The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7191 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7143 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under     Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update     experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 serves as a replacement for Red Hat     JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10, and includes bug fixes and enhancements,     which are documented in the Release Notes linked to in the References section.

    Security Fix(es):

    * httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

    * httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

    * httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275)

    * httpd: NULL pointer dereference via crafted request during HTTP/2 request processing (CVE-2021-41524)

    * httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7119 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.30).

    Security Fix(es):

    * mysql: Server: DML multiple unspecified vulnerabilities (CVE-2021-2478, CVE-2021-2479, CVE-2021-35591,     CVE-2021-35607, CVE-2022-21301, CVE-2022-21413)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CVE-2021-2481, CVE-2021-35575,     CVE-2021-35577, CVE-2021-35610, CVE-2021-35612, CVE-2021-35626, CVE-2021-35627, CVE-2021-35628,     CVE-2021-35634, CVE-2021-35635, CVE-2021-35636, CVE-2021-35638, CVE-2021-35641, CVE-2021-35642,     CVE-2021-35643, CVE-2021-35644, CVE-2021-35645, CVE-2021-35646, CVE-2021-35647, CVE-2022-21253,     CVE-2022-21254, CVE-2022-21264, CVE-2022-21278, CVE-2022-21297, CVE-2022-21339, CVE-2022-21342,     CVE-2022-21351, CVE-2022-21370, CVE-2022-21378, CVE-2022-21412, CVE-2022-21414, CVE-2022-21435,     CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459,     CVE-2022-21462, CVE-2022-21478, CVE-2022-21479, CVE-2022-21509, CVE-2022-21525, CVE-2022-21526,     CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553,     CVE-2022-21569, CVE-2022-21265)

    * mysql: Server: Replication multiple unspecified vulnerabilities (CVE-2021-35546, CVE-2022-21344,     CVE-2022-21415)

    * mysql: Server: Error Handling unspecified vulnerability (CVE-2021-35596)

    * mysql: C API unspecified vulnerability (CVE-2021-35597)

    * mysql: Server: Options multiple unspecified vulnerabilities (CVE-2021-35602, CVE-2021-35630,     CVE-2022-21515)

    * mysql: InnoDB multiple unspecified vulnerabilities (CVE-2021-35604, CVE-2022-21302, CVE-2022-21348,     CVE-2022-21352, CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21517, CVE-2022-21537,     CVE-2022-21539, CVE-2022-21423)

    * mysql: Server: Group Replication Plugin multiple unspecified vulnerabilities (CVE-2021-35608,     CVE-2022-21256, CVE-2022-21379, CVE-2022-21454)

    * mysql: Server: Security: Encryption multiple unspecified vulnerabilities (CVE-2021-35622,     CVE-2022-21358, CVE-2022-21372, CVE-2022-21538)

    * mysql: Server: Security: Privileges multiple unspecified vulnerabilities (CVE-2021-35624,     CVE-2022-21245, CVE-2021-35625)

    * mysql: Server: GIS unspecified vulnerability (CVE-2021-35631)

    * mysql: Server: Data Dictionary unspecified vulnerability (CVE-2021-35632)

    * mysql: Server: PS unspecified vulnerability (CVE-2021-35637)

    * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CVE-2021-35639, CVE-2022-21303,     CVE-2022-21522, CVE-2022-21534)

    * mysql: Server: FTS multiple unspecified vulnerabilities (CVE-2021-35648, CVE-2022-21427)

    * mysql: Server: Federated multiple unspecified vulnerabilities (CVE-2022-21270, CVE-2022-21547)

    * mysql: Server: Parser unspecified vulnerability (CVE-2022-21304)

    * mysql: Server: Information Schema multiple unspecified vulnerabilities (CVE-2022-21362, CVE-2022-21374)

    * mysql: Server: Compiling unspecified vulnerability (CVE-2022-21367)

    * mysql: Server: Components Services unspecified vulnerability (CVE-2022-21368)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CVE-2022-21425, CVE-2022-21444, CVE-2021-35640,     CVE-2022-21249)

    * mysql: Server: PAM Auth Plugin unspecified vulnerability (CVE-2022-21457)

    * mysql: Server: Logging multiple unspecified vulnerabilities (CVE-2022-21460, CVE-2021-35633)

    * mysql: Server: Security: Roles unspecified vulnerability (CVE-2021-35623)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Rebuild mecab due to change in the suffix (from .el8 to .el8.0.0) [rhel-8] (BZ#2110940)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7137 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7133 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: SIGSEGV in sync_repl (CVE-2022-2850)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7128 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7173 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

    * kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7209 advisory.

    KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by     other applications.  Both specifications are building blocks of S/MIME and TLS.

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7108 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * sqlite: Out of bounds access during table rename (CVE-2020-35527)

    * sqlite: Null pointer derreference in src/select.c (CVE-2020-35525)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7186 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7182 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7184 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7190 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7181 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7183 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7178 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.4.0.

    Security Fix(es):

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack by malicious server     administrators (CVE-2022-39249)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a device verification attack (CVE-2022-39250)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to an impersonation attack (CVE-2022-39251)

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to a data corruption issue (CVE-2022-39236)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox ESR 102.4 and Thunderbird 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7188 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7129 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * git-lfs needs to be rebuild with golang 1.17.7-1 or above

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7105 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7110 advisory.

  - kernel: information leak in scsi_ioctl() (CVE-2022-0494)

  - kernel: kernel info leak issue in pfkey_register (CVE-2022-1353)

  - hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions     (CVE-2022-29900)

  - hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7146 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7087 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: SIGSEGV in sync_repl (CVE-2022-2850)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Import may break replication because changelog starting csn may not be created (BZ#2113056)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6735 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR7-FP15.

    Security Fix(es):

    * OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7111 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: server memory information leak via SMB1 (CVE-2022-32742)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * python3-samba requires samba and that is a bug (BZ#2126041)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7134 advisory.

  - kernel: information leak in scsi_ioctl() (CVE-2022-0494)

  - kernel: kernel info leak issue in pfkey_register (CVE-2022-1353)

  - hw: cpu: AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825)

  - kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

  - hw: cpu: AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions     (CVE-2022-29900)

  - hw: cpu: Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7192 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7171 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * a use-after-free in cls_route filter implementation may lead to privilege escalation (CVE-2022-2588)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * backports from upstream for netfilter (BZ#2120635)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7187 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7106 advisory.

    The zlib packages provide a general-purpose lossless data compression library that is used by many     different programs.

    Security Fix(es):

    * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header     extra field (CVE-2022-37434)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7185 advisory.

    The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to     manage multipath devices.

    Security Fix(es):

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7090 advisory.

    KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by     other applications.  Both specifications are building blocks of S/MIME and TLS.

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7089 advisory.

    KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by     other applications.  Both specifications are building blocks of S/MIME and TLS.

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7086 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by     entering name in Subject field (CVE-2022-2393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7088 advisory.

    KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by     other applications.  Both specifications are building blocks of S/MIME and TLS.

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7066 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7069 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7070 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7068 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7072 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:7071 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.4.0 ESR.

    Security Fix(es):

    * Mozilla: Same-origin policy violation could have leaked cross-origin URLs (CVE-2022-42927)

    * Mozilla: Memory Corruption in JS Engine (CVE-2022-42928)

    * Mozilla: Denial of Service via window.print (CVE-2022-42929)

    * Mozilla: Memory safety bugs fixed in Firefox 106 and Firefox ESR 102.4 (CVE-2022-42932)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6999 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [rhel-9] (BZ#2132934)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7007 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7013 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [rhel-9] (BZ#2131865)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7008 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) (BZ#2130373)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7009 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7002 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2022-10, 8u352) (BZ#2130371)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7003 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7004 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7011 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7006 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
166699	RHEL 8 : device-mapper-multipath (RHSA-2022:7191)	high
166564	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 (RHSA-2022:7143)	critical
166543	RHEL 8 : mysql:8.0 (RHSA-2022:7119)	high
166542	RHEL 8 : kpatch-patch (RHSA-2022:7137)	high
166541	RHEL 8 : 389-ds:1.4 (RHSA-2022:7133)	medium
166540	RHEL 8 : postgresql:12 (RHSA-2022:7128)	high
166539	RHEL 7 : kpatch-patch (RHSA-2022:7173)	high
166521	RHEL 8 : libksba (RHSA-2022:7209)	critical
166492	RHEL 8 : sqlite (RHSA-2022:7108)	critical
166491	RHEL 7 : device-mapper-multipath (RHSA-2022:7186)	high
166490	RHEL 8 : thunderbird (RHSA-2022:7182)	high
166486	RHEL 7 : thunderbird (RHSA-2022:7184)	high
166485	RHEL 8 : thunderbird (RHSA-2022:7190)	high
166484	RHEL 8 : thunderbird (RHSA-2022:7181)	high
166483	RHEL 8 : thunderbird (RHSA-2022:7183)	high
166482	RHEL 9 : thunderbird (RHSA-2022:7178)	high
166481	RHEL 8 : device-mapper-multipath (RHSA-2022:7188)	high
166480	RHEL 8 : git-lfs (RHSA-2022:7129)	medium
166479	RHEL 8 : gnutls (RHSA-2022:7105)	high
166478	RHEL 8 : kernel (RHSA-2022:7110)	high
166477	RHEL 7 : kernel (RHSA-2022:7146)	high
166476	RHEL 7 : 389-ds-base (RHSA-2022:7087)	medium
166475	RHEL 8 : java-1.8.0-ibm (RHSA-2022:6735)	high
166474	RHEL 8 : samba (RHSA-2022:7111)	medium
166473	RHEL 8 : kernel-rt (RHSA-2022:7134)	high
166471	RHEL 8 : device-mapper-multipath (RHSA-2022:7192)	high
166470	RHEL 7 : kernel (RHSA-2022:7171)	high
166465	RHEL 8 : device-mapper-multipath (RHSA-2022:7187)	high
166464	RHEL 8 : zlib (RHSA-2022:7106)	critical
166463	RHEL 9 : device-mapper-multipath (RHSA-2022:7185)	high
166445	RHEL 9 : libksba (RHSA-2022:7090)	critical
166444	RHEL 8 : libksba (RHSA-2022:7089)	critical
166431	RHEL 7 : pki-core (RHSA-2022:7086)	medium
166430	RHEL 7 : libksba (RHSA-2022:7088)	critical
166345	RHEL 8 : firefox (RHSA-2022:7066)	high
166344	RHEL 7 : firefox (RHSA-2022:7069)	high
166343	RHEL 8 : firefox (RHSA-2022:7070)	high
166342	RHEL 8 : firefox (RHSA-2022:7068)	high
166341	RHEL 8 : firefox (RHSA-2022:7072)	high
166340	RHEL 9 : firefox (RHSA-2022:7071)	high
166328	RHEL 9 : java-17-openjdk (RHSA-2022:6999)	medium
166327	RHEL 9 : java-1.8.0-openjdk (RHSA-2022:7007)	low
166326	RHEL 9 : java-11-openjdk (RHSA-2022:7013)	medium
166290	RHEL 7 : java-11-openjdk (RHSA-2022:7008)	medium
166288	RHEL 8 : java-11-openjdk (RHSA-2022:7009)	medium
166287	RHEL 7 : java-1.8.0-openjdk (RHSA-2022:7002)	low
166285	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:7003)	low
166284	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:7004)	low
166283	RHEL 8 : java-11-openjdk (RHSA-2022:7011)	medium
166282	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:7006)	low

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

critical

high

high

medium

high

high

critical

critical

high

high

high

high

high

high

high

high

medium

high

high

high

medium

high

medium

high

high

high

high

critical

high

critical

critical

medium

critical

high

high

high

high

high

high

medium

low

medium

medium

medium

low

low

low

medium

low