The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6811 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6793 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: rh-python38-python (3.8.18), rh-     python38-python-cryptography (2.8), rh-python38-python-pip (19.3.1), rh-python38-python-requests (2.22.0),     rh-python38-python-setuptools (41.6.0), rh-python38-python-wheel (0.33.6).

    Security Fix(es):

    * python: urllib.parse url blocklisting bypass (CVE-2023-24329)

    * python: TLS handshake bypass (CVE-2023-40217)

    * python: tarfile module directory traversal (CVE-2007-4559)

    * pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)

    * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli     (CVE-2022-40898)

    * python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

    * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6804 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6812 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Bug Fix(es) and Enhancement(s):

    * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6805 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6810 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6808 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6801 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6813 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head (CVE-2023-1095)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * netfilter: RHEL 8.8 phase 2 backports from upstream (BZ#2236820)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6803 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6578 advisory.

    The libqb packages provide a library with the primary purpose of providing high performance client/server     reusable features, such as high performance logging, tracing, inter-process communication, and polling.

    Security Fix(es):

    * libqb: Buffer overflow in log_blackbox.c (CVE-2023-39976)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6738 advisory.

    The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025)

    * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 21.0.0     release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release,     21.0.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With     both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true.

    * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 20.0.0     release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some     JAR files. This release, 20.0.1, increases it to 16 MB. (RHEL-14954)

    * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many     threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel     transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages     into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a     guard page and prevent the creation of huge pages. (RHEL-14962)

    * Installing the same java-21-openjdk-headless package on two different systems resulted in distinct     classes.jsa files getting generated. This was because the CDS archive was being generated by a post script     action of the java-21-openjdk-headless package. This prevented the use of the dynamic dump feature,     because the checksum in the archive would be different on each system. This release resolves this issue by     using the .jsa files generated during the initial build. (RHEL-14946)

    * The /usr/bin/jfr alternative is now owned by the java-21-openjdk package. (RHEL-14959)

    * The jcmd tool is now provided by the java-21-openjdk-headless package, rather than java-21-openjdk-     devel, to make it more accessible. (RHEL-14948)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6712 advisory.

    Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427.

    Security Fix(es):

    * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli     (CVE-2022-40898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6496 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: data leak via fcgi requests (CVE-2023-0836)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6508 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Empty entry in Java class path (CVE-2022-38745)

    * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)

    * libreoffice: Arbitrary file write (CVE-2023-1183)

    * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6569 advisory.

    The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk,     network, and other I/O activity.

    Security Fix(es):

    * sysstat: check_overflow() function can work incorrectly, which could lead to an overflow     (CVE-2023-33204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6403 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    The following packages have been upgraded to a later upstream version: httpd (2.4.57). (BZ#2184403)

    Security Fix(es):

    * httpd: mod_proxy_uwsgi HTTP response splitting (CVE-2023-27522)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6409 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785)

    Security Fix(es):

    * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6705 advisory.

    The procps-ng packages contain a set of system utilities that provide system information, including ps,     free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx.

    Security Fix(es):

    * procps: ps buffer overflow (CVE-2023-4016)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6371 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6587 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * opensc: buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package (CVE-2023-2977)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6593 advisory.

    The binutils packages provide a collection of binary utilities for the manipulation of object code in     various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf,     size, strings, strip, and addr2line utilities.

    Security Fix(es):

    * binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault     (CVE-2022-4285)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6744 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961)

    * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091)

    * samba: rpcecho development server allows denial of service via sleep() call on AD DC (CVE-2023-42669)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6535 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: arbitrary code execution (CVE-2023-32393)

    * webkitgtk: disclose sensitive information (CVE-2023-38133)

    * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-38592)

    * webkitgtk: arbitrary code execution (CVE-2023-38594)

    * webkitgtk: arbitrary code execution (CVE-2023-38595)

    * webkitgtk: track sensitive user information (CVE-2023-38599)

    * webkitgtk: arbitrary code execution (CVE-2023-38600)

    * webkitgtk: arbitrary code execution (CVE-2023-38611)

    * webkitgtk: bypass Same Origin Policy (CVE-2023-38572)

    * webkitgtk: arbitrary code execution (CVE-2023-38597)

    * webkitgtk: Memory corruption issue when processing web content (CVE-2022-32885)

    * webkitgtk: Same Origin Policy bypass via crafted web content (CVE-2023-27932)

    * webkitgtk: Website may be able to track sensitive user information (CVE-2023-27954)

    * webkitgtk: use after free vulnerability (CVE-2023-28198)

    * webkitgtk: content security policy blacklist failure (CVE-2023-32370)

    * webkitgtk: arbitrary javascript code execution (CVE-2023-40397)

    * webkitgtk: attacker with JavaScript execution may be able to execute arbitrary code (CVE-2023-40451)

    * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2023-42833)

    * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing. (CVE-2022-32919)

    * webkitgtk: A website may able to track visited websites in private browsing (CVE-2022-32933)

    * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2022-46705)

    * webkitgtk: Visiting a malicious website may lead to address bar spoofing. (CVE-2022-46725)

    Bug Fix(es) and Enhancement(s):

    * Upgrade WebKitGTK for RHEL 9.3 (BZ#2176270)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6659 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: python3.9 (3.9.18). (BZ#2210783)

    Security Fix(es):

    * python: tarfile module directory traversal (CVE-2007-4559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6685 advisory.

    The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API     library. This library enables programs to interact with TPM 2.0 devices

    Security Fix(es):

    * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6745 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: a heap-based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)

    * curl: cookie injection with none file (CVE-2023-38546)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6667 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415)

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6596 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: heap buffer overflow may lead to DoS (CVE-2023-32324)

    * cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6661 advisory.

    The gmp packages contain GNU MP, a library for arbitrary precision arithmetics, signed integers     operations, rational numbers, and floating point numbers.

    Security Fix(es):

    * gmp: Integer overflow and resultant buffer overflow via crafted input (CVE-2021-43618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6369 advisory.

    Qt is a software toolkit for developing applications.

    Security Fix(es):

    * qt: buffer over-read via a crafted reply from a DNS server (CVE-2023-33285)

    * qt: allows remote attacker to bypass security restrictions caused by flaw in certificate validation     (CVE-2023-34410)

    * qtbase: buffer overflow in QXmlStreamReader (CVE-2023-37369)

    * qtbase: infinite loops in QXmlStreamReader (CVE-2023-38197)

    * qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6631 advisory.

    GLib provides the core application building blocks for libraries and applications written in C. It     provides the core object system used in GNOME, the main loop implementation, and a large set of utility     functions for strings and common data structures.

    Security Fix(es):

    * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499)

    * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611)

    * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6694 advisory.

    pip is a package management system used to install and manage software packages written in Python. Many     packages can be found in the Python Package Index (PyPI). pip is a recursive acronym that can stand for     either Pip Installs Packages or Pip Installs Python.

    Security Fix(es):

    * python: tarfile module directory traversal (CVE-2007-4559)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6363 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6699 advisory.

    Kerberos is a network authentication system, which can improve the security of your network by eliminating     the insecure practice of sending passwords over the network in unencrypted form. It allows clients and     servers to authenticate to each other with the help of a trusted third party, the Kerberos key     distribution center (KDC).

    Security Fix(es):

    * krb5: Denial of service through freeing uninitialized pointer (CVE-2023-36054)

    * krb5: double-free in KDC TGS processing (CVE-2023-39975)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6469 advisory.

    The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running     on a computer network.

    Security Fix(es):

    * wireshark: RTPS dissector crash (CVE-2023-0666)

    * wireshark: IEEE C37.118 Synchrophasor dissector crash (CVE-2023-0668)

    * wireshark: Candump log file parser crash (CVE-2023-2855)

    * wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856)

    * wireshark: NetScaler file parser crash (CVE-2023-2858)

    * wireshark: XRA dissector infinite loop (CVE-2023-2952)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6575 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731)

    * libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316)

    * libtiff: memory leak in tiffcrop.c (CVE-2023-3576)

    * libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c     (CVE-2023-26965)

    * libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6473 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * containerd: Supplementary groups are not set up properly (CVE-2023-25173)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6615 advisory.

    The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library,     which provides cryptographic primitives and recipes to Python developers.

    Security Fix(es):

    * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6368 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    The following packages have been upgraded to a later upstream version: qemu-kvm (8.0.0). (BZ#2180898)

    Security Fix(es):

    * QEMU: hcd-ehci: DMA reentrancy issue (incomplete fix for CVE-2021-3750) (CVE-2023-2680)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6431 advisory.

    The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The     library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert     JSON-formatted strings back to the C representation of JSON objects.

    Security Fix(es):

    * json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6570 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

    * tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)

    * tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6420 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: persistent xss in grafana core plugins (CVE-2022-23552)

    * grafana: plugin signature bypass (CVE-2022-31123)

    * grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination     plugins (CVE-2022-31130)

    * grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination     plugins (CVE-2022-39201)

    * grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)

    * grafana: User enumeration via forget password (CVE-2022-39307)

    * grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6492 advisory.

    Tang is a server for binding data to network presence. It includes a daemon which provides cryptographic     operations for binding to a remote service. The tang package provides the server side of the Network Bound     Disk Encryption (NBDE) project.

    Security Fix(es):

    * tang: Race condition exists in the key generation and rotation functionality (CVE-2023-1672)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6497 advisory.

    The libX11 packages contain the core X11 protocol client library.

    Security Fix(es):

    * libX11: InitExt.c can overwrite unintended portions of the Display structure if the extension request     leads to a buffer overflow (CVE-2023-3138)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6343 advisory.

    LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and     others).

    Security Fix(es):

    * LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp     (CVE-2021-32142)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6551 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6595 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635)

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-40964)

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw: intel: Improper input validation in some Intel(R) PROSet/Wireless WiFi (CVE-2022-36351)

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    * hw: intel: Improper input validation in some Intel(R) PROSet/Wireless WiFi (CVE-2022-38076)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6340 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
185369	RHEL 8 : insights-client (RHSA-2023:6811)	high
185367	RHEL 7 : rh-python38-python (RHSA-2023:6793)	high
185363	RHEL 8 : squid:4 (RHSA-2023:6804)	medium
185362	RHEL 8 : fence-agents (RHSA-2023:6812)	high
185361	RHEL 7 : squid (RHSA-2023:6805)	high
185360	RHEL 8 : squid:4 (RHSA-2023:6810)	medium
185359	RHEL 8 : tigervnc (RHSA-2023:6808)	high
185358	RHEL 7 : insights-client (RHSA-2023:6795)	high
185357	RHEL 8 : squid:4 (RHSA-2023:6801)	medium
185356	RHEL 8 : kernel (RHSA-2023:6813)	critical
185355	RHEL 8 : squid:4 (RHSA-2023:6803)	medium
185159	RHEL 9 : libqb (RHSA-2023:6578)	critical
185158	RHEL 9 : java-21-openjdk (RHSA-2023:6738)	low
185157	RHEL 9 : python-wheel (RHSA-2023:6712)	high
185156	RHEL 9 : haproxy (RHSA-2023:6496)	high
185155	RHEL 9 : libreoffice (RHSA-2023:6508)	high
185154	RHEL 9 : sysstat (RHSA-2023:6569)	high
185153	RHEL 9 : httpd and mod_http2 (RHSA-2023:6403)	high
185152	RHEL 9 : libvirt (RHSA-2023:6409)	medium
185151	RHEL 9 : procps-ng (RHSA-2023:6705)	low
185150	RHEL 9 : cloud-init (RHSA-2023:6371)	medium
185149	RHEL 9 : opensc (RHSA-2023:6587)	high
185148	RHEL 9 : binutils (RHSA-2023:6593)	medium
185147	RHEL 9 : samba (RHSA-2023:6744)	critical
185146	RHEL 9 : webkit2gtk3 (RHSA-2023:6535)	critical
185145	RHEL 9 : python3.9 (RHSA-2023:6659)	critical
185144	RHEL 9 : tpm2-tss (RHSA-2023:6685)	medium
185143	RHEL 9 : curl (RHSA-2023:6745)	critical
185142	RHEL 9 : samba (RHSA-2023:6667)	medium
185141	RHEL 9 : cups (RHSA-2023:6596)	high
185140	RHEL 9 : gmp (RHSA-2023:6661)	high
185139	RHEL 9 : qt5 (RHSA-2023:6369)	medium
185138	RHEL 9 : glib2 (RHSA-2023:6631)	high
185137	RHEL 9 : python-pip (RHSA-2023:6694)	critical
185136	RHEL 9 : skopeo (RHSA-2023:6363)	critical
185135	RHEL 9 : krb5 (RHSA-2023:6699)	critical
185134	RHEL 9 : wireshark (RHSA-2023:6469)	medium
185133	RHEL 9 : libtiff (RHSA-2023:6575)	medium
185132	RHEL 9 : buildah (RHSA-2023:6473)	critical
185131	RHEL 9 : python-cryptography (RHSA-2023:6615)	critical
185130	RHEL 9 : qemu-kvm (RHSA-2023:6368)	high
185129	RHEL 9 : libfastjson (RHSA-2023:6431)	high
185128	RHEL 9 : tomcat (RHSA-2023:6570)	medium
185127	RHEL 9 : grafana (RHSA-2023:6420)	high
185126	RHEL 9 : tang (RHSA-2023:6492)	medium
185125	RHEL 9 : libX11 (RHSA-2023:6497)	high
185124	RHEL 9 : LibRaw (RHSA-2023:6343)	high
185123	RHEL 9 : yajl (RHSA-2023:6551)	medium
185122	RHEL 9 : linux-firmware (RHSA-2023:6595)	high
185121	RHEL 9 : xorg-x11-server (RHSA-2023:6340)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

medium

high

high

medium

high

high

medium

critical

medium

critical

low

high

high

high

high

high

medium

low

medium

high

medium

critical

critical

critical

medium

critical

medium

high

high

medium

high

critical

critical

critical

medium

medium

critical

critical

high

high

medium

high

medium

high

high

medium

high

high