The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8552 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.5.0 ESR.

    Security Fix(es):

    * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)

    * Mozilla: Fullscreen notification bypass (CVE-2022-45404)

    * Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)

    * Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)

    * Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)

    * Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)

    * Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)

    * Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)

    * Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)

    * Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)

    * Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)

    * Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)

    * Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8547 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.5.0.

    Security Fix(es):

    * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)

    * Mozilla: Fullscreen notification bypass (CVE-2022-45404)

    * Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)

    * Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)

    * Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)

    * Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)

    * Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)

    * Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)

    * Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)

    * Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)

    * Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)

    * Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)

    * Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8543 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.5.0.

    Security Fix(es):

    * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)

    * Mozilla: Fullscreen notification bypass (CVE-2022-45404)

    * Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)

    * Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)

    * Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)

    * Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)

    * Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)

    * Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)

    * Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)

    * Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)

    * Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)

    * Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)

    * Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8545 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.5.0.

    Security Fix(es):

    * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)

    * Mozilla: Fullscreen notification bypass (CVE-2022-45404)

    * Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)

    * Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)

    * Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)

    * Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)

    * Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)

    * Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)

    * Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)

    * Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)

    * Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)

    * Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)

    * Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8544 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.5.0.

    Security Fix(es):

    * Mozilla: Service Workers might have learned size of cross-origin media files (CVE-2022-45403)

    * Mozilla: Fullscreen notification bypass (CVE-2022-45404)

    * Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)

    * Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)

    * Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)

    * Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)

    * Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 (CVE-2022-45421)

    * Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy (CVE-2022-45410)

    * Mozilla: Cross-Site Tracing was possible via non-standard override headers (CVE-2022-45411)

    * Mozilla: Symlinks may resolve to partially uninitialized buffers (CVE-2022-45412)

    * Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)

    * Mozilla: Custom mouse cursor could have been drawn over browser UI (CVE-2022-45418)

    * Mozilla: Iframe contents could be rendered outside the iframe (CVE-2022-45420)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8532 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):
    * tfm-rubygem-puma: http request smuggling vulnerabilities (CVE-2022-24790)

    This update fixes the following bugs:
    * 2038995: When executing the content migration (pre-upgrade process), there is a PG query created by pulp     that will be sitting forever
    * 2074099: The errata migration continues to fail with pymongo.errors.DocumentTooLarge: BSON document too     large error even after upgrading to Satellite 6.9.8
    * 2081560: ForeignKeyViolation Error with docker_meta_tags
    * 2091438: Use of content.count() in app/models/repository.py seems to hit an error
    * 2093829: 'foreman-maintain content migration-stats' command stucks and consume all memory
    * 2098221: Pulp 3 migration stats timing is too low for very large deployments
    * 2141348: It appears that the egg is downloaded every time

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8493 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8502 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor (CVE-2022-0155)

    * ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style (CVE-2022-2805)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Ghost OVFs are written when using floating SD to migrate VMs between 2 RHV environments. (BZ#1705338)

    * RHV engine is reporting a delete disk with wipe as completing successfully when it actually fails from a     timeout. (BZ#1836318)

    * [DR] Failover / Failback HA VM Fails to be started due to 'VM XXX is being imported' (BZ#1968433)

    * Virtual Machine with lease fails to run on DR failover (BZ#1974535)

    * Disk is missing after importing VM from Storage Domain that was detached from another DC. (BZ#1983567)

    * Unable to switch RHV host into maintenance mode as there are image transfer in progress (BZ#2123141)

    * not able to import disk in 4.5.2 (BZ#2134549)

    Enhancement(s):

    * [RFE] Show last events for user VMs (BZ#1886211)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8491 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550)

    * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8492 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8494 advisory.

    The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and     customizable boot loader with modular architecture. The packages support a variety of kernel formats, file     systems, computer architectures, and hardware devices.

    Security Fix(es):

    * grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure     boot bypass (CVE-2022-2601)

    * grub2: Heap based out-of-bounds write when redering certain unicode sequences (CVE-2022-3775)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8434 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2.

    The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134641)

    Security Fix(es):

    * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7955 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * containers/storage: DoS via malicious image (CVE-2021-20291)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8062 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2087120)

    Security Fix(es):

    * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious     domain names (CVE-2022-30698)

    * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious     domain names (CVE-2022-30699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8003 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313)

    Security Fix(es):

    * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8139 advisory.

    WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique     hybrid compression mode.

    Security Fix(es):

    * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8291 advisory.

    The rsync utility enables the users to copy and synchronize files locally or across a network.
    Synchronization with rsync is fast because rsync only sends the differences in files over the network     instead of sending whole files. The rsync utility is also used as a mirroring tool.

    Security Fix(es):

    * zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra     field (CVE-2022-37434)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8453 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Regression of CVE-2022-41974 fix in Red Hat Enterprise Linux (CVE-2022-3787)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8098 advisory.

    Toolbox is a tool for Linux operating systems, which allows the use of containerized command line     environments. It is built on top of Podman and other standard container technologies from OCI.

    Security Fix(es):

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8221 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319)

    * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension     (CVE-2022-2320)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8222 advisory.

    Xwayland is an X server for running X clients under Wayland.

    Security Fix(es):

    * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319)

    * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension     (CVE-2022-2320)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8361 advisory.

    The e2fsprogs packages provide a number of utilities for creating, checking, modifying, and correcting the     ext2, ext3, and ext4 file systems.

    Security Fix(es):

    * e2fsprogs: out-of-bounds read/write via crafted filesystem (CVE-2022-1304)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8151 advisory.

    Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

    Security Fix(es):

    * poppler: A logic error in the Hints::Hints function can cause denial of service (CVE-2022-27337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7968 advisory.

    The virt-v2v package provides a tool for converting virtual machines to use the KVM (Kernel-based Virtual     Machine) hypervisor or Red Hat Enterprise Virtualization. The tool modifies both the virtual machine image     and its associated libvirt metadata. Also, virt-v2v can configure a guest to use VirtIO drivers if     possible.

    Security Fix(es):

    * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8263 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    * DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash (CVE-2021-3839)

    * dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service     (CVE-2022-28199)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8126 advisory.

    Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks,     formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first     boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service,     hypervisor bridge, etc.) and applies the configuration.

    The following packages have been upgraded to a later upstream version: ignition (2.14.0). (BZ#2090647)

    Security Fix(es):

    * ignition: configs are accessible from unprivileged containers in VMs running on VMware products     (CVE-2022-1706)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8267 advisory.

  - kernel: off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516)

  - kernel: use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640)

  - kernel: smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168)

  - kernel: NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617)

  - kernel: swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854)

  - kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

  - kernel: race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048)

  - kernel: KVM: cmpxchg_gpte can write to pfns outside the userspace region (CVE-2022-1158)

  - kernel: use-after-free and memory errors in ext4 when mounting and operating on a corrupted image     (CVE-2022-1184)

  - kernel: concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280)

  - kernel: kernel info leak issue in pfkey_register (CVE-2022-1353)

  - kernel: use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679)

  - kernel: NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852)

  - kernel: fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998)

  - kernel: net/packet: slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368)

  - hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123)

  - hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125)

  - hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166)

  - kernel: possible to use the debugger to write zero into a location of choice (CVE-2022-21499)

  - hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

  - kernel: nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448)

  - kernel: nf_tables cross-table potential use-after-free may lead to local privilege escalation     (CVE-2022-2586)

  - hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373)

  - kernel: openvswitch: integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639)

  - kernel: double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390)

  - kernel: use after free in SUNRPC subsystem (CVE-2022-28893)

  - kernel: use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581)

  - hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29900)

  - hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

  - kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946)

  - kernel: nf_tables disallow binding to already bound chain (CVE-2022-39190)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8250 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8008 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * containers/storage: DoS via malicious image (CVE-2021-20291)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8207 advisory.

    OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.

    Security Fix(es):

    * openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer (CVE-2022-1122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8252 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8317 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.16.4). (BZ#2077487)

    Security Fix(es):

    * samba: server memory information leak via SMB1 (CVE-2022-32742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8022 advisory.

    The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework.

    Security Fix(es):

    * qt: QProcess could execute a binary from the current working directory when not found in the PATH     (CVE-2022-25255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8420 advisory.

    The zlib packages provide a general-purpose lossless data compression library that is used by many     different programs.

    Security Fix(es):

    * zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8444 advisory.

    Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

    Security Fix(es):

    * keylime: exception handling and impedance match in tornado_requests (CVE-2022-3500)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8219 advisory.

    Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail     storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP.

    Security Fix(es):

    * mutt: buffer overflow in uudecoder function (CVE-2022-1328)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8299 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: bad local IPv6 connection reuse (CVE-2022-27775)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8431 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * (podman image trust) does not support the new trust type sigstoreSigned  (BZ#2120436)

    * dnf-update broken for podman/catatonit (BZ#2123319)

    * podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905)

    * podman kill may deadlock [RHEL 9.1] (BZ#2124716)

    * containers config.json gets empty after sudden power loss (BZ#2136278)

    * PANIC podman API service endpoint handler panic (BZ#2136287)

    Enhancement(s):

    * Podman volume plugin timeout should be configurable [rhel-9.1.0 Z] (BZ#2124676)

    * [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8054 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-22624)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-22628)

    * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2022-22629)

    * webkitgtk: Cookie management issue leading to sensitive user information disclosure (CVE-2022-22662)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26700)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26709)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26710)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26716)

    * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26717)

    * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26719)

    * webkitgtk: Heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer leading to arbitrary     code execution (CVE-2022-30293)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8162 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    The following packages have been upgraded to a later upstream version: 389-ds-base (2.1.3). (BZ#2061801)

    Security Fix(es):

    * 389-ds-base: sending crafted message could result in DoS (CVE-2022-0918)

    * 389-ds-base: SIGSEGV in sync_repl (CVE-2022-2850)

    * 389-ds-base: expired password was still allowed to access the database (CVE-2022-0996)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8068 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220)

    * bind: DoS from specifically crafted TCP packets (CVE-2022-0396)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8194 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561)

    * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562)

    * libtiff: reachable assertion (CVE-2022-0865)

    * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924)

    * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355)

    * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844)

    * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891)

    * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c     (CVE-2022-0908)

    * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909)

    * libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8090 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8393 advisory.

    The logrotate utility simplifies the administration of multiple log files by allowing their automatic     rotation, compression, removal, and mailing.

    Security Fix(es):

    * logrotate: potential DoS from unprivileged users via the state file (CVE-2022-1348)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:8226 advisory.

    lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python     ElementTree API.

    Security Fix(es):

    * lxml: NULL Pointer Dereference in lxml (CVE-2022-2309)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7954 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

    * podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)

    * podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)

    * containers/storage: DoS via malicious image (CVE-2021-20291)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8318 advisory.

    The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP     servers, or use local TDB databases.

    The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490)

    Security Fix(es):

    * samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request     (CVE-2022-32746)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8384 advisory.

    HarfBuzz is an implementation of the OpenType Layout engine.

    Security Fix(es):

    * harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc (CVE-2022-33068)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7950 advisory.

    Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits,     that uses osbuild under the hood.

    Security Fix(es):

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8070 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * dnsmasq: Heap use after free in dhcp6_no_relay (CVE-2022-0934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
168024	RHEL 7 : firefox (RHSA-2022:8552)	critical
168016	RHEL 8 : thunderbird (RHSA-2022:8547)	critical
168014	RHEL 8 : thunderbird (RHSA-2022:8543)	critical
168013	RHEL 8 : thunderbird (RHSA-2022:8545)	critical
168012	RHEL 8 : thunderbird (RHSA-2022:8544)	critical
167832	RHEL 7 : Satellite 6.9.10 Async Security Update (Important) (RHSA-2022:8532)	high
167788	RHEL 9 : python3.9 (RHSA-2022:8493)	high
167749	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.3] (RHSA-2022:8502)	medium
167742	RHEL 7 : xorg-x11-server (RHSA-2022:8491)	high
167741	RHEL 8 : python39:3.9 (RHSA-2022:8492)	high
167651	RHEL 8 : grub2 (RHSA-2022:8494)	high
167645	RHEL 9 : dotnet7.0 (RHSA-2022:8434)	high
167644	RHEL 9 : skopeo (RHSA-2022:7955)	high
167643	RHEL 9 : unbound (RHSA-2022:8062)	medium
167642	RHEL 9 : libvirt (RHSA-2022:8003)	medium
167641	RHEL 9 : wavpack (RHSA-2022:8139)	medium
167636	RHEL 9 : rsync (RHSA-2022:8291)	critical
167635	RHEL 9 : device-mapper-multipath (RHSA-2022:8453)	high
167628	RHEL 9 : toolbox (RHSA-2022:8098)	medium
167627	RHEL 9 : xorg-x11-server (RHSA-2022:8221)	high
167626	RHEL 9 : xorg-x11-server-Xwayland (RHSA-2022:8222)	high
167625	RHEL 9 : e2fsprogs (RHSA-2022:8361)	high
167624	RHEL 9 : poppler (RHSA-2022:8151)	medium
167623	RHEL 9 : virt-v2v (RHSA-2022:7968)	medium
167622	RHEL 9 : dpdk (RHSA-2022:8263)	high
167621	RHEL 9 : ignition (RHSA-2022:8126)	medium
167620	RHEL 9 : kernel (RHSA-2022:8267)	high
167619	RHEL 9 : grafana-pcp (RHSA-2022:8250)	medium
167618	RHEL 9 : buildah (RHSA-2022:8008)	high
167617	RHEL 9 : openjpeg2 (RHSA-2022:8207)	medium
167616	RHEL 9 : yajl (RHSA-2022:8252)	high
167614	RHEL 9 : samba (RHSA-2022:8317)	medium
167613	RHEL 9 : qt5 (RHSA-2022:8022)	high
167612	RHEL 9 : mingw-zlib (RHSA-2022:8420)	high
167611	RHEL 9 : keylime (RHSA-2022:8444)	medium
167610	RHEL 9 : mutt (RHSA-2022:8219)	medium
167609	RHEL 9 : curl (RHSA-2022:8299)	high
167608	RHEL 9 : podman (RHSA-2022:8431)	high
167607	RHEL 9 : webkit2gtk3 (RHSA-2022:8054)	high
167606	RHEL 9 : 389-ds-base (RHSA-2022:8162)	medium
167605	RHEL 9 : bind (RHSA-2022:8068)	medium
167604	RHEL 9 : libtiff (RHSA-2022:8194)	high
167603	RHEL 9 : runc (RHSA-2022:8090)	high
167602	RHEL 9 : logrotate (RHSA-2022:8393)	medium
167601	RHEL 9 : python-lxml (RHSA-2022:8226)	high
167600	RHEL 9 : podman (RHSA-2022:7954)	medium
167599	RHEL 9 : libldb (RHSA-2022:8318)	medium
167598	RHEL 9 : harfbuzz (RHSA-2022:8384)	medium
167597	RHEL 9 : Image Builder (RHSA-2022:7950)	high
167596	RHEL 9 : dnsmasq (RHSA-2022:8070)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

critical

critical

critical

critical

critical

high

high

medium

high

high

high

high

high

medium

medium

medium

critical

high

medium

high

high

high

medium

medium

high

medium

high

medium

high

medium

high

medium

high

high

medium

medium

high

high

high

medium

medium

high

high

medium

high

medium

medium

medium

high

high