The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1486 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic     design. It focuses on automating as much as possible and adhering to the DRY (Don't Repeat Yourself)     principle.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * puma-5.6.4: http request smuggling vulnerabilities (CVE-2022-24790)

    * rubygem-rack: crafted requests can cause shell escape sequences (CVE-2022-30123)

    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

    * rubygem-tzinfo: arbitrary code execution (CVE-2022-31163)

    * rubygem-rack: crafted multipart POST request may cause a DoS (CVE-2022-30122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1479 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1466 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1471 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1470 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL9.0 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127880)

    * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on     the system. (BZ#2143766)

    * RHEL9.0 - boot: Add secure boot trailer (BZ#2151528)

    * kernel-rt-debug: WARNING: possible circular locking dependency detected     (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160614)

    * Support cpuset.sched_load_balance by changing default CPUset directory structure (BZ#2161105)

    * RHEL9.0 -  s390/kexec: fix ipl report address for kdump (BZ#2166903)

    * libgpiod doesn't seem to work with Interphase gpiochip (BZ#2166956)

    * Azure RHEL9 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170227)

    Enhancement(s):

    * IBM 9.2 FEAT: Upgrade the QETH driver to latest from upstream, e.g. kernel 6.0 (BZ#2166304)

    * Intel 9.2 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168382)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1472 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1467 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z8 Batch (BZ#2174392)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1468 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL 9.1 Extending NMI watchdog's timer during LPM (BZ#2140086)

    * RHEL9.1 Rainer 2gb/4GB LMB: kdump is not working with 2GB/4GB LMB size[FW1030]. (BZ#2151867)

    * RHEL9.0 -  s390/kexec: fix ipl report address for kdump (BZ#2166904)

    * Azure RHEL-9 RMB MANA: RMB Patch To Backport On The Azure Linux Images (BZ#2172876)

    Enhancement(s):

    * IBM 9.2 FEAT Upgrade the QETH driver to the latest from upstream, e.g. kernel 6.0 (BZ#2166305)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1469 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.1.z3 Batch (BZ#2170460)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1440 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1435 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service     attack (CVE-2022-4379)

    * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1403 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1436 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1370 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1443 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1442 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1445 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1365 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    Bug Fix(es):

    * In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function     used, or provide an indicator. (BZ#2177435)

    * Need to update FIPS review comments into NSS RHEL-9. (BZ#2177876)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1444 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1364 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1368 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    Bug Fix(es):

    * In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function     used, or provide an indicator. (BZ#2177434)

    * Need to update FIPS review comments into NSS RHEL-9. (BZ#2177875)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1402 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1406 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1437 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1405 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

    * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)

    * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1441 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1404 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1367 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1438 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1366 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1407 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.9.0.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1439 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1369 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1335 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1333 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1332 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1337 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1336 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.9.0 ESR.

    Security Fix(es):

    * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751)

    * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176)

    * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752)

    * Mozilla: Invalid downcast in Worklets (CVE-2023-28162)

    * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation     (CVE-2023-28164)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1252 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1251 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1221 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    The following packages have been upgraded to a later upstream version: kernel (4.18.0). (BZ#2165648)

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL 8.7 - Outputs of lsmem, lparstat, numactl and /proc/meminfo show wrong value of memory when LMB     size is set to 4GB. (BZ#2140092)

    * RHEL8.4 - boot: Add secure boot trailer (BZ#2151532)

    * Concurrent reading of /proc/cpuinfo by multiple tasks causes soft lockup (BZ#2154441)

    * GSS: OCP 4.10.30 node crash after ODF upgrade : unable to handle kernel NULL pointer dereference at     0000000000000000 : ceph_get_snap_realm+0x68/0xa0 [ceph] (BZ#2155799)

    * cgroup: Backport cgroup_mutex performance patches (BZ#2160165)

    * Redhat OpenShift: Error downloading big ZIP files inside pod on power OCP and pod getting restarted     (BZ#2160223)

    * i40e/iavf: VF reset task fails Never saw reset with 5 second timeout per VF (BZ#2160462)

    * panic in fib6_rule_suppress+0x22 with custom xdp prog involved in (BZ#2167606)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1200 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: timing side-channel in the TLS RSA key exchange code (CVE-2023-0361)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * CCM tag length should be limited to known values (BZ#2144536)

    * In FIPS mode, gnutls should reject RSASSA-PSS salt lengths larger than the output size of the hash     function used, or provide an indicator (BZ#2144538)

    * dracut-cmdline[554]: Error in GnuTLS initialization: Error while performing self checks i FIPS mode     (BZ#2149641)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1202 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service     attack (CVE-2022-4379)

    * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL9:[P10] With Guest Secure Boot and lockdown enabled, DLPAR operations can't be done (Rainier)     (BZ#2107480)

    * [RHEL 9.0] LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133084)

    * RHEL9.0 - boot: Add secure boot trailer (BZ#2151529)

    * 'date' command shows wrong time in nested KVM s390x guest (BZ#2158816)

    * Kernel FIPS-140-3 requirements - part 3 - AES-XTS (BZ#2160176)

    * RHEL 9.0.0 soft quota cannot exceed more the 5 warns which breaks timer functionality (BZ#2164263)

    * In FIPS mode, the kernel should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for     hash-based DRBGs, or provide an indicator after 2023-05-16 (BZ#2165131)

    * [RHEL 9] FIPS: deadlock between PID 1 and modprobe crypto-jitterentropy_rng at boot, preventing system     to boot. (BZ#2167762)

    Enhancement(s):

    * [Intel 9.2 FEAT] [SPR] CPU: AMX: Improve the init_fpstate setup code (BZ#2168383)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1211 advisory.

    The lua packages provide support for Lua, a powerful light-weight programming language designed for     extending applications. Lua is also frequently used as a general-purpose, stand-alone language.

    The following packages have been upgraded to a later upstream version: lua (5.4.4).

    Security Fix(es):

    * lua: use after free allows Sandbox Escape (CVE-2021-44964)

    * lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1220 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.4.z15 source tree. (BZ#2162415)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1199 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    * openssl: read buffer overflow in X.509 certificate verification (CVE-2022-4203)

    * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

    * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)

    * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

    * openssl: invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216)

    * openssl: NULL dereference validating DSA public key (CVE-2023-0217)

    * openssl: NULL dereference during PKCS7 data verification (CVE-2023-0401)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * HMAC generation should reject key lengths < 112 bits or provide an indicator in FIPS mode (BZ#2144001)

    * In FIPS mode, openssl should set a minimum length for passwords in PBKDF2 (BZ#2144004)

    * stunnel consumes high amount of memory when pestered with TCP connections without a TLS handshake     (BZ#2144009)

    * In FIPS mode, openssl should reject SHAKE as digest for RSA-OAEP or provide an indicator (BZ#2144011)

    * In FIPS mode, openssl should reject RSASSA-PSS salt lengths larger than the output size of the hash     function used, or provide an indicator (BZ#2144013)

    * In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator     (BZ#2144016)

    * In FIPS mode, openssl should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-     based DRBGs, or provide an indicator after 2023-05-16 (BZ#2144018)

    * In FIPS mode, openssl should reject KDF input and output key lengths < 112 bits or provide an indicator     (BZ#2144020)

    * In FIPS mode, openssl should reject RSA keys < 2048 bits when using EVP_PKEY_decapsulate, or provide an     indicator (BZ#2145171)

    * OpenSSL FIPS checksum code needs update (BZ#2158413)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1203 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378)

    * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service     attack (CVE-2022-4379)

    * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179)

    * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266)

    * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z7 Batch (BZ#2162424)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1192 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: mm/mremap.c use-after-free vulnerability (CVE-2022-41222)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1185 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.

    Security Fix(es):

    * undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgements, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1140 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: HTTP multi-header compression denial of service (CVE-2023-23916)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
173453	RHEL 7 : Red Hat Gluster Storage web-admin-build (RHSA-2023:1486)	critical
173435	RHEL 8 : firefox (RHSA-2023:1479)	high
173428	RHEL 9 : kpatch-patch (RHSA-2023:1466)	high
173427	RHEL 9 : kpatch-patch (RHSA-2023:1471)	high
173426	RHEL 9 : kernel (RHSA-2023:1470)	high
173423	RHEL 8 : thunderbird (RHSA-2023:1472)	high
173422	RHEL 9 : kernel-rt (RHSA-2023:1467)	high
173421	RHEL 9 : kernel (RHSA-2023:1468)	high
173420	RHEL 9 : kernel-rt (RHSA-2023:1469)	high
173332	RHEL 8 : openssl (RHSA-2023:1440)	critical
173325	RHEL 9 : kpatch-patch (RHSA-2023:1435)	high
173324	RHEL 8 : thunderbird (RHSA-2023:1403)	high
173323	RHEL 8 : nss (RHSA-2023:1436)	high
173322	RHEL 8 : nss (RHSA-2023:1370)	high
173321	RHEL 8 : thunderbird (RHSA-2023:1443)	high
173320	RHEL 8 : thunderbird (RHSA-2023:1442)	high
173319	RHEL 8 : firefox (RHSA-2023:1445)	high
173318	RHEL 9 : nss (RHSA-2023:1365)	high
173317	RHEL 8 : firefox (RHSA-2023:1444)	high
173316	RHEL 9 : firefox (RHSA-2023:1364)	high
173315	RHEL 9 : nss (RHSA-2023:1368)	high
173314	RHEL 9 : thunderbird (RHSA-2023:1402)	high
173313	RHEL 8 : nss (RHSA-2023:1406)	high
173312	RHEL 8 : openssl (RHSA-2023:1437)	critical
173311	RHEL 8 : openssl (RHSA-2023:1405)	critical
173310	RHEL 8 : openssl (RHSA-2023:1441)	critical
173309	RHEL 8 : thunderbird (RHSA-2023:1404)	high
173308	RHEL 8 : firefox (RHSA-2023:1367)	high
173307	RHEL 6 : openssl (RHSA-2023:1438)	critical
173306	RHEL 6 : nss (RHSA-2023:1366)	high
173305	RHEL 9 : thunderbird (RHSA-2023:1407)	high
173304	RHEL 8 : openssl (RHSA-2023:1439)	critical
173303	RHEL 8 : nss (RHSA-2023:1369)	high
173046	RHEL 7 : openssl (RHSA-2023:1335)	critical
173045	RHEL 7 : firefox (RHSA-2023:1333)	high
173043	RHEL 7 : nss (RHSA-2023:1332)	high
173042	RHEL 9 : firefox (RHSA-2023:1337)	high
173041	RHEL 8 : firefox (RHSA-2023:1336)	high
172587	RHEL 8 : nss (RHSA-2023:1252)	high
172586	RHEL 8 : kpatch-patch (RHSA-2023:1251)	high
172549	RHEL 8 : kernel (RHSA-2023:1221)	high
172548	RHEL 9 : gnutls (RHSA-2023:1200)	high
172547	RHEL 9 : kernel (RHSA-2023:1202)	high
172546	RHEL 9 : lua (RHSA-2023:1211)	medium
172544	RHEL 8 : kernel-rt (RHSA-2023:1220)	high
172543	RHEL 9 : openssl (RHSA-2023:1199)	critical
172542	RHEL 9 : kernel-rt (RHSA-2023:1203)	high
172501	RHEL 8 : kpatch-patch (RHSA-2023:1192)	high
172400	RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4 (RHSA-2023:1185)	high
172374	RHEL 8 : curl (RHSA-2023:1140)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

critical

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

high

high

critical

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high

medium

high

critical

high

high

high

medium