The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-20a2dbdd45 advisory.

    Security fix for CVE-2022-45197

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e733724edb advisory.

    Update to 2.8.1 (CVE-2022-39282, CVE-2022-39283).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-37c2d26f59 advisory.

    **Changes in version 1.6.0**

    Bug Fixes:

     * Introduce required service_name constructor argument to fix service hostname discovery exploitation     vulnerability **CVE-2022-39369** (Henry Pan)
     * Set user agent [#421] (Fydon)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8ac4104a02 advisory.

    - Latest stable release (various small fixes all over: #2085481, #2086166)
    - #2139355, CVE-2022-3821

    No need to log out or reboot.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ef96a58bbe advisory.

    Upgrade to Ruby 3.1.3.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-acff3f54b2 advisory.

    A potential bug was found on nokogiri on or before 1.13.9 overlooked some return values from functions     used internally. This can lead to raise some illegal exception. This bug was assigned as CVE-2022-23476.
    This new rpm should fix this issue.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-cb7084ae1c advisory.

    Fixes for multiple CVEs

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-7798bf3aa3 advisory.

    Security fix for CVE-2022-37454

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-003403ec6b advisory.

    Update to version 4.15.12

    ----

    Update to version 4.15.11 - Security fixes for CVE-2022-3437

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-40161673a3 advisory.

    The newest upstream commit

    Security fixes for CVE-2022-3256, CVE-2022-3324, CVE-2022-3352, CVE-2022-3235, CVE-2022-3234,     CVE-2022-3296, CVE-2022-3297, CVE-2022-3278.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-65a0a3504a advisory.

    The 6.0.8 stable kernel update contains a number of important fixes across the tree.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c0bfe37ae5 advisory.

    Security fix for CVE-2022-21797

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-d680c70ebe advisory.

    Update to version 4.16.7

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-49db80f821 advisory.

    Update to 2.5.0, fixes CVE-2022-43680.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c43235716e advisory.

    Update to 2.5.0, fixes CVE-2022-43680.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ebb3db782c advisory.

    Fixed use after free in regex handler

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-97de53f202 advisory.

    Security: processing of a specially crafted mp4 file by the     ngx_http_mp4_module might cause a worker process crash, worker     process memory disclosure, or might have potential other impact     (CVE-2022-41741, CVE-2022-41742).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-3f9ee1ad91 advisory.

     CVE-2021-46848 libtasn1: Out-of-bound access in ETYPE_OK

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-5b644a935b advisory.

    Add a null check in parameter_brace_transform() function

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-a758e9293f advisory.

    Some stability fixes.

    ----

    Update to 2.53.14

    Note that besides the ordinary builds for the current Fedora and EPEL branches, there is an additional     distro-independed build available at https://buc.fedorapeople.org/seamonkey . So if you have friends who     use other Linux distro, but that distro does not provide SeaMonkey yet, you can recommend it for them.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-c22feb71ba advisory.

    Update to 2.4.9, fixes CVE-2022-30674.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-01ffde372c advisory.

    - url: use IDN decoded names for HSTS checks (CVE-2022-42916)
    - http_proxy: restore the protocol pointer on error (CVE-2022-42915)
    - netrc: replace fgets with Curl_get_line (CVE-2022-35260)
    - fix POST following PUT confusion (CVE-2022-32221)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ec7de69ceb advisory.

    # New in release OpenJDK 19.0.1 (2022-10-18)

    * [Full release notes](https://builds.shipilev.net/backports-monitor/release-notes-19.0.1.html)
    * This update depends on     [FEDORA-2022-10bb6f119e](https://bodhi.fedoraproject.org/updates/FEDORA-2022-10bb6f119e)

    ## CVEs Fixed
      - CVE-2022-21618
      - CVE-2022-21619
      - CVE-2022-21624
      - CVE-2022-21628
      - CVE-2022-39399

    ## Security Fixes
      - JDK-8282252: Improve BigInteger/Decimal validation
      - JDK-8285662: Better permission resolution
      - JDK-8286077: Wider MultiByte conversions
      - JDK-8286511: Improve macro allocation
      - JDK-8286519: Better memory handling
      - JDK-8286526: Improve NTLM support
      - JDK-8286910: Improve JNDI lookups
      - JDK-8286918: Better HttpServer service
      - JDK-8287446: Enhance icon presentations
      - JDK-8288508: Enhance ECDSA usage
      - JDK-8289366: Improve HTTP/2 client usage
      - JDK-8289853: Update HarfBuzz to 4.4.1
      - JDK-8290334: Update FreeType to 2.12.1

    ## Major Changes

    ### [JDK-8292654](https://bugs.openjdk.org/browse/JDK-8292654): G1 Remembered set memory footprint     regression after [JDK-8286115](https://bugs.openjdk.org/browse/JDK-8286115)     JDK-8286115 changed ergonomic sizing of a component of the remembered sets in G1. This change causes     increased native memory usage of the Hotspot VM for applications that create large remembered sets with     the G1 collector.

    In an internal benchmark total GC component native memory usage rose by almost 10% (from 1.2GB to 1.3GB).

    This issue can be worked around by passing double the value of `G1RemSetArrayOfCardsEntries` as printed by     running the application with `-XX:+PrintFlagsFinal -XX:+UnlockExperimentalVMOptions` to your application.

    E.g. pass `-XX:+UnlockExperimentalVMOptions -XX:G1RemSetArrayOfCardsEntries=128` if a previous run showed     a value of `64` for `G1RemSetArrayOfCardsEntries` in the output of `-XX:+PrintFlagsFinal`.

    ## [JDK-8292579](https://bugs.openjdk.org/browse/JDK-8292579): Update Timezone Data to 2022c

    This version includes changes from 2022b that merged multiple regions that have the same timestamp data     post-1970 into a single time zone database.  All time zone IDs remain the same but the merged time zones     will point to a shared zone database.

    As a result, pre-1970 data may not be compatible with earlier JDK versions.  The affected zones are     ```Antarctica/Vostok, Asia/Brunei, Asia/Kuala_Lumpur, Atlantic/Reykjavik, Europe/Amsterdam,     Europe/Copenhagen, Europe/Luxembourg, Europe/Monaco, Europe/Oslo, Europe/Stockholm, Indian/Christmas,     Indian/Cocos, Indian/Kerguelen, Indian/Mahe,  Indian/Reunion, Pacific/Chuuk, Pacific/Funafuti,     Pacific/Majuro, Pacific/Pohnpei, Pacific/Wake, Pacific/Wallis, Arctic/Longyearbyen, Atlantic/Jan_Mayen,     Iceland, Pacific/Ponape, Pacific/Truk, and Pacific/Yap```.

    For more details, refer to the announcement of [2022b](https://mm.icann.org/pipermail/tz-     announce/2022-August/000071.html)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b050ae8974 advisory.

    # New in release OpenJDK 8u352 (2022-10-18)

    * [Release announcement](https://bit.ly/openjdk8u352)
    * [Full release notes](https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u352.html)

    ## Security Fixes
    * JDK-8282252: Improve BigInteger/Decimal validation
    * JDK-8285662: Better permission resolution
    * JDK-8286511: Improve macro allocation
    * JDK-8286519: Better memory handling
    * JDK-8286526, CVE-2022-21619: Improve NTLM support
    * JDK-8286533, CVE-2022-21626: Key X509 usages
    * JDK-8286910, CVE-2022-21624: Improve JNDI lookups
    * JDK-8286918, CVE-2022-21628: Better HttpServer service
    * JDK-8288508: Enhance ECDSA usage

    ## Major Changes

    ### [JDK-8201793](https://bugs.openjdk.org/browse/JDK-8201793): (ref) Reference object should not support     cloning     `java.lang.ref.Reference::clone` method always throws `CloneNotSupportedException`. `Reference` objects     cannot be     meaningfully cloned. To create a new Reference object, call the constructor to create a `Reference` object     with the same referent and reference queue instead.

    ### [JDK-8175797](https://bugs.openjdk.org/browse/JDK-8175797): (ref) Reference::enqueue method should     clear the reference object before enqueuing     `java.lang.ref.Reference.enqueue` method clears the reference object before it is added to the registered     queue. When the `enqueue` method is called, the reference object is cleared and `get()` method will return     null in OpenJDK 8u352.

    Typically when a reference object is enqueued, it is expected that the reference object is cleared     explicitly via the `clear` method to avoid memory leak because its referent is no longer referenced. In     other words the `get` method is expected not to be called in common cases once the `enqueue`method is     called. In the case when the `get` method from an enqueued reference object and existing code attempts to     access members of the referent, `NullPointerException` may be thrown. Such     code will need to be updated.

    ### [JDK-8071507](https://bugs.openjdk.org/browse/JDK-8071507): (ref) Clear phantom reference as soft and     weak references do     This enhancement changes phantom references to be automatically cleared by the garbage collector as soft     and weak references.

    An object becomes phantom reachable after it has been finalized. This change may cause the phantom     reachable objects to be GC'ed earlier - previously the referent is kept alive until PhantomReference     objects are GC'ed or cleared by the application. This potential behavioral change might only impact     existing code that would depend on PhantomReference being enqueued rather than when the referent be freed     from the heap.

    ### JDK-8286918: Better HttpServer service     The HttpServer can be optionally configured with a maximum connection limit by setting the     `jdk.httpserver.maxConnections` system property. A value of `0` or a negative integer is ignored and     considered to represent no connection limit. In the case of a positive integer value, any newly accepted     connections will be first checked against the current count of established connections and, if the     configured limit has been reached, then the newly accepted connection will be closed immediately.

    ### [JDK-8282859](https://bugs.openjdk.org/browse/JDK-8282859): Enable TLSv1.3 by Default on JDK 8 for     Client Roles     The TLSv1.3 implementation is now enabled by default for client roles     in 8u352. It has been enabled by default for server roles since 8u272.

    Note that TLS 1.3 is not directly compatible with previous     versions. Enabling it on the client may introduce compatibility issues     on either the server or the client side. Here are some more details on     potential compatibility issues that you should be aware of:

    * TLS 1.3 uses a half-close policy, while TLS 1.2 and prior versions       use a duplex-close policy. For applications that depend on the       duplex-close policy, there may be compatibility issues when       upgrading to TLS 1.3.

    * The signature_algorithms_cert extension requires that pre-defined       signature algorithms are used for certificate authentication. In       practice, however, an application may use non-supported signature       algorithms.

    * The DSA signature algorithm is not supported in TLS 1.3. If a server       is configured to only use DSA certificates, it cannot upgrade to TLS       1.3.

    * The supported cipher suites for TLS 1.3 are not the same as TLS 1.2       and prior versions. If an application hard-codes cipher suites which       are no longer supported, it may not be able to use TLS 1.3 without       modifying the application code.

    * The TLS 1.3 session resumption and key update behaviors are       different from TLS 1.2 and prior versions. The compatibility should       be minimal, but it could be a risk if an application depends on the       handshake details of the TLS protocols.

    The TLS 1.3 protocol can be disabled by using the jdk.tls.client.protocols     system property:
    ~~~     java -Djdk.tls.client.protocols=TLSv1.2 ...
    ~~~     Alternatively, an application can explicitly set the enabled protocols     with the javax.net.ssl APIs e.g.
    ~~~     sslSocket.setEnabledProtocols(new String[] {TLSv1.2});
    ~~~     or:
    ~~~     SSLParameters params = sslSocket.getSSLParameters();
    params.setProtocols(new String[] {TLSv1.2});
    sslSocket.setSSLParameters(params);
    ~~~


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-f9ca76e479 advisory.

    This is the October 2022 release of .NET Core 3.1

    This updates .NET Core 3.1 SDK to 3.1.424 and Runtime to 3.1.30.

    This includes fixes for CVE-2022-41032

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-b36cd53dca advisory.

    The 6.0.11 stable kernel update contains a number of important fixes across the tree.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-99c5ddb2ae advisory.

    This is a security update adding fixes for the following issues

    * VSV00009 aka CVE-2022-38150: Denial of service
    * VSV00010 aka CVE-2022-45059: Request smuggling
    * VSV00011 aka CVE-2022-45060: Request forgery

    For details, see https://varnish-cache.org/security

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-11bf2b2597 advisory.

    Resolves CVE-2022-40617

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-91ce497459 advisory.

    - https://www.drupal.org/project/i18n/releases/7.x-1.31
    - https://www.drupal.org/project/i18n/releases/7.x-1.30
    - https://www.drupal.org/project/i18n/releases/7.x-1.29
    - https://www.drupal.org/project/i18n/releases/7.x-1.28
    - https://www.drupal.org/project/i18n/releases/7.x-1.27
        - [SA-CONTRIB-2020-025](https://www.drupal.org/sa-contrib-2020-025)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-6f4e6120d7 advisory.

    Update to 3.9.16

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-3c933ffaca advisory.

    Update to 4.19.0, fixes CVE-2021-46848.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-613e993500 advisory.

    Security fix for CVE-2022-3550, CVE-2022-3551

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-458378be7a advisory.

    Fix a possible double free in woffEncode()

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-dba9ba8e2b advisory.

    Fixes:

    * Delay service starts until after network is online (rhbz#2005501)
    * Restart services on package update (will apply when updating from this release)


    ----

    This release fixes the following Security Vulnerabilities:

    * CVE-2022-42898 PAC parse integer overflows
    * CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour
    * CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array
    * CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
    * CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ
    * CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

    Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring     System (CVSS) v3.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-93c6916349 advisory.

    Update to 3.7.16

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-45d2cfdfa4 advisory.

    Backport patch for CVE-2022-45061.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-64ab9153c0 advisory.

    The 6.0.8 stable kernel update contains a number of important fixes across the tree.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-cba606724f advisory.

    - Updated to 106.0.3

    ----

    - New upstream version (106.0.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8c3ebc1a18 advisory.

    - Updated to latest upstream (107.0.1)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-babfbc2622 advisory.

    This release includes fix for CVE-2022-45059 (VSV00010) and CVE-2022-45060 (VSV00011). From the upstream     release notes:

    VSV00010 Varnish Request Smuggling Vulnerability

    Date: 2022-11-08

    A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers     are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
    Among the headers that can be filtered this way are both Content-Length and Host, making it possible for     an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

    VSV00011 Varnish HTTP/2 Request Forgery Vulnerability

    Date: 2022-11-08

    A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned     on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context     of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend.
    This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-52dec6351a advisory.

    November 2022 Security Updates

    https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/

    ----

    [September Security Updates for Node.js](https://nodejs.org/en/blog/vulnerability/september-2022-security-     releases/)

    ----

    Update to Node.js 16.17.0

    https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V16.md#16.17.0

    ----

    Fix dependency typo

    ----

    Update to 16.15.0

    ----

    Update to Node.js 16.14.1

    Note that we will be skipping 16.14.2 since the only changes were in the bundled copy of OpenSSL, which we     do not use. The relevant security patches are handled in Fedora's `openssl` package.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-523c1c8017 advisory.

    The release you're looking at is Python 3.9.15, a security bugfix release for the legacy 3.9 series.
    https://docs.python.org/release/3.9.15/whatsnew/changelog.html#python-3-9-15-final

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ff582c5b0d advisory.

    Update to 2.28.1

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-775c747e4a advisory.

    LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint     server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added.

    In the affected versions of LibreOffice links using that scheme could be constructed to call internal     macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in     arbitrary script execution without warning.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8268fa6877 advisory.

    Update to the latest upstream release 2.57.6. Includes fixes for CVE 2022-3328

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-fc4c513d06 advisory.

    The newest upstream commit

    Security fix for CVE-2022-4141

    Vim did not recognize key codes passed by Kitty

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-2004702d98 advisory.

    Resolves, in part, #2142161.  Security patches that resolve CVE-2022-3162 and CVE-2022-3294.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-5495b36bed advisory.

    Security fix for CVE-2022-3550, CVE-2022-3551

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-706c76c4f0 advisory.

    Fix a possible double free in `woffEncode()`.

    - Update License to SPDX
    - improved summary and description
    - Add hand-written man pages
    - Install HTML format description as documentation

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-53a4a5dd11 advisory.

    update to xen-4.15.4     adjust xen.canonicalize.patch     remove or adjust patches now included or superceded upstream     x86: Multiple speculative security issues [XSA-422, CVE-2022-23824]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
169085	Fedora 36 : python-slixmpp (2022-20a2dbdd45)	high
169084	Fedora 35 : freerdp (2022-e733724edb)	high
169083	Fedora 36 : php-pear-CAS (2022-37c2d26f59)	high
169082	Fedora 35 : systemd (2022-8ac4104a02)	medium
169081	Fedora 36 : ruby (2022-ef96a58bbe)	high
169080	Fedora 36 : rubygem-nokogiri (2022-acff3f54b2)	high
169079	Fedora 35 : moodle (2022-cb7084ae1c)	critical
169078	Fedora 35 : python3.8 (2022-7798bf3aa3)	critical
169077	Fedora 35 : samba (2022-003403ec6b)	high
169076	Fedora 36 : vim (2022-40161673a3)	high
169075	Fedora 35 : kernel (2022-65a0a3504a)	high
169074	Fedora 36 : python-joblib (2022-c0bfe37ae5)	critical
169073	Fedora 36 : samba (2022-d680c70ebe)	high
169071	Fedora 36 : mingw-expat (2022-49db80f821)	high
169070	Fedora 35 : mingw-expat (2022-c43235716e)	high
169069	Fedora 35 : exim (2022-ebb3db782c)	high
169068	Fedora 35 : nginx (2022-97de53f202)	critical
169067	Fedora 36 : libtasn1 (2022-3f9ee1ad91)	critical
169066	Fedora 35 : bash (2022-5b644a935b)	high
169065	Fedora 36 : seamonkey (2022-a758e9293f)	high
169064	Fedora 35 : mingw-expat (2022-c22feb71ba)	high
169063	Fedora 36 : curl (2022-01ffde372c)	critical
169062	Fedora 35 : java-latest-openjdk (2022-ec7de69ceb)	medium
169061	Fedora 35 : java-1.8.0-openjdk (2022-b050ae8974)	low
169060	Fedora 36 : dotnet3.1 (2022-f9ca76e479)	high
169059	Fedora 35 : kernel (2022-b36cd53dca)	high
169058	Fedora 35 : varnish (2022-99c5ddb2ae)	high
169057	Fedora 36 : strongswan (2022-11bf2b2597)	high
169056	Fedora 36 : drupal7-i18n (2022-91ce497459)	high
169055	Fedora 35 : python3.9 (2022-6f4e6120d7)	high
169054	Fedora 36 : mingw-libtasn1 (2022-3c933ffaca)	critical
169053	Fedora 36 : xorg-x11-server (2022-613e993500)	high
169052	Fedora 35 : sfnt2woff-zopfli (2022-458378be7a)	high
169051	Fedora 36 : heimdal (2022-dba9ba8e2b)	critical
169050	Fedora 36 : python3.7 (2022-93c6916349)	high
169049	Fedora 36 : mingw-python3 (2022-45d2cfdfa4)	high
169048	Fedora 36 : kernel (2022-64ab9153c0)	high
169047	Fedora 35 : firefox (2022-cba606724f)	high
169046	Fedora 36 : firefox (2022-8c3ebc1a18)	high
169045	Fedora 36 : varnish (2022-babfbc2622)	high
169044	Fedora 36 : nodejs (2022-52dec6351a)	critical
169043	Fedora 35 : python3.9 (2022-523c1c8017)	high
169042	Fedora 36 : mbedtls (2022-ff582c5b0d)	high
169041	Fedora 35 : libreoffice (2022-775c747e4a)	medium
169040	Fedora 36 : snapd (2022-8268fa6877)	high
169039	Fedora 36 : vim (2022-fc4c513d06)	high
169038	Fedora 35 : kubernetes (2022-2004702d98)	high
169037	Fedora 35 : xorg-x11-server-Xwayland (2022-5495b36bed)	high
169036	Fedora 36 : woff (2022-706c76c4f0)	high
169035	Fedora 35 : xen (2022-53a4a5dd11)	medium

Detections

Analytics

Fedora Local Security Checks Family for Nessus

high

high

high

medium

high

high

critical

critical

high

high

high

critical

high

high

high

high

critical

critical

high

high

high

critical

medium

low

high

high

high

high

high

high

critical

high

high

critical

high

high

high

high

high

high

critical

high

high

medium

high

high

high

high

high

medium