The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4381 advisory.

  - A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit     WebKitGTK 2.30.1. A specially crafted web page can lead to a use after free. (CVE-2020-13558)

  - Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
    (CVE-2020-24870)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.0.1, watchOS 7.1, iOS 14.2 and iPadOS 14.2, iCloud for Windows 11.5, Safari 14.0.1, tvOS 14.2, iTunes     12.11 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.
    (CVE-2020-27918)

  - A port redirection issue was addressed with additional port validation. This issue is fixed in macOS Big     Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS     14.4 and iPadOS 14.4, Safari 14.0.3. A malicious website may be able to access restricted ports on     arbitrary servers. (CVE-2021-1799)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4     and iPadOS 14.4. Maliciously crafted web content may violate iframe sandboxing policy. (CVE-2021-1801)

  - A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2021-30689)

  - This issue was addressed with improved checks. This issue is fixed in iOS 14.7, Safari 14.1.2, macOS Big     Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to code execution.
    (CVE-2021-30797)

  - autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other     software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent     is a symlink to a directory outside of the intended extraction location. (CVE-2020-36241)

  - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7,     Safari 14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may     lead to arbitrary code execution. (CVE-2021-30795)

  - This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave. Maliciously crafted web content     may violate iframe sandboxing policy. (CVE-2021-1765)

  - A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1788)

  - A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of     Webkit WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further     memory corruption. In order to trigger the vulnerability, a victim must be tricked into visiting a     malicious webpage. (CVE-2021-21775)

  - A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2,     Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote     attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-1870, CVE-2021-1871)

  - A use-after-free vulnerability exists in the way Webkit's GraphicsContext handles certain events in     WebKitGTK 2.30.4. A specially crafted web page can lead to a potential information leak and further memory     corruption. A victim must be tricked into visiting a malicious web page to trigger this vulnerability.
    (CVE-2021-21779)

  - An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. A specially     crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim     needs to visit a malicious web site to trigger the vulnerability. (CVE-2021-21806)

  - autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other     software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent     is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for     CVE-2020-36241. (CVE-2021-28650)

  - Clear History and Website Data did not clear the history. The issue was addressed with improved data     deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update     2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing     history. (CVE-2020-29623)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur     11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4     and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code     execution. (CVE-2021-1789)

  - A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 14.4.1 and     iPadOS 14.4.1, Safari 14.0.3 (v. 14610.4.3.1.7 and 15610.4.3.1.7), watchOS 7.3.2, macOS Big Sur 11.2.3.
    Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-1844)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS     14.7, macOS Big Sur 11.5, Security Update 2021-004 Catalina, Security Update 2021-005 Mojave. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30799)

  - Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in     tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing     maliciously crafted web content may lead to arbitrary code execution. (CVE-2021-30734, CVE-2021-30749)

  - Description: A cross-origin issue with iframe elements was addressed with improved tracking of security     origins. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4,     watchOS 7.5. Processing maliciously crafted web content may lead to universal cross site scripting.
    (CVE-2021-30744)

  - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 14.5.1 and     iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, Safari 14.1.1, macOS Big Sur 11.3.1. Processing maliciously crafted     web content may lead to arbitrary code execution. (CVE-2021-30663)

  - A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS     7.4.1, iOS 14.5.1 and iPadOS 14.5.1, tvOS 14.6, iOS 12.5.3, macOS Big Sur 11.3.1. Processing maliciously     crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may     have been actively exploited.. (CVE-2021-30665)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious application may be able to leak     sensitive user information. (CVE-2021-30682)

  - A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and     iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access     restricted ports on arbitrary servers. (CVE-2021-30720)

  - A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.7, Safari     14.1.2, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7. Processing maliciously crafted web content may lead to     arbitrary code execution. (CVE-2021-30758)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4404 advisory.

  - kexec-tools: incorrect permissions on kdump dmesg file (CVE-2021-20269)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4382 advisory.

  - json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated     by printbuf_memappend. (CVE-2020-12762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4396 advisory.

  - SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application     crash. (CVE-2019-19603)

  - SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. (CVE-2020-13435)

  - Integer overflow in SQLite via WebSQL in Google Chrome prior to 74.0.3729.131 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2019-5827)

  - Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted HTML page. (CVE-2019-13751)

  - Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to     bypass defense-in-depth measures via a crafted HTML page. (CVE-2019-13750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4358 advisory.

  - The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It     may use the notification thread attributes object (passed through its struct sigevent parameter) after it     has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified     other impact. (CVE-2021-33574)

  - The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when     processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in     degraded service or Denial of Service on the local system. This is related to netgroupcache.c.
    (CVE-2021-27645)

  - The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in     parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in     a denial of service or disclosure of information. This occurs because atoi was used but strtoul should     have been used to ensure correct calculations. (CVE-2021-35942)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4464 advisory.

  - A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. This flaw     allows an attacker to achieve code execution if they can alter the header information of an RPM package     and then trick a user or system into installing it. The highest risk of this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2021-3445)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4326 advisory.

  - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute     arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw     allowing a client to send color-name requests with a name longer than the maximum size allowed by the     protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data     exceeding the maximum size is then interpreted by the server as additional X protocol requests and     executed, e.g., to disable X server authorization completely. For example, if the victim encounters     malicious terminal control sequences for color codes, then the attacker may be able to take full control     of the running graphical session. (CVE-2021-31535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4213 advisory.

  - In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files     using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to     a crash or information disclosure. (CVE-2020-7068)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used     with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can     lead to both decreased security and incorrect encryption data. (CVE-2020-7069)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components     of the URL. (CVE-2020-7071)

  - In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to     connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would     cause PHP to access a null pointer and thus cause a crash. (CVE-2021-21702)

  - In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing     incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like
    __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge     cookie which is supposed to be secure. See also CVE-2020-8184 for more information. (CVE-2020-7070)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4288 advisory.

  - Libjpeg-turbo all version have a stack-based buffer overflow in the transform component. A remote     attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of     service of the target service. (CVE-2020-17541)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4222 advisory.

  - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4517 advisory.

  - vim is vulnerable to Heap-based Buffer Overflow (CVE-2021-3778)

  - vim is vulnerable to Use After Free (CVE-2021-3796)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4324 advisory.

  - psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount     mishandling within a while or for loop that converts system data into a Python object. (CVE-2019-18874)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4426 advisory.

  - There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4316 advisory.

  - Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return     value zzip_file_read in the function unzzip_cat_file. (CVE-2020-18442)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4236 advisory.

  - The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.
    (CVE-2020-8037)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4226 advisory.

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.
    (CVE-2021-27358)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4231 advisory.

  - A flaw was found in libwebp in versions before 1.0.1. An unitialized variable is used in function     ReadSymbol. The highest threat from this vulnerability is to data confidentiality and integrity as well as     system availability. (CVE-2018-25014)

  - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function     ShiftBytes. The highest threat from this vulnerability is to data confidentiality and to the service     availability. (CVE-2018-25013)

  - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function     ChunkAssignData. The highest threat from this vulnerability is to data confidentiality and to the service     availability. (CVE-2020-36331)

  - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function     ChunkVerifyAndAssign. The highest threat from this vulnerability is to data confidentiality and to the     service availability. (CVE-2020-36330)

  - A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive     amount of memory. The highest threat from this vulnerability is to the service availability.
    (CVE-2020-36332)

  - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function     WebPMuxCreateInternal. The highest threat from this vulnerability is to data confidentiality and to the     service availability. (CVE-2018-25009, CVE-2018-25012)

  - A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function     ApplyFilter. The highest threat from this vulnerability is to data confidentiality and to the service     availability. (CVE-2018-25010)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4455 advisory.

  - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote     attacker could possibly use this issue to install a different revision on a repository. The highest threat     from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. (CVE-2021-3572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4221 advisory.

  - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4385 advisory.

  - An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with     G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also     creates the target of the symlink as an empty file, which could conceivably have security relevance if the     symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents     of that file correctly remain unchanged.) (CVE-2021-28153)

  - glib2: Possible privilege escalation thourgh pkexec and aliases (CVE-2021-3800)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4399 advisory.

  - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince     another local or adjacent user to start a pydoc server could access the server and use it to disclose     sensitive information belonging to the other user that they would not normally be able to access. The     highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9,     Python versions before 3.9.3 and Python versions before 3.10.0a7. (CVE-2021-3426)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4409 advisory.

  - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent     blinding to address a side-channel attack against mpi_powm, and the window size is not chosen     appropriately. This, for example, affects use of ElGamal in OpenPGP. (CVE-2021-33560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4235 advisory.

  - jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is     an invalid relationship between the number of channels and the number of image components. (CVE-2021-3272)

  - A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead     to program crash and denial of service. (CVE-2021-26927)

  - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an     attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality,     integrity, or application availability. (CVE-2020-27828)

  - A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function     whic may lead to disclosure of information or program crash. (CVE-2021-26926)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4373 advisory.

  - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R     has more than one fixed quantifier, a related issue to CVE-2019-20454. (CVE-2019-20838)

  - libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring.
    (CVE-2020-14155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4321 advisory.

  - A flaw was found in the ptp4l program of the linuxptp package. When ptp4l is operating on a little-endian     architecture as a PTP transparent clock, a remote attacker could send a crafted one-step sync message to     cause an information leak or crash. The highest threat from this vulnerability is to data confidentiality     and system availability. This flaw affects linuxptp versions before 3.1.1 and before 2.0.1.
    (CVE-2021-3571)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4319 advisory.

  - An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based     buffer overflow and cause a denial of service (DOS) via crafted metadata. (CVE-2021-31292)

  - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata     of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds     read is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into     running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC     profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p     C`). The bug is fixed in version v0.27.5. (CVE-2021-37618)

  - Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata     of image files. An out-of-bounds read was found in Exiv2 versions v0.27.4 and earlier. The out-of-bounds     read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could     potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick     the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when writing     the metadata, which is a less frequently used Exiv2 operation than reading the metadata. For example, to     trigger the bug in the Exiv2 command-line application, you need to add an extra command-line argument such     as insert. The bug is fixed in version v0.27.5. (CVE-2021-37619)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4368 advisory.

  - The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected. (CVE-2020-14145)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4413 advisory.

  - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2_import used a fixed AES key     for the inner wrapper, potentially allowing a MITM attacker to unwrap the inner portion and reveal the key     being imported. The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3565)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4256 advisory.

  - Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote     attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted     file into the lib/common/shapes.c component. (CVE-2020-18032)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-4315 advisory.

  - In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run     system commands without any output or errors. With this, exploits can be injected in a number of     scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd     party .cf files from trusted places. (CVE-2020-1946)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4201 advisory.

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by     its CNA. Notes: none. (CVE-2021-20095)

  - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing     serialized Python objects) via directory traversal, leading to code execution. (CVE-2021-42771)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4325 advisory.

  - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (CVE-2021-28091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4339 advisory.

  - In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the     SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is     similar to CVE-2016-20011. (CVE-2021-39365)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4241 advisory.

  - A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can     lead to an abort, resulting in denial of service. (CVE-2020-35521)

  - A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's     TIFF2PDF tool. A specially crafted TIFF file can lead to arbitrary code execution. The highest threat from     this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35524)

  - In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an     abort, resulting in a remote denial of service attack. (CVE-2020-35522)

  - An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an     attacker to inject and execute arbitrary code when a user opens a crafted TIFF file. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-35523)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1846 advisory.

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1762 advisory.

  - A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25637)

  - iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose     unrelated information from process memory to an attacker. (CVE-2020-11947)

  - ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated. (CVE-2020-29443)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29129)

  - slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29130)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
    (CVE-2020-28916)

  - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service. (CVE-2020-25723)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a duplicate of CVE-2020-28916     (CVE-2020-25707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1879 advisory.

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to     remote code execution in certain Python applications that accept floating-point numbers as untrusted     input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used     unsafely. (CVE-2021-3177)

  - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly     imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote     attacker could exploit this flaw to run arbitrary HTML/JS code. (CVE-2020-27783)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-1796 advisory.

  - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including     from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by     default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)

  - A nil pointer dereference in the golang.org/x/crypto/ssh component through     v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH     servers. (CVE-2020-29652)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1775 advisory.

  - A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions     prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that     integrates into the server's response. This flaw may result in an injection, which leads to unexpected     behavior when the HTTP response is constructed. (CVE-2020-1695)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4619 advisory.

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input     data. A malicious gateway might allow client memory to be written out of bounds. This issue has been     resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections     if possible or use a direct connection without a gateway. (CVE-2021-41159)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a malicious server might trigger out of bound writes in a connected client.
    Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0`     width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the     memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not     allocated) region. This issue has been patched in FreeRDP 2.4.1. (CVE-2021-41160)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-9545 advisory.

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9546 advisory.

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions when ext-authz extension is sending request headers to the external     authorization service it must merge multiple value headers according to the HTTP spec. However, only the     last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers     may be able to escalate privileges when using ext-authz extension or back end service that uses multiple     value headers for authorization. A specifically constructed request may be delivered by an untrusted     downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5     contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending     request for authorization. (CVE-2021-32777)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it     receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING     when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving     these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid     state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream     server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions     1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the     CLOSED state. (CVE-2021-32780)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions after Envoy sends a locally generated response it must stop further     processing of request or response data. However when local response is generated due the internal buffer     overflow while request or response is processed by the filter chain the operation may not be stopped     completely and result in accessing a freed memory block. A specifically constructed request delivered by     an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size     of request or response bodies resulting in a Denial of Service when using extensions that modify and     increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1,     1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally     generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions     or proprietary extensions that modify and increase the size of request or response bodies, if feasible.
    (CVE-2021-32781)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the     path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an     explicit case of a final /admin path element, or is using a negative assertion with final path element     of /admin. The client sends request to /app1/admin#foo. In Envoy prior to 1.18.0, or 1.18.0+     configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when     present, or as a suffix of the path when query string is absent, so it evaluates the final path element as     /admin#foo and mismatches with the configured /admin path element. In Envoy 1.18.0+ configured with     path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured     /admin prefix. The resulting URI is sent to the next server-agent with the offending #foo fragment which     violates RFC3986 or with the nonsensical %23foo text appended. A specifically constructed request with     URI containing '#fragment' element delivered by an untrusted client in the presence of path based request     authorization resulting in escalation of Privileges when path based request authorization extensions.
    Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in     incoming requests. (CVE-2021-32779)

  - A security issue was discovered in Kubernetes where a user may be able to create a container with subpath     volume mounts to access files & directories outside of the volume, including on the host filesystem.
    (CVE-2021-25741)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions envoy's procedure for resetting a HTTP/2 stream has O(N^2) complexity,     leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to     Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing     to exploit this vulnerability would require a client opening and closing a large number of H/2 streams.
    Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2     streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and     downstream peers to a low number, i.e. 100. (CVE-2021-32778)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9525 advisory.

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions when ext-authz extension is sending request headers to the external     authorization service it must merge multiple value headers according to the HTTP spec. However, only the     last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers     may be able to escalate privileges when using ext-authz extension or back end service that uses multiple     value headers for authorization. A specifically constructed request may be delivered by an untrusted     downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5     contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending     request for authorization. (CVE-2021-32777)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it     receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING     when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving     these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid     state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream     server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions     1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the     CLOSED state. (CVE-2021-32780)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions after Envoy sends a locally generated response it must stop further     processing of request or response data. However when local response is generated due the internal buffer     overflow while request or response is processed by the filter chain the operation may not be stopped     completely and result in accessing a freed memory block. A specifically constructed request delivered by     an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size     of request or response bodies resulting in a Denial of Service when using extensions that modify and     increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1,     1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally     generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions     or proprietary extensions that modify and increase the size of request or response bodies, if feasible.
    (CVE-2021-32781)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the     path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an     explicit case of a final /admin path element, or is using a negative assertion with final path element     of /admin. The client sends request to /app1/admin#foo. In Envoy prior to 1.18.0, or 1.18.0+     configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when     present, or as a suffix of the path when query string is absent, so it evaluates the final path element as     /admin#foo and mismatches with the configured /admin path element. In Envoy 1.18.0+ configured with     path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured     /admin prefix. The resulting URI is sent to the next server-agent with the offending #foo fragment which     violates RFC3986 or with the nonsensical %23foo text appended. A specifically constructed request with     URI containing '#fragment' element delivered by an untrusted client in the presence of path based request     authorization resulting in escalation of Privileges when path based request authorization extensions.
    Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in     incoming requests. (CVE-2021-32779)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9526 advisory.

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions when ext-authz extension is sending request headers to the external     authorization service it must merge multiple value headers according to the HTTP spec. However, only the     last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers     may be able to escalate privileges when using ext-authz extension or back end service that uses multiple     value headers for authorization. A specifically constructed request may be delivered by an untrusted     downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5     contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending     request for authorization. (CVE-2021-32777)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it     receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING     when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving     these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid     state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream     server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions     1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the     CLOSED state. (CVE-2021-32780)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions after Envoy sends a locally generated response it must stop further     processing of request or response data. However when local response is generated due the internal buffer     overflow while request or response is processed by the filter chain the operation may not be stopped     completely and result in accessing a freed memory block. A specifically constructed request delivered by     an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size     of request or response bodies resulting in a Denial of Service when using extensions that modify and     increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1,     1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally     generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions     or proprietary extensions that modify and increase the size of request or response bodies, if feasible.
    (CVE-2021-32781)

  - Envoy is an open source L7 proxy and communication bus designed for large modern service oriented     architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the     path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an     explicit case of a final /admin path element, or is using a negative assertion with final path element     of /admin. The client sends request to /app1/admin#foo. In Envoy prior to 1.18.0, or 1.18.0+     configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when     present, or as a suffix of the path when query string is absent, so it evaluates the final path element as     /admin#foo and mismatches with the configured /admin path element. In Envoy 1.18.0+ configured with     path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured     /admin prefix. The resulting URI is sent to the next server-agent with the offending #foo fragment which     violates RFC3986 or with the nonsensical %23foo text appended. A specifically constructed request with     URI containing '#fragment' element delivered by an untrusted client in the presence of path based request     authorization resulting in escalation of Privileges when path based request authorization extensions.
    Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in     incoming requests. (CVE-2021-32779)

  - A security issue was discovered in Kubernetes where a user may be able to create a container with subpath     volume mounts to access files & directories outside of the volume, including on the host filesystem.
    (CVE-2021-25741)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4130 advisory.

  - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass     restrictions such as executing scripts or navigating the top-level frame.  (CVE-2021-38503)

  - When interacting with an HTML input element's file picker dialog with <code>webkitdirectory</code> set, a     use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash.
    (CVE-2021-38504)

  - Through a series of navigations, Firefox could have entered fullscreen mode without notification or     warning to the user. This could lead to spoofing attacks on the browser UI including phishing.
    (CVE-2021-38506)

  - The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded     to TLS while retaining the visual properties of an HTTP connection, including being same-origin with     unencrypted connections on port 80.  However, if a second encrypted port on the same IP address (e.g. port     8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the     browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin     with HTTP.  This was resolved by disabling the Opportunistic Encryption feature, which had low usage.
    (CVE-2021-38507)

  - By displaying a form validity message in the correct location at the same time as a permission prompt     (such as for geolocation), the validity message could have obscured the prompt, resulting in the user     potentially being tricked into granting the permission.  (CVE-2021-38508)

  - Due to an unusual sequence of attacker-controlled events, a Javascript <code>alert()</code> dialog with     arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the     attacker's choosing.  (CVE-2021-38509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9344 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9478 advisory.

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9280 advisory.

  - The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple     suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite     loop when processing invalid multi-byte input sequences, leading to a denial of service. (CVE-2016-10228)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance     the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a     different vulnerability from CVE-2016-10228. (CVE-2020-27618)

  - The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid     input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program,     potentially resulting in a denial of service. (CVE-2021-3326)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4123 advisory.

  - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass     restrictions such as executing scripts or navigating the top-level frame.  (CVE-2021-38503)

  - When interacting with an HTML input element's file picker dialog with <code>webkitdirectory</code> set, a     use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash.
    (CVE-2021-38504)

  - Through a series of navigations, Firefox could have entered fullscreen mode without notification or     warning to the user. This could lead to spoofing attacks on the browser UI including phishing.
    (CVE-2021-38506)

  - The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded     to TLS while retaining the visual properties of an HTTP connection, including being same-origin with     unencrypted connections on port 80.  However, if a second encrypted port on the same IP address (e.g. port     8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the     browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin     with HTTP.  This was resolved by disabling the Opportunistic Encryption feature, which had low usage.
    (CVE-2021-38507)

  - By displaying a form validity message in the correct location at the same time as a permission prompt     (such as for geolocation), the validity message could have obscured the prompt, resulting in the user     potentially being tricked into granting the permission.  (CVE-2021-38508)

  - Due to an unusual sequence of attacker-controlled events, a Javascript <code>alert()</code> dialog with     arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the     attacker's choosing.  (CVE-2021-38509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4134 advisory.

  - The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass     restrictions such as executing scripts or navigating the top-level frame.  (CVE-2021-38503)

  - When interacting with an HTML input element's file picker dialog with <code>webkitdirectory</code> set, a     use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash.
    (CVE-2021-38504)

  - Through a series of navigations, Firefox could have entered fullscreen mode without notification or     warning to the user. This could lead to spoofing attacks on the browser UI including phishing.
    (CVE-2021-38506)

  - The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded     to TLS while retaining the visual properties of an HTTP connection, including being same-origin with     unencrypted connections on port 80.  However, if a second encrypted port on the same IP address (e.g. port     8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the     browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin     with HTTP.  This was resolved by disabling the Opportunistic Encryption feature, which had low usage.
    (CVE-2021-38507)

  - By displaying a form validity message in the correct location at the same time as a permission prompt     (such as for geolocation), the validity message could have obscured the prompt, resulting in the user     potentially being tricked into granting the permission.  (CVE-2021-38508)

  - Due to an unusual sequence of attacker-controlled events, a Javascript <code>alert()</code> dialog with     arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the     attacker's choosing.  (CVE-2021-38509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
155421	Oracle Linux 8 : GNOME (ELSA-2021-4381)	high
155420	Oracle Linux 8 : kexec-tools (ELSA-2021-4404)	high
155419	Oracle Linux 8 : json-c (ELSA-2021-4382)	high
155418	Oracle Linux 8 : sqlite (ELSA-2021-4396)	high
155417	Oracle Linux 8 : glibc (ELSA-2021-4358)	critical
155416	Oracle Linux 8 : dnf (ELSA-2021-4464)	high
155415	Oracle Linux 8 : libX11 (ELSA-2021-4326)	critical
155414	Oracle Linux 8 : php:7.4 (ELSA-2021-4213)	medium
155413	Oracle Linux 8 : libjpeg-turbo (ELSA-2021-4288)	high
155412	Oracle Linux 8 : container-tools:3.0 (ELSA-2021-4222)	critical
155411	Oracle Linux 8 : vim (ELSA-2021-4517)	high
155410	Oracle Linux 8 : python-psutil (ELSA-2021-4324)	high
155409	Oracle Linux 8 : ncurses (ELSA-2021-4426)	medium
155408	Oracle Linux 8 : zziplib (ELSA-2021-4316)	low
155407	Oracle Linux 8 : tcpdump (ELSA-2021-4236)	high
155406	Oracle Linux 8 : grafana (ELSA-2021-4226)	high
155405	Oracle Linux 8 : libwebp (ELSA-2021-4231)	critical
155404	Oracle Linux 8 : python-pip (ELSA-2021-4455)	medium
155403	Oracle Linux 8 : container-tools:2.0 (ELSA-2021-4221)	critical
155402	Oracle Linux 8 : glib2 (ELSA-2021-4385)	medium
155401	Oracle Linux 8 : python3 (ELSA-2021-4399)	medium
155400	Oracle Linux 8 : libgcrypt (ELSA-2021-4409)	high
155398	Oracle Linux 8 : jasper (ELSA-2021-4235)	high
155397	Oracle Linux 8 : pcre (ELSA-2021-4373)	medium
155396	Oracle Linux 8 : linuxptp (ELSA-2021-4321)	high
155395	Oracle Linux 8 : compat-exiv2-026 (ELSA-2021-4319)	high
155394	Oracle Linux 8 : openssh (ELSA-2021-4368)	medium
155393	Oracle Linux 8 : tpm2-tools (ELSA-2021-4413)	medium
155392	Oracle Linux 8 : graphviz (ELSA-2021-4256)	high
155391	Oracle Linux 8 : spamassassin (ELSA-2021-4315)	critical
155390	Oracle Linux 8 : babel (ELSA-2021-4201)	high
155389	Oracle Linux 8 : lasso (ELSA-2021-4325)	high
155388	Oracle Linux 8 : grilo (ELSA-2021-4339)	medium
155387	Oracle Linux 8 : libtiff (ELSA-2021-4241)	high
155348	Oracle Linux 8 : idm:DL1 / and / idm:client (ELSA-2021-1846)	medium
155325	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2021-1762)	medium
155324	Oracle Linux 8 : python38:3.8 (ELSA-2021-1879)	critical
155323	Oracle Linux 8 : container-tools:ol8 (ELSA-2021-1796)	medium
155318	Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2021-1775)	high
155298	Oracle Linux 7 : freerdp (ELSA-2021-4619)	high
155245	Oracle Linux 8 : httpd:2.4 (ELSA-2021-9545)	high
155011	Oracle Linux 8 : olcne / istio / istio / kubernetes (ELSA-2021-9546)	high
154971	Oracle Linux 7 : olcne (ELSA-2021-9525)	high
154970	Oracle Linux 7 : olcne (ELSA-2021-9526)	high
154934	Oracle Linux 8 : thunderbird (ELSA-2021-4130)	high
154917	Oracle Linux 8 : glibc (ELSA-2021-9344)	critical
154916	Oracle Linux 7 : openssl (ELSA-2021-9478)	high
154915	Oracle Linux 8 : glibc (ELSA-2021-9280)	critical
154905	Oracle Linux 8 : firefox (ELSA-2021-4123)	high
154902	Oracle Linux 7 : thunderbird (ELSA-2021-4134)	high

Oracle Linux Local Security Checks Family for Nessus

high

high

high

high

critical

high

critical

medium

high

critical

high

high

medium

low

high

high

critical

medium

critical

medium

medium

high

high

medium

high

high

medium

medium

high

critical

high

high

medium

high

medium

medium

critical

medium

high

high

high

high

high

high

high

critical

high

critical

high

high