory.

  - python: Unsafe use of eval() on data retrieved via HTTP in the test suite (CVE-2020-27619)

  - python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

  - python-pygments: Infinite loop in SML lexer may lead to DoS (CVE-2021-20270)

  - python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in     query parameters (CVE-2021-23336)

  - python-pygments: ReDoS in multiple lexers (CVE-2021-27291)

  - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

  - python-babel: Relative path traversal allows attacker to load arbitrary locale files and     execute arbitrary code (CVE-2021-42771)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4150 advisory.

  - python-pygments: Infinite loop in SML lexer may lead to DoS (CVE-2021-20270)

  - python-pygments: ReDoS in multiple lexers (CVE-2021-27291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4324 advisory.

  - python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4464 advisory.

  - libdnf: Signature verification bypass via signature placed in the main RPM header (CVE-2021-3445)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4270 advisory.

  - rust: incorrect parsing of extraneous zero characters at the beginning of an IP address string     (CVE-2021-29922)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4455 advisory.

  - python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4537 advisory.

  - httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5     (CVE-2021-20325)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4158 advisory.

  - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4160 advisory.

  - python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

  - python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

  - python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

  - python: Information disclosure via pydoc (CVE-2021-3426)

  - python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

  - python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

  - python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4292 advisory.

  - squid: denial of service in URN processing (CVE-2021-28651)

  - squid: denial of service issue in Cache Manager (CVE-2021-28652)

  - squid: denial of service in HTTP response processing (CVE-2021-28662, CVE-2021-33620)

  - squid: improper input validation in HTTP Range header (CVE-2021-31806)

  - squid: incorrect memory management in HTTP Range header (CVE-2021-31807)

  - squid: integer overflow in HTTP Range header (CVE-2021-31808)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4426 advisory.

  - ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)

  - ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4161 advisory.

  - python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4181 advisory.

  - mutt: Incorrect handling of invalid initial IMAP responses could lead to an authentication attempt over     unencrypted connection (CVE-2020-28896)

  - mutt: Memory leak when parsing rfc822 group addresses (CVE-2021-3181)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4173 advisory.

  - exiv2: Heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata (CVE-2021-29457)

  - exiv2: Out-of-bounds read in Exiv2::Internal::CrwMap::encode (CVE-2021-29458)

  - exiv2: Out-of-bounds read in Exiv2::WebPImage::doWriteMetadata (CVE-2021-29463)

  - exiv2: Heap-based buffer overflow in Exiv2::Jp2Image::encodeJp2Header (CVE-2021-29464)

  - exiv2: Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header (CVE-2021-29470, CVE-2021-37619)

  - exiv2: Out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata (CVE-2021-29473)

  - exiv2: Use of uninitialized memory in isWebPType() may lead to information leak (CVE-2021-29623)

  - exiv2: Integer overflow in CrwMap:encode0x1810 leading to heap-based buffer overflow and DoS     (CVE-2021-31292)

  - exiv2: DoS due to quadratic complexity in ProcessUTF8Portion (CVE-2021-32617)

  - exiv2: Heap-based buffer overflow in Jp2Image::readMetadata() (CVE-2021-3482)

  - exiv2: Out-of-bounds read in Exiv2::Jp2Image::printStructure (CVE-2021-37618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4432 advisory.

  - bluez: Passkey Entry protocol of the Bluetooth Core is vulnerable to an impersonation attack     (CVE-2020-26558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4149 advisory.

  - python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

  - python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

  - python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287, CVE-2021-25288)

  - python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

  - python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

  - python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

  - python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

  - python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

  - python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

  - python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

  - python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

  - python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

  - python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

  - python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:4321 advisory.

  - linuxptp: wrong length of one-step follow-up in transparent clock (CVE-2021-3571)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4288 advisory.

  - libjpeg-turbo: Stack-based buffer overflow in the transform component (CVE-2020-17541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4339 advisory.

  - grilo: missing TLS certificate verification (CVE-2021-39365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4139 advisory.

  - python-pygments: Infinite loop in SML lexer may lead to DoS (CVE-2021-20270)

  - python-pygments: ReDoS in multiple lexers (CVE-2021-27291)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4325 advisory.

  - lasso: XML signature wrapping vulnerability when parsing SAML responses (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4393 advisory.

  - cups: access to uninitialized buffer in ipp.c (CVE-2020-10001)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4130 advisory.

  - Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503)

  - Mozilla: Use-after-free in file picker dialog (CVE-2021-38504)

  - Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning     (CVE-2021-38506)

  - Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services     hosted on other ports (CVE-2021-38507)

  - Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing     (CVE-2021-38508)

  - Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain (CVE-2021-38509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4123 advisory.

  - Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503)

  - Mozilla: Use-after-free in file picker dialog (CVE-2021-38504)

  - Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning     (CVE-2021-38506)

  - Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services     hosted on other ports (CVE-2021-38507)

  - Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing     (CVE-2021-38508)

  - Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain (CVE-2021-38509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4097 advisory.

  - webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30858)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4057 advisory.

  - python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4059 advisory.

  - curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols (CVE-2021-22946)

  - curl: Server responses received before STARTTLS processed after TLS handshake (CVE-2021-22947)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4060 advisory.

  - libsolv: heap-based buffer overflow in pool_installable() in src/repo.h (CVE-2021-33928)

  - libsolv: heap-based buffer overflow in pool_disabled_solvable() in src/repo.h (CVE-2021-33929)

  - libsolv: heap-based buffer overflow in pool_installable_whatprovides() in src/repo.h (CVE-2021-33930)

  - libsolv: heap-based buffer overflow in prune_to_recommended() in src/policy.c (CVE-2021-33938)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4042 advisory.

  - flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4056 advisory.

  - kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free (CVE-2020-36385)

  - kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of     hid-input.c (CVE-2021-0512)

  - kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE) (CVE-2021-3656)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4058 advisory.

  - samba: Negative idmap cache entries can cause incorrect group entries in the Samba file server process     token (CVE-2021-20254)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3891 advisory.

  - OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550)

  - OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-35556)

  - OpenJDK: Excessive memory allocation in RTFReader (Swing, 8265580) (CVE-2021-35559)

  - OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

  - OpenJDK: Certificates with end dates too far in the future can corrupt keystore (Keytool, 8266137)     (CVE-2021-35564)

  - OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565)

  - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689)     (CVE-2021-35567)

  - OpenJDK: Unexpected exception raised during TLS handshake (JSSE, 8267729) (CVE-2021-35578)

  - OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8267735) (CVE-2021-35586)

  - OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618) (CVE-2021-35603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3918 advisory.

  - redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)

  - redis: Integer overflow issue with Streams (CVE-2021-32627)

  - redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)

  - redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)

  - redis: Integer overflow issue with intsets (CVE-2021-32687)

  - redis: Integer overflow issue with strings (CVE-2021-41099)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3893 advisory.

  - OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550)

  - OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-35556)

  - OpenJDK: Excessive memory allocation in RTFReader (Swing, 8265580) (CVE-2021-35559)

  - OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

  - OpenJDK: Certificates with end dates too far in the future can corrupt keystore (Keytool, 8266137)     (CVE-2021-35564)

  - OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565)

  - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689)     (CVE-2021-35567)

  - OpenJDK: Unexpected exception raised during TLS handshake (JSSE, 8267729) (CVE-2021-35578)

  - OpenJDK: Excessive memory allocation in BMPImageReader (ImageIO, 8267735) (CVE-2021-35586)

  - OpenJDK: Incomplete validation of inner class references in ClassFileParser (Hotspot, 8268071)     (CVE-2021-35588)

  - OpenJDK: Non-constant comparison during TLS handshakes (JSSE, 8269618) (CVE-2021-35603)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3945 advisory.

  - redis: Lua scripts can overflow the heap-based Lua stack (CVE-2021-32626)

  - redis: Integer overflow issue with Streams (CVE-2021-32627)

  - redis: Integer overflow bug in the ziplist data structure (CVE-2021-32628)

  - redis: Denial of service via Redis Standard Protocol (RESP) request (CVE-2021-32675)

  - redis: Integer overflow issue with intsets (CVE-2021-32687)

  - redis: Integer overflow issue with strings (CVE-2021-41099)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3819 advisory.

  - dotnet: System.DirectoryServices.Protocols.LdapConnection sends credentials in plaintext if TLS handshake     fails (CVE-2021-41355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3838 advisory.

  - rust-crossbeam-deque: race condition may lead to double free (CVE-2021-32810)

  - Mozilla: Use-after-free in MessageTask (CVE-2021-38496)

  - Mozilla: Validation message could have been overlaid on another origin (CVE-2021-38497)

  - Mozilla: Use-after-free of nsLanguageAtomService object (CVE-2021-38498)

  - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500)

  - Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501)

  - Mozilla: Downgrade attack on SMTP STARTTLS connections (CVE-2021-38502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3771 advisory.

  - grafana: Snapshot authentication bypass (CVE-2021-39226)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:3755 advisory.

  - rust-crossbeam-deque: race condition may lead to double free (CVE-2021-32810)

  - Mozilla: Use-after-free in MessageTask (CVE-2021-38496)

  - Mozilla: Validation message could have been overlaid on another origin (CVE-2021-38497)

  - Mozilla: Use-after-free of nsLanguageAtomService object (CVE-2021-38498)

  - Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500)

  - Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3816 advisory.

  - httpd: mod_session: Heap overflow via a crafted SessionHeader value (CVE-2021-26691)

  - httpd: mod_proxy: SSRF via a crafted request uri-path containing unix: (CVE-2021-40438)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3438 advisory.

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3666 advisory.

  - nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930, CVE-2021-22940)

  - nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  - nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  - nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

  - nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite     (CVE-2021-32803)

  - nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite     (CVE-2021-32804)

  - c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3576 advisory.

  - krb5: Sending a request containing PA-ENCRYPTED-CHALLENGE padata element without using FAST could result     in NULL dereference in KDC which leads to DoS (CVE-2021-36222)

  - krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks     server field (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3582 advisory.

  - curl: Content not matching hash in Metalink is not being discarded (CVE-2021-22922)

  - curl: Metalink download sends credentials (CVE-2021-22923)

  - curl: Bad connection reuse due to flawed path name checks (CVE-2021-22924)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:3623 advisory.

  - nodejs: Use-after-free on close http2 on stream canceling (CVE-2021-22930, CVE-2021-22940)

  - nodejs: Improper handling of untypical characters in domain names (CVE-2021-22931)

  - nodejs: Incomplete validation of tls rejectUnauthorized parameter (CVE-2021-22939)

  - nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343)

  - nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite     (CVE-2021-32803)

  - nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite     (CVE-2021-32804)

  - c-ares: Missing input validation of host names may lead to domain hijacking (CVE-2021-3672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2021:3585 advisory.

  - golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
155053	CentOS 8 : mingw-glib2 (CESA-2021:4526)	high
155052	CentOS 8 : gnutls and nettle (CESA-2021:4451)	critical
155051	CentOS 8 : jasper (CESA-2021:4235)	high
155050	CentOS 8 : pcre (CESA-2021:4373)	high
155049	CentOS 8 : python27:2.7 (CESA-2021:4151)	critical
155047	CentOS 8 : python36:3.6 (CESA-2021:4150)	high
155046	CentOS 8 : python-psutil (CESA-2021:4324)	high
155045	CentOS 8 : dnf (CESA-2021:4464)	high
155044	CentOS 8 : rust-toolset:rhel8 (CESA-2021:4270)	critical
155043	CentOS 8 : python-pip (CESA-2021:4455)	medium
155042	CentOS 8 : httpd:2.4 (CESA-2021:4537)	critical
155041	CentOS 8 : python-lxml (CESA-2021:4158)	medium
155040	CentOS 8 : python39:3.9 and python39-devel:3.9 (CESA-2021:4160)	critical
155039	CentOS 8 : squid:4 (CESA-2021:4292)	high
155038	CentOS 8 : ncurses (CESA-2021:4426)	medium
155037	CentOS 8 : python-jinja2 (CESA-2021:4161)	medium
155036	CentOS 8 : mutt (CESA-2021:4181)	medium
155035	CentOS 8 : exiv2 (CESA-2021:4173)	high
155034	CentOS 8 : bluez (CESA-2021:4432)	medium
155033	CentOS 8 : python-pillow (CESA-2021:4149)	critical
155032	CentOS 8 : linuxptp (CESA-2021:4321)	high
155031	CentOS 8 : libjpeg-turbo (CESA-2021:4288)	high
155030	CentOS 8 : grilo (CESA-2021:4339)	medium
155029	CentOS 8 : resource-agents (CESA-2021:4139)	high
155028	CentOS 8 : lasso (CESA-2021:4325)	high
155027	CentOS 8 : cups (CESA-2021:4393)	medium
154979	CentOS 8 : thunderbird (CESA-2021:4130)	critical
154969	CentOS 8 : firefox (CESA-2021:4123)	critical
154884	CentOS 8 : webkit2gtk3 (CESA-2021:4097)	high
154877	CentOS 8 : python3 (CESA-2021:4057)	medium
154874	CentOS 8 : curl (CESA-2021:4059)	high
154873	CentOS 8 : libsolv (CESA-2021:4060)	high
154872	CentOS 8 : flatpak (CESA-2021:4042)	high
154871	CentOS 8 : kernel (CESA-2021:4056)	high
154870	CentOS 8 : samba (CESA-2021:4058)	medium
154649	CentOS 8 : java-11-openjdk (CESA-2021:3891)	medium
154644	CentOS 8 : redis:5 (CESA-2021:3918)	high
154642	CentOS 8 : java-1.8.0-openjdk (CESA-2021:3893)	medium
154329	CentOS 8 : redis:6 (CESA-2021:3945)	high
154272	CentOS 8 : .NET 5.0 (CESA-2021:3819)	medium
154158	CentOS 8 : thunderbird (CESA-2021:3838)	critical
154157	CentOS 8 : grafana (CESA-2021:3771)	high
154156	CentOS 8 : firefox (CESA-2021:3755)	critical
154050	CentOS 8 : httpd:2.4 (CESA-2021:3816)	critical
153767	CentOS 7 : kernel (RHSA-2021:3438)	high
153763	CentOS 8 : nodejs:14 (CESA-2021:3666)	critical
153590	CentOS 8 : krb5 (CESA-2021:3576)	high
153539	CentOS 8 : curl (CESA-2021:3582)	medium
153532	CentOS 8 : nodejs:12 (CESA-2021:3623)	critical
153521	CentOS 8 : go-toolset:rhel8 (CESA-2021:3585)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

critical

high

high

critical

high

high

high

critical

medium

critical

medium

critical

high

medium

medium

medium

high

medium

critical

high

high

medium

high

high

medium

critical

critical

high

medium

high

high

high

high

medium

medium

high

medium

high

medium

critical

high

critical

critical

high

critical

high

medium

critical

high