According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66     and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read     the contents of the sigpage, which can leak kernel memory contents. An attacker can read a processs     memory at a specific offset to trigger this vulnerability. This was fixed in kernel releases: 4.14.222     4.19.177 5.4.99 5.10.17 5.11 (CVE-2021-21781)

  - fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer     allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an     unprivileged user, aka CID-8cae8cd89f05. (CVE-2021-33909)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling     the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute     allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS     code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.
    (CVE-2021-28957)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nettle package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions     (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being     called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to     force an invalid signature, causing an assertion failure or possible validation. The highest threat to     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-20305)

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Networking). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle     GraalVM Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated     attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise     Edition. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality     impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). (CVE-2021-2341)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Library). Supported versions that are affected are Java SE: 7u301, 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Oracle     GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments,     typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load     and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for     security. This vulnerability does not apply to Java deployments, typically in servers, that load and run     only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.3 (Integrity impacts).
    CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). (CVE-2021-2369)

  - Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component:
    Hotspot). Supported versions that are affected are Java SE: 8u291, 11.0.11, 16.0.1; Oracle GraalVM     Enterprise Edition: 20.3.2 and 21.1.0. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition.
    Successful attacks require human interaction from a person other than the attacker. Successful attacks of     this vulnerability can result in takeover of Java SE, Oracle GraalVM Enterprise Edition. Note: This     vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start     applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the     internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java     deployments, typically in servers, that load and run only trusted code (e.g., code installed by an     administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS     Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). (CVE-2021-2388)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the polkit packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libdnf packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw     allows an attacker to achieve code execution if they can alter the header information of an RPM package     and then trick a user or system into installing it. The highest risk of this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-3445)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsolv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp,     const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334,     which could cause a denial of service (CVE-2021-3200)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-     based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with     a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to     sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because     of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words,     the reference to 2.23 is intentional despite the mention of 'Fixed for glibc 2.33' in the 26649 reference.
    (CVE-2020-29573)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsndfile package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to     execute arbitrary code via a crafted WAV file. (CVE-2021-3246)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the glibc packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and     ICC image metadata. A read of uninitialized memory was found in Exiv2 versions v0.27.3 and earlier. Exiv2     is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of     image files. The read of uninitialized memory is triggered when Exiv2 is used to read the metadata of a     crafted image file. An attacker could potentially exploit the vulnerability to leak a few bytes of stack     memory, if they can trick the victim into running Exiv2 on a crafted image file. The bug is fixed in     version v0.27.4. (CVE-2021-29623)

  - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata     of image files. An inefficient algorithm (quadratic complexity) was found in Exiv2 versions v0.27.3 and     earlier. The inefficient algorithm is triggered when Exiv2 is used to write metadata into a crafted image     file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can     trick the victim into running Exiv2 on a crafted image file. The bug is fixed in version v0.27.4. Note     that this bug is only triggered when _writing_ the metadata, which is a less frequently used Exiv2     operation than _reading_ the metadata. For example, to trigger the bug in the Exiv2 command-line     application, you need to add an extra command-line argument such as `rm`. (CVE-2021-32617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte     overread. This would result in an incorrect text display of the certificate. This bug has been present     since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

  - OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an 'error state' mechanism. The intent was that if     a fatal error occurred during a handshake then OpenSSL would move into the error state and would     immediately fail if you attempted to continue the handshake. This works as designed for the explicit     handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not     work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails     then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is     subsequently called by the application for the same SSL object then it will succeed and the data is passed     without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue     an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued     after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL     1.0.2n. OpenSSL 1.1.0 is not affected. (CVE-2017-3737)

  - During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o). (CVE-2018-0732)

  - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation     process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in     OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

  - Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually     exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service     attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n). (CVE-2018-0739)

  - In situations where an attacker receives automated notification of the success or failure of a decryption     attempt an attacker, after sending a very large number of messages to be decrypted, can recover a     CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the     public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a     certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the     correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the '-crl_download' option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the lz4 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be     able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing     an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some     potential impact to confidentiality and integrity as well. (CVE-2021-3520)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. This bug is similar to CVE-2020-5260(GHSA-qm7j-c969-7j4q). The fix     for that bug still left the door open for an exploit where _some_ credential is leaked (but the attacker     cannot control which one). Git uses external 'credential helper' programs to store and retrieve passwords     or other credentials from secure storage provided by the operating system. Specially-crafted URLs that are     considered illegal as of the recently published Git versions can cause Git to send a 'blank' pattern to     helpers, missing hostname and protocol fields. Many helpers will interpret this as matching _any_ URL, and     will return some unspecified stored password, leaking the password to an attacker's server. The     vulnerability can be triggered by feeding a malicious URL to `git clone`. However, the affected URLs look     rather suspicious; the likely vector would be through systems which automatically clone URLs not visible     to the user, such as Git submodules, or package systems built around Git. The root of the problem is in     Git itself, which should not be feeding blank input to helpers. However, the ability to exploit the     vulnerability in practice depends on which helpers are in use. Credential helpers which are known to     trigger the vulnerability: - Git's 'store' helper - Git's 'cache' helper - the 'osxkeychain' helper that     ships in Git's 'contrib' directory Credential helpers which are known to be safe even with vulnerable     versions of Git: - Git Credential Manager for Windows Any helper not in this list should be assumed to     trigger the vulnerability. (CVE-2020-11008)

  - Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials     to a host controlled by an attacker. Git uses external 'credential helper' programs to store and retrieve     passwords or other credentials from secure storage provided by the operating system. Specially-crafted     URLs that contain an encoded newline can inject unintended values into the credential helper protocol     stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for     an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the     former being sent to the latter. There are no restrictions on the relationship between the two, meaning     that an attacker can craft a URL that will present stored credentials for any host to a host of their     choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the     affected URLs look rather suspicious; the likely vector would be through systems which automatically clone     URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has     been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to     backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks     for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched     versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1.
    (CVE-2020-5260)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the     `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most     exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format     user content instead of the urlize filter, or by implementing request timeouts and limiting process     memory. (CVE-2020-28493)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations. (CVE-2021-31525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer,     with a resultant invalid free or segmentation fault, via malformed gzip data. (CVE-2021-28831)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libjpeg-turbo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libjpeg-turbo all version have a stack-based buffer overflow in the 'transform' component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the graphviz packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted     file into the 'lib/common/shapes.c' component. (CVE-2020-18032)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding     crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this     issue exists because of an incomplete fix for CVE-2020-35654. (CVE-2021-25289)

  - An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in     TiffreadRGBATile via invalid tile boundaries. (CVE-2021-25291)

  - An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS)     attack via a crafted PDF file because of a catastrophic backtracking regex. (CVE-2021-25292)

  - An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    (CVE-2021-25293)

  - Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass     controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    (CVE-2021-34552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the xorg-x11-server package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver     which can lead to a local privilege escalation. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2021-3472)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the graphviz package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted     file into the 'lib/common/shapes.c' component. (CVE-2020-18032)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nettle packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted     file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to     confidentiality, integrity, and availability. (CVE-2021-3516)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl-Convert-ASN1 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an     infinite loop via unexpected input. (CVE-2013-7488)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out of bounds flaw was found in GNU binutils objdump utility version 2.36. An attacker could use this     flaw and pass a large section to avr_elf32_load_records_from_section() probably resulting in a crash or in     some cases memory corruption. The highest threat from this vulnerability is to integrity as well as system     availability. (CVE-2021-3549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass     controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    (CVE-2021-34552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the avahi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the     client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing     a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the     availability of the avahi service, which becomes unresponsive after this flaw is triggered.
    (CVE-2021-3468)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the     vulnerability, an attacker must be able to create multiple containers with a fairly specific mount     configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
    (CVE-2021-30465)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses     the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service     (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML     document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already     provides the ability to disable external entity expansion, the responsibility for resolving this issue     lies with application developers; according to this argument, this entry should be REJECTed, and each     affected application would need its own CVE. (CVE-2013-0340)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a     crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this     vulnerability is to system availability. (CVE-2021-20193)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libX11 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libX11 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libgcrypt package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte     overread. This would result in an incorrect text display of the certificate. This bug has been present     since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

  - OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an 'error state' mechanism. The intent was that if     a fatal error occurred during a handshake then OpenSSL would move into the error state and would     immediately fail if you attempted to continue the handshake. This works as designed for the explicit     handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not     work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails     then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is     subsequently called by the application for the same SSL object then it will succeed and the data is passed     without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue     an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued     after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL     1.0.2n. OpenSSL 1.1.0 is not affected. (CVE-2017-3737)

  - During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o). (CVE-2018-0732)

  - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation     process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in     OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

  - Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually     exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service     attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n). (CVE-2018-0739)

  - In situations where an attacker receives automated notification of the success or failure of a decryption     attempt an attacker, after sending a very large number of messages to be decrypted, can recover a     CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the     public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a     certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the     correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the '-crl_download' option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a     network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP,     CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.
    (CVE-2020-24586)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary     can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP,     CCMP, or GCMP encryption key is periodically renewed. (CVE-2020-24587)

  - The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent     Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated.
    Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an     adversary can abuse this to inject arbitrary network packets. (CVE-2020-24588)

  - A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak     and eventually hanging-up the system. (CVE-2020-25673)

  - The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a     vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85. (CVE-2020-28097)

  - An issue was discovered in the Linux kernel before 5.10. drivers/infiniband/core/ucma.c has a use-after-     free because the ctx is reached via the ctx_list in some ucma_migrate_id situations where ucma_close is     called, aka CID-f5449e74802c. (CVE-2020-36385)

  - An issue was discovered in the Linux kernel before 5.8.1. net/bluetooth/hci_event.c has a slab out-of-     bounds read in hci_extended_inquiry_result_evt, aka CID-51c19bf3d5cf. (CVE-2020-36386)

  - In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to     a heap buffer overflow. This could lead to local escalation of privilege with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-173843328References: Upstream kernel (CVE-2021-0512)

  - In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check. This     could lead to local information disclosure in the kernel with System execution privileges needed. User     interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-110373476     (CVE-2021-0605)

  - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
    This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name     space (CVE-2021-22555)

  - In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because     of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a     side-channel attack, aka CID-9183671af6db. (CVE-2021-33624)

  - net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from     kernel stack memory because parts of a data structure are uninitialized. (CVE-2021-34693)

  - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in     the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the     system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
154001	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2570)	high
154000	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2569)	high
153761	EulerOS 2.0 SP5 : python-lxml (EulerOS-SA-2021-2517)	medium
153760	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2521)	high
153759	EulerOS 2.0 SP9 : nettle (EulerOS-SA-2021-2536)	high
153758	EulerOS 2.0 SP5 : libgcrypt (EulerOS-SA-2021-2503)	high
153755	EulerOS 2.0 SP5 : java-1.8.0-openjdk (EulerOS-SA-2021-2501)	high
153754	EulerOS 2.0 SP9 : polkit (EulerOS-SA-2021-2537)	high
153749	EulerOS 2.0 SP9 : libdnf (EulerOS-SA-2021-2531)	high
153748	EulerOS 2.0 SP9 : libsolv (EulerOS-SA-2021-2557)	low
153747	EulerOS 2.0 SP5 : glibc (EulerOS-SA-2021-2496)	high
153746	EulerOS 2.0 SP5 : libsndfile (EulerOS-SA-2021-2505)	high
153740	EulerOS 2.0 SP9 : glibc (EulerOS-SA-2021-2526)	critical
153739	EulerOS 2.0 SP5 : exiv2 (EulerOS-SA-2021-2495)	low
153738	EulerOS 2.0 SP9 : shim (EulerOS-SA-2021-2542)	medium
153737	EulerOS 2.0 SP9 : lz4 (EulerOS-SA-2021-2535)	critical
153736	EulerOS 2.0 SP9 : git (EulerOS-SA-2021-2549)	high
153735	EulerOS 2.0 SP5 : python-jinja2 (EulerOS-SA-2021-2516)	medium
153734	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-2527)	medium
153733	EulerOS 2.0 SP9 : busybox (EulerOS-SA-2021-2546)	high
153732	EulerOS 2.0 SP5 : libjpeg-turbo (EulerOS-SA-2021-2504)	high
153731	EulerOS 2.0 SP9 : libdnf (EulerOS-SA-2021-2555)	high
153730	EulerOS 2.0 SP5 : graphviz (EulerOS-SA-2021-2498)	high
153729	EulerOS 2.0 SP9 : python-jinja2 (EulerOS-SA-2021-2562)	medium
153728	EulerOS 2.0 SP9 : libsolv (EulerOS-SA-2021-2533)	low
153727	EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-2563)	medium
153726	EulerOS 2.0 SP5 : nginx (EulerOS-SA-2021-2513)	medium
153724	EulerOS 2.0 SP9 : python-pillow (EulerOS-SA-2021-2564)	critical
153723	EulerOS 2.0 SP9 : xorg-x11-server (EulerOS-SA-2021-2568)	high
153722	EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-2539)	medium
153721	EulerOS 2.0 SP9 : graphviz (EulerOS-SA-2021-2528)	high
153720	EulerOS 2.0 SP5 : nettle (EulerOS-SA-2021-2512)	high
153719	EulerOS 2.0 SP5 : libxml2 (EulerOS-SA-2021-2508)	high
153718	EulerOS 2.0 SP5 : perl-Convert-ASN1 (EulerOS-SA-2021-2515)	high
153717	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-2493)	high
153716	EulerOS 2.0 SP5 : python-pillow (EulerOS-SA-2021-2518)	critical
153715	EulerOS 2.0 SP5 : golang (EulerOS-SA-2021-2497)	medium
153714	EulerOS 2.0 SP5 : avahi (EulerOS-SA-2021-2492)	medium
153713	EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2021-2523)	high
153712	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2545)	high
153711	EulerOS 2.0 SP9 : expat (EulerOS-SA-2021-2548)	medium
153710	EulerOS 2.0 SP9 : tar (EulerOS-SA-2021-2543)	medium
153708	EulerOS 2.0 SP5 : libX11 (EulerOS-SA-2021-2507)	critical
153707	EulerOS 2.0 SP9 : libX11 (EulerOS-SA-2021-2558)	critical
153706	EulerOS 2.0 SP9 : libgcrypt (EulerOS-SA-2021-2556)	high
153705	EulerOS 2.0 SP9 : shim (EulerOS-SA-2021-2566)	medium
153704	EulerOS 2.0 SP9 : python-jinja2 (EulerOS-SA-2021-2538)	medium
153703	EulerOS 2.0 SP9 : kernel (EulerOS-SA-2021-2530)	high
153702	EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2021-2547)	high
153701	EulerOS 2.0 SP9 : xorg-x11-server (EulerOS-SA-2021-2544)	high

Huawei Local Security Checks Family for Nessus

high

high

medium

high

high

high

high

high

high

low

high

high

critical

low

medium

critical

high

medium

medium

high

high

high

high

medium

low

medium

medium

critical

high

medium

high

high

high

high

high

critical

medium

medium

high

high

medium

medium

critical

critical

high

medium

medium

high

high

high