The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2627 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-     SN-3008,CVE-2024-25742,CVE-2024-25743)

    Bug Fix(es):

    * CVE-2024-25743 kernel: hw: amd: Instruction raise #VC exception at exit (JIRA:RHEL-30028)

    * Seeing high latency execution of kernel functions associated with cgroup_rstat_updated()     (JIRA:RHEL-30186)

    * RHEL9 NFS file corruption handling congestion (JIRA:RHEL-31223)

    * Add tracepoints for sources of IPIs (JIRA:RHEL-27097)

    * In RHEL9/cgroupv2, vhost task is not pinned to pCPU defined by emulatorpin (JIRA:RHEL-32635)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2631 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, and bug fixes. Space precludes documenting all of these     changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on     the most significant of these changes:

    https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/6.1/html/release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2085 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357)

    Bug Fix(es):

    * Connection cannot be established when IPv6 IP SAN is used (JIRA:RHEL-33350)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2625 advisory.

    The rhc-worker-script packages provide Remote Host Configuration (rhc) worker for executing an interpreted     programming language script on hosts managed by Red Hat Insights.

    Security Fix(es):

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Enhancement(s):

    * Include deps information in rhc-worker-script binary (JIRA:HMS-3983)

    * Set more granular log level for the scripts (JIRA:HMS-3837)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2081 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2628 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-     SN-3008,CVE-2024-25742,CVE-2024-25743)

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.2 ad hoc schedule build (JIRA:RHEL-32985)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2089 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: full container escape at build time (CVE-2024-1753)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2082 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2090 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * buildah: full container escape at build time (CVE-2024-1753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2562 advisory.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect     (CVE-2023-45289)

    * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

    * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

    * golang: html/template: errors returned from MarshalJSON methods may break template escaping     (CVE-2024-24785)

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2581 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2571 advisory.

    The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote     directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the     Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to     connect to multiple different account sources.

    Security Fix(es):

    * sssd: Race condition during authorization leads to GPO policies functioning inconsistently     (CVE-2023-3758)

    Bug Fix(es):

    * socket leak (JIRA:RHEL-22340)

    * Passkey cannot fall back to password (JIRA:RHEL-28161)

    * sssd: Race condition during authorization leads to GPO policies functioning inconsistently     (JIRA:RHEL-27209)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2551 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

    * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

    * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516)

    * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution     (CVE-2023-5679)

    * bind: Querying RFC 1918 reverse zones may cause an assertion failure when nxdomain-redirect is     enabled (CVE-2023-5517)

    * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408)

    Bug Fix(es):

    * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2619 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the     MySQL server daemon, mysqld, and many client programs.

    The following packages have been upgraded to a later upstream version:
    rh-mysql80-mysql (8.0.36)

    Security fixes:

    * mysql: Client programs unspecified vulnerability (CVE-2023-21980, CVE-2023-22053)

    * mysql: InnoDB unspecified vulnerability (CVE-2023-21911, CVE-2023-22008, CVE-2023-22033, CVE-2023-22066,     CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114)

    * mysql: Server : Security : Firewall unspecified vulnerability (CVE-2024-20984)

    * mysql: Server: Audit Plug-in unspecified vulnerability (CVE-2024-21061)

    * mysql: Server: Components Services unspecified vulnerability (CVE-2023-21940, CVE-2023-21947,     CVE-2023-21962)

    * mysql: Server: DDL unspecified vulnerability (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933,     CVE-2023-22058, CVE-2024-20969, CVE-2024-20981)

    * mysql: Server: DML unspecified vulnerability (CVE-2023-21972, CVE-2023-22115, CVE-2024-20983,     CVE-2024-21015, CVE-2024-21049, CVE-2024-21050, CVE-2024-21051, CVE-2024-21052, CVE-2024-21053,     CVE-2024-21056)

    * mysql: Server: JSON unspecified vulnerability (CVE-2023-21966)

    * mysql: Server: Optimizer unspecified vulnerability (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945,     CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982, CVE-2023-22032, CVE-2023-22046,     CVE-2023-22054, CVE-2023-22056, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070,     CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112,     CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-20970, CVE-2024-20971,     CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978,     CVE-2024-20982, CVE-2024-20993, CVE-2024-21055, CVE-2024-21057)

    * mysql: Server: Options unspecified vulnerability (CVE-2024-20968)

    * mysql: Server: Partition unspecified vulnerability (CVE-2023-21953, CVE-2023-21955)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CVE-2023-22048)

    * mysql: Server: RAPID unspecified vulnerability (CVE-2024-20960)

    * mysql: Server: Replication unspecified vulnerability (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057,     CVE-2024-20967)

    * mysql: Server: Security: Encryption unspecified vulnerability (CVE-2023-22113, CVE-2024-20963)

    * mysql: Server: Security: Privileges unspecified vulnerability (CVE-2023-22038, CVE-2024-20964)

    * mysql: Server: UDF unspecified vulnerability (CVE-2023-22111, CVE-2024-20985)

    * zstd: mysql: buffer overrun in util.c (CVE-2022-4899)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2582 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

    * kernel: netfilter: divide error in nft_limit_init (CVE-2021-46915)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

    Bug Fix(es):

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-18996)

    * rbd: don't move requests to the running list on errors [8.x] (JIRA:RHEL-24201)

    * TRIAGE CVE-2021-46915 kernel: netfilter: divide error in nft_limit_init (JIRA:RHEL-28179)

    * [RHEL 8.4] Soft Lockups from BZ-2174623 hit on RHEL 8.4 (JIRA:RHEL-16035)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (JIRA:RHEL-26386)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (JIRA:RHEL-29181)

    * Intel i40e driver performance issue (JIRA:RHEL-30402)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2570 advisory.

    The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Security Fix(es):

    * gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834)

    * gnutls: potential crash during chain building/verification (CVE-2024-28835)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2550 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Bug Fix(es):

    * TRIAGE CVE-2024-24786 buildah: golang-protobuf: encoding/protojson, internal/encoding/json: infinite     loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] RHEL9.4 0Day     (JIRA:RHEL-28230)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2566 advisory.

    Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and     analysis of system-level performance measurements. Its light-weight distributed architecture makes it     particularly well-suited to centralized analysis of complex systems.

    Security Fix(es):

    * pcp: exposure of the redis server backend allows remote command execution via pmproxy (CVE-2024-3019)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2586 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with     very large exponents (CVE-2021-33198)

    * runc: golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2585 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)

    * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

    * kernel: netfilter: divide error in nft_limit_init (CVE-2021-46915)

    * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

    Bug Fix(es):

    * kernel-rt: kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (JIRA:RHEL-20498)

    * TRIAGE CVE-2021-46915 kernel-rt: kernel: netfilter: divide error in nft_limit_init (JIRA:RHEL-29264)

    * kernel-rt: update RT source tree to the latest RHEL-8.4.z Batch 24 (JIRA:RHEL-29266)

    * kernel-rt: kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (JIRA:RHEL-26391)

    * kernel-rt: kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (JIRA:RHEL-29217)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2624 advisory.

    PostgreSQL is an advanced object-relational database management system. The     postgresql-jdbc package includes the .jar files needed for Java programs to     access a PostgreSQL database.

    Security Fix(es):

    * pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using     PreferQueryMode=SIMPLE (CVE-2024-1597)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2583 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2575 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2568 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads     (CVE-2024-1394)

    * grafana: vulnerable to authorization bypass (CVE-2024-1313)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2549 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    Bug Fix(es):

    * TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop     in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - RHEL 9.4 0day     (JIRA:RHEL-28235)

    * skopeo: jose-go: improper handling of highly compressed data [rhel-9] (JIRA:RHEL-28736)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2560 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fixes:

    * libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441)

    * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fixes:

    * libvirt: off-by-one error in udevListInterfacesByStatus() [rhel-9] (JIRA:RHEL-25081)

    * libvirt: negative g_new0 length can lead to unbounded memory allocation [rhel-9] (JIRA:RHEL-29515)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2580 advisory.

    Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a     small validating JSON generator.

    Security Fix(es):

    * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2621 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640)

    * kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c (CVE-2022-42895)

    * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546,ZDI-CAN-20527)

    * kernel: ext4: kernel bug in ext4_write_inline_data_end() (CVE-2021-33631)

    * kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

    Bug Fix(es):

    * kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (JIRA:RHEL-18806)

    * tx-checksumming required for accessing port in OpenShift for RHEL 8.6 (JIRA:RHEL-20821)

    * ceph: several cap and snap fixes (JIRA:RHEL-20908)

    * unable to access smsc95xx based interface unless you start outgoing traffic.  (JIRA:RHEL-25718)

    * [RHEL8] ] BUG bio-696 (Not tainted): Poison overwritten  (JIRA:RHEL-26100)

    * kernel: ext4: kernel bug in ext4_write_inline_data_end() (JIRA:RHEL-26330)

    * kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c (JIRA:RHEL-18808)

    * kernel: GSM multiplexing race condition leads to privilege escalation (JIRA:RHEL-19953)

    Enhancement(s):

    * [IBM 8.10 FEAT] Upgrade the qeth driver to latest from upstream, e.g. kernel 6.4 (JIRA:RHEL-25810)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2616 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080)

    * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081)

    * xorg-x11-server: User-after-free in ProcRenderAddGlyphs (CVE-2024-31083)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2559 advisory.

    The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature     (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption)     standards.

    Security Fix(es):

    * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2584 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2565 advisory.

    Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and     uses strong cryptography to provide both authentication and encryption services. These services allow you     to build secure tunnels through untrusted networks such as virtual private network (VPN).

    Security Fix(es):

    * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2577 advisory.

    The shadow-utils packages include programs for converting UNIX password files to     the shadow password format, as well as utilities for managing user and group     accounts.

    Security Fix(es):

    * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2564 advisory.

    The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4     servers.

    Security Fix(es):

    * mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2548 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fixes:

    * podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in     protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    * podman: buildah: full container escape at build time (CVE-2024-1753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fixes:

    * liveness probe not called by podman when using httpGet (JIRA:RHEL-28633)

    * Unable to copy image from one virtual machine to another using podman image scp (JIRA:RHEL-28629)

    * [v4.9] Backport two docker CLI compatibility fixes (JIRA:RHEL-28636)

    * Issue in podman causing S2I to fail in overwriting ENTRYPOINT (JIRA:RHEL-14922)

    * Need to backport podman fix for SIGSEGV in RHEL 9.3/8.9 for UBI based containers (JIRA:RHEL-26843)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2569 advisory.

    grafana-pcp is an open source Grafana plugin for PCP.

    Security Fix(es):

    * grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads     (CVE-2024-1394)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2587 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or     DNSSEC resolver.

    Security Fix(es):

    * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator     (CVE-2023-50387)

    * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU     resources (CVE-2023-50868)

    * A vulnerability was found in Unbound due to incorrect default     permissions, allowing any process outside the unbound group to modify the unbound runtime configuration.
    The default combination of the control-use-cert: no option with either explicit or implicit use of an IP     address in the control-interface option could allow improper access. If a process can connect over     localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an     unprivileged local process to manipulate a running instance, potentially altering forwarders, allowing     them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving     altogether.

    To mitigate the vulnerability, a new file /etc/unbound/conf.d/remote-control.conf has been added and     included in the main unbound configuration file, unbound.conf. The file contains two directives that     should limit access to unbound.conf:

        control-interface: /run/unbound/control         control-use-cert: yes

    For details about these directives, run man unbound.conf.

    Updating to the version of unbound provided by this advisory should, in     most cases, address the vulnerability. To verify that your configuration is not vulnerable, use the     unbound-control status | grep control command. If the output contains control(ssl) or     control(namedpipe), your configuration is not vulnerable. If the command output returns only control,     the configuration is vulnerable because it does not enforce access only to the unbound group members. To     fix your configuration, add the line include: /etc/unbound/conf.d/remote-control.conf to the end of the     file /etc/unbound/unbound.conf. If you use a custom /etc/unbound/conf.d/remote-control.conf file, add     the new directives to     this file. (CVE-2024-1488)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2208 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)

    * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)

    * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)

    * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect     (CVE-2023-39356)

    * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface     (CVE-2023-40186)

    * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)

    * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations     (CVE-2023-40569)

    * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)

    * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)

    * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)

    * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)

    * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2239 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2278 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2528 advisory.

    GLib provides the core application building blocks for libraries and applications written in C. It     provides the core object system used in GNOME, the main loop implementation, and a large set of utility     functions for strings and common data structures.

    Security Fix(es):

    * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499)

    * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611)

    * glib: Timeout in fuzz_variant_text (CVE-2023-32636)

    * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2264 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message     (CVE-2023-45235)

    * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763)

    * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764)

    * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message     (CVE-2023-45229)

    * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231)

    * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232)

    * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2447 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data     entries (CVE-2023-2975)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    * OpenSSL: Excessive time spent checking DH q parameter value (CVE-2023-3817)

    * openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or     parameters may be very slow (CVE-2023-5678)

    * openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)

    * openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237)

    * openssl: denial of service via null dereference (CVE-2024-0727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2217 advisory.

    The motif packages include the Motif shared libraries needed to run applications which are dynamically     linked against Motif, as well as MWM, the Motif Window Manager.

    Security Fix(es):

    * libXpm: out of bounds read in XpmCreateXpmImageFromBuffer() (CVE-2023-43788)

    * libXpm: out of bounds read on XPM with corrupted colormap (CVE-2023-43789)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2160 advisory.

    Toolbox is a tool for Linux operating systems, which allows the use of containerized command line     environments. It is built on top of Podman and other standard container technologies from OCI.

    Security Fix(es):

    * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2147 advisory.

    Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization     solution for both traditional and cloud-based enterprise environments.

    Security Fix(es):

    * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2289 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090)

    * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618)

    * libtiff: integer overflow in tiffcp.c (CVE-2023-40745)

    * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175)

    * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:2483 advisory.

    The traceroute utility displays the route used by IP packets on their way to a specified network (or     Internet) host.

    Security Fix(es):

    * traceroute: improper command line parsing (CVE-2023-46316)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2463 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes (CVE-2023-7008)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2368 advisory.

    The mod_http2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd     2.4 servers.

    Security Fix(es):

    * httpd: mod_http2: DoS in HTTP/2 with initial window size 0 (CVE-2023-43622)

    * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
194888	RHEL 9 : kernel (RHSA-2024:2627)	high
194887	RHEL 8 / 9 : Red Hat Ceph Storage 6.1 (RHSA-2024:2631)	critical
194880	RHEL 9 : libreswan (RHSA-2024:2085)	medium
194879	RHEL 7 : rhc-worker-script (RHSA-2024:2625)	high
194878	RHEL 8 : libreswan (RHSA-2024:2081)	medium
194877	RHEL 9 : kernel-rt (RHSA-2024:2628)	high
194876	RHEL 9 : podman (RHSA-2024:2089)	high
194875	RHEL 8 : libreswan (RHSA-2024:2082)	medium
194874	RHEL 8 : container-tools:rhel8 (RHSA-2024:2090)	high
194846	RHEL 9 : golang (RHSA-2024:2562)	high
194845	RHEL 8 : pcs (RHSA-2024:2581)	high
194844	RHEL 9 : sssd (RHSA-2024:2571)	high
194843	RHEL 9 : bind (RHSA-2024:2551)	high
194842	RHEL 7 : rh-mysql80-mysql (RHSA-2024:2619)	high
194841	RHEL 8 : kernel (RHSA-2024:2582)	high
194840	RHEL 9 : gnutls (RHSA-2024:2570)	medium
194839	RHEL 9 : buildah update (Moderate) (RHSA-2024:2550)	high
194838	RHEL 9 : pcp (RHSA-2024:2566)	high
194837	RHEL 8 : container-tools:3.0 (RHSA-2024:2586)	high
194836	RHEL 8 : kernel-rt (RHSA-2024:2585)	high
194835	RHEL 8 : postgresql-jdbc : Security Update (Important) (RHSA-2024:2624)	critical
194834	RHEL 8 : linux-firmware (RHSA-2024:2583)	medium
194833	RHEL 8 : expat (RHSA-2024:2575)	high
194832	RHEL 9 : grafana (RHSA-2024:2568)	medium
194831	RHEL 9 : skopeo (RHSA-2024:2549)	high
194830	RHEL 9 : libvirt (RHSA-2024:2560)	medium
194829	RHEL 8 : yajl (RHSA-2024:2580)	medium
194828	RHEL 8 : kernel (RHSA-2024:2621)	high
194827	RHEL 9 : tigervnc (RHSA-2024:2616)	high
194826	RHEL 9 : python-jwcrypto (RHSA-2024:2559)	medium
194825	RHEL 8 : pcs (RHSA-2024:2584)	high
194824	RHEL 9 : libreswan (RHSA-2024:2565)	medium
194823	RHEL 8 : shadow-utils (RHSA-2024:2577)	medium
194822	RHEL 9 : mod_http2 (RHSA-2024:2564)	high
194821	RHEL 9 : podman (RHSA-2024:2548)	high
194820	RHEL 9 : grafana-pcp (RHSA-2024:2569)	high
194819	RHEL 8 : unbound (RHSA-2024:2587)	high
194814	RHEL 9 : freerdp (RHSA-2024:2208)	critical
194813	RHEL 9 : skopeo (RHSA-2024:2239)	high
194812	RHEL 9 : httpd (RHSA-2024:2278)	high
194811	RHEL 9 : mingw-glib2 (RHSA-2024:2528)	high
194810	RHEL 9 : edk2 (RHSA-2024:2264)	critical
194809	RHEL 9 : openssl and openssl-fips-provider (RHSA-2024:2447)	critical
194808	RHEL 9 : motif (RHSA-2024:2217)	medium
194807	RHEL 9 : toolbox (RHSA-2024:2160)	medium
194806	RHEL 9 : ipa (RHSA-2024:2147)	medium
194805	RHEL 9 : libtiff (RHSA-2024:2289)	medium
194804	RHEL 9 : traceroute (RHSA-2024:2483)	medium
194803	RHEL 9 : systemd (RHSA-2024:2463)	medium
194802	RHEL 9 : mod_http2 (RHSA-2024:2368)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

critical

medium

high

medium

high

high

medium

high

high

high

high

high

high

high

medium

high

high

high

high

critical

medium

high

medium

high

medium

medium

high

high

medium

high

medium

medium

high

high

high

high

critical

high

high

high

critical

critical

medium

medium

medium

medium

medium

medium

high