The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5805 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5806 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5802 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5837 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR7-FP10.

    Security Fix(es):

    * OpenJDK: Excessive memory allocation in HashMap and HashSet (Utility, 8266097) (CVE-2021-35561)

    * OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)     (CVE-2022-21434)

    * OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151) (CVE-2022-21443)

    * OpenJDK: URI parsing inconsistencies (JNDI, 8278972) (CVE-2022-21496)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5834 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The latest RHEL 8.6.z2 kernel changes need to be merged into the RT source tree to keep source parity     between the two kernels. (BZ#2107215)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5777 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5799 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    The golang packages provide the Go programming language compiler.

    Security Fix(es):

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Clean up dist-git patches (BZ#2109174)

    * Update Go to version 1.17.12 (BZ#2109183)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5778 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5775 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Clean up dist-git patches (BZ#2110942)

    * Update Go to version 1.17.12 (BZ#2110943)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5774 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5771 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5773 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5769 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5772 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5779 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * ruby: Regular expression denial of service vulnerability of Date parsing methods (CVE-2021-41817)

    * ruby: Cookie prefix spoofing in CGI::Cookie.parse (CVE-2021-41819)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5776 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5765 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5767 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5770 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 91.12.0.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5766 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 91.12.0 ESR.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 103 and 102.1 (CVE-2022-2505)

    * Mozilla: Directory indexes for bundled resources reflected URL parameters (CVE-2022-36318)

    * Mozilla: Mouse Position spoofing with CSS transforms (CVE-2022-36319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5759 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a later upstream version: rh-mariadb105-galera (26.4.11), rh-     mariadb105-mariadb (10.5.16).

    Security Fix(es):

    * mariadb: convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669)

    * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-     length stack-based buffer (CVE-2022-24048)

    * mariadb: lack of validating the existence of an object prior to performing operations on the object     (CVE-2022-24050)

    * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier     (CVE-2022-24051)

    * mariadb: CONNECT storage engine heap-based buffer overflow (CVE-2022-24052)

    * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376)

    * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377)

    * mariadb: crash in create_tmp_table::finalize (CVE-2022-27378)

    * mariadb: crash in arg_comparator::compare_real_fixed (CVE-2022-27379)

    * mariadb: crash at my_decimal::operator= (CVE-2022-27380)

    * mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381)

    * mariadb: assertion failure via Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382)

    * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383)

    * mariadb: crash via Item_subselect::init_expr_cache_tracker (CVE-2022-27384)

    * mariadb: crashe in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386)

    * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387)

    * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444)

    * mariadb: assertion failure in compare_order_elements (CVE-2022-27445)

    * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447)

    * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448)

    * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449)

    * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451)

    * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452)

    * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455)

    * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456)

    * mariadb: incorrect key in dup value error after long unique (CVE-2022-27457)

    * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458)

    * mariadb: improper locking in ds_compress.cc (CVE-2022-31622)

    * mariadb: improper locking in ds_compress.cc (CVE-2022-31623)

    * mariadb: crash at init_expr_cache_tracker (CVE-2022-32083)

    * mariadb: crash in cleanup/Item::cleanup_processor (CVE-2022-32085)

    * mariadb: crash in fix_outer_field for INSERT SELECT (CVE-2022-32086)

    * mariadb: crash in Item_args::walk_args (CVE-2022-32087)

    * mariadb: segmentation fault in get_loops/report_use/filesort (CVE-2022-32088)

    * mariadb: crash executing query with VIEW, aggregate and subquery (CVE-2021-46659)

    * mariadb: crash via an unused common table expression (CTE) (CVE-2021-46661)

    * mariadb: ha_maria::extra crash via certain SELECT statements (CVE-2021-46663)

    * mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664)

    * mariadb: sql_parse.cc crash because of used_tables expectations (CVE-2021-46665)

    * mariadb: application crash via long SELECT DISTINCT statements (CVE-2021-46668)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Don't use less parallelism if not necessary (BZ#2101776)

    * [Tracker] Rebase to Galera 26.4.11 (BZ#2101783)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5736 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8).
    (BZ#2084779)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    * OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previous Red Hat builds of OpenJDK 17 altered the arguments passed to     sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an     additional form of the method, retaining the original arguments, so that applications which depend on this     internal method continue to function with Red Hat builds of OpenJDK. (BZ#2099919)

    * With previous Red Hat builds of OpenJDK 17, Mac key generation and import would fail due to the lack of     the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration.
    (BZ#2105395)

    * With the release of Red Hat Enterprise Linux 8.6, a change was made so that disabling OpenJDK FIPS mode     required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.redhat.fips=false     options, with the intention that FIPS mode could be controlled independently of system security     properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is     required to disable FIPS mode, as in Red Hat Enterprise Linux 8.4. (BZ#2107941)

    * Previous Red Hat builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a     lack of module access permissions. This has now been corrected. (BZ#2107943)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5726 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8).
    (BZ#2084650)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    * OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previous Red Hat builds of OpenJDK 17 altered the arguments passed to     sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an     additional form of the method, retaining the original arguments, so that applications which depend on this     internal method continue to function with Red Hat builds of OpenJDK. (BZ#2099913)

    * With previous Red Hat builds of OpenJDK 17, Mac key generation and import would fail due to the lack of     the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration.
    (BZ#2108190)

    * With the release of Red Hat Enterprise Linux 8.6, a change was made so that disabling OpenJDK FIPS mode     required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.redhat.fips=false     options, with the intention that FIPS mode could be controlled independently of system security     properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is     required to disable FIPS mode, as in Red Hat Enterprise Linux 8.4. (BZ#2108206)

    * Previous Red Hat builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a     lack of module access permissions. This has now been corrected. (BZ#2108209)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5720 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * grafana: OAuth account takeover (CVE-2022-31107)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:5718 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * grafana: OAuth account takeover (CVE-2022-31107)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5719 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * grafana: OAuth account takeover (CVE-2022-31107)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:5716 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * grafana: OAuth account takeover (CVE-2022-31107)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:5717 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for     Graphite, InfluxDB & OpenTSDB.

    Security Fix(es):

    * grafana: OAuth account takeover (CVE-2022-31107)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5709 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07).
    (BZ#2084776)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-9, openjdk-8] (BZ#2099916)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-9, openjdk-8]     (BZ#2107956)

    * Revert to disabling system security properties and FIPS mode support together [rhel-9, openjdk-8]     (BZ#2107958)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5698 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07).
    (BZ#2083257)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5697 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-8] (BZ#2099912)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-8]     (BZ#2108565)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-8]     (BZ#2108567)

    * Detect NSS at Runtime for FIPS detection [rhel-8, openjdk-11] (BZ#2108667)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5696 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07).
    (BZ#2084648)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-8] (BZ#2099911)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-8]     (BZ#2108564)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-8]     (BZ#2108566)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5700 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5701 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5695 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8).
    (BZ#2084777)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-9, openjdk-11]     (BZ#2099915)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-9, openjdk-11]     (BZ#2107866)

    * Revert to disabling system security properties and FIPS mode support together [rhel-9, openjdk-11]     (BZ#2107868)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5687 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8).
    (BZ#2083258)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5681 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-11]     (BZ#2099918)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-11]     (BZ#2108249)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-11]     (BZ#2108252)

    * Detect NSS at Runtime for FIPS detection [rhel-8, openjdk-17] (BZ#2108269)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5678 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.5.1), redhat-virtualization-host (4.5.1), redhat-virtualization-host-productimg (4.5.1). (BZ#2062192,     BZ#2070869, BZ#2094682)

    Security Fix(es):

    * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

    * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHV-H 4.4 SP1 Has been rebased on RHEL 8.6 Batch #1 (BZ#2070869)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5683 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8).
    (BZ#2084649)

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [rhel-8, openjdk-11]     (BZ#2099917)

    * Revert to disabling system security properties and FIPS mode support together [rhel-8, openjdk-11]     (BZ#2108248)

    * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [rhel-8, openjdk-11]     (BZ#2108251)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5685 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5684 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169)

    * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540)

    * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5622 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ubi9-beta/ubi-minimal has a broken microdnf (g_system_thread_new fatal error) (BZ#2095808)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5620 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: sending crafted message could result in DoS (CVE-2022-0918)

    * 389-ds-base: expired password was still allowed to access the database (CVE-2022-0996)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5640 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5641 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5648 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5626 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    * kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

    * kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

    * kernel: the copy-on-write implementation can grant unintended write access because of a race condition     in a THP mapcount check (CVE-2020-29368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Failed to reboot after crash trigger (BZ#2060747)

    * conntrack entries linger around after test (BZ#2066357)

    * Enable nested virtualization (BZ#2079070)

    * slub corruption during  LPM of hnv interface (BZ#2081251)

    * sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35 (BZ#2082091)

    * Backport request of genirq: use rcu in kstat_irqs_usr() (BZ#2083309)

    * ethtool -L may cause system to hang (BZ#2083323)

    * For isolated CPUs (with nohz_full enabled for isolated CPUs) CPU utilization statistics are not getting     reflected continuously (BZ#2084139)

    * Affinity broken due to vector space exhaustion (BZ#2084647)

    * kernel memory leak while freeing nested actions (BZ#2086597)

    * sync rhel-8.6 with upstream 5.13 through 5.16 fixes and improvements (BZ#2088037)

    * Kernel panic possibly when cleaning namespace on pod deletion (BZ#2089539)

    * Softirq hrtimers are being placed on the per-CPU softirq clocks on isolcpus. (BZ#2090485)

    * fix missed wake-ups in rq_qos_throttle try two (BZ#2092076)

    * NFS4 client experiencing IO outages while sending duplicate SYNs and erroneous RSTs during connection     reestablishment (BZ#2094334)

    * using __this_cpu_read() in preemptible [00000000] code: kworker/u66:1/937154 (BZ#2095775)

    * Need some changes in RHEL8.x kernels. (BZ#2096932)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5633 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    * kernel: cgroup: Use open-time creds and namespace for migration perm checks (CVE-2021-4197)

    * kernel: Race condition in races in sk_peer_pid and sk_peer_cred accesses (CVE-2021-4203)

    * kernel: the copy-on-write implementation can grant unintended write access because of a race condition     in a THP mapcount check (CVE-2020-29368)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.4.z10 source tree (BZ#2087922)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5636 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport request of genirq: use rcu in kstat_irqs_usr() (BZ#2083311)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5597 advisory.

    Pandoc is a markdown/markup conversion tool. The version of pandoc in RHEL 8 CRB uses cmark-gfm (GitHub's     extended version of the C reference implementation of CommonMark) for parts of its conversion. The update,     fixes CVE-2022-24724: an integer overflow in cmark-gfm's table row parsing which may lead to heap memory     corruption when parsing tables with more than UINT16_MAX columns.

    Security Fix(es):

    * cmark-gfm: possible RCE due to integer overflow (CVE-2022-24724)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
163697	RHEL 7 : kernel (RHSA-2022:5805)	high
163696	RHEL 7 : kernel (RHSA-2022:5806)	high
163695	RHEL 7 : kernel (RHSA-2022:5802)	high
163694	RHEL 8 : java-1.8.0-ibm (RHSA-2022:5837)	medium
163693	RHEL 8 : kernel-rt (RHSA-2022:5834)	high
163678	RHEL 8 : firefox (RHSA-2022:5777)	high
163676	RHEL 9 : go-toolset and golang (RHSA-2022:5799)	medium
163673	RHEL 9 : thunderbird (RHSA-2022:5778)	high
163672	RHEL 8 : go-toolset:rhel8 (RHSA-2022:5775)	medium
163671	RHEL 8 : thunderbird (RHSA-2022:5774)	high
163670	RHEL 8 : thunderbird (RHSA-2022:5771)	high
163669	RHEL 7 : thunderbird (RHSA-2022:5773)	high
163667	RHEL 8 : firefox (RHSA-2022:5769)	high
163666	RHEL 8 : thunderbird (RHSA-2022:5772)	high
163665	RHEL 8 : ruby:2.5 (RHSA-2022:5779)	high
163664	RHEL 7 : firefox (RHSA-2022:5776)	high
163655	RHEL 8 : firefox (RHSA-2022:5765)	high
163654	RHEL 9 : firefox (RHSA-2022:5767)	high
163653	RHEL 8 : thunderbird (RHSA-2022:5770)	high
163652	RHEL 8 : firefox (RHSA-2022:5766)	high
163524	RHEL 7 : rh-mariadb105-galera and rh-mariadb105-mariadb (RHSA-2022:5759)	high
163503	RHEL 9 : java-17-openjdk (RHSA-2022:5736)	high
163472	RHEL 8 : java-17-openjdk (RHSA-2022:5726)	high
163466	RHEL 8 : grafana (RHSA-2022:5720)	high
163465	RHEL 8 : grafana (RHSA-2022:5718)	high
163464	RHEL 8 : grafana (RHSA-2022:5719)	high
163463	RHEL 9 : grafana (RHSA-2022:5716)	high
163462	RHEL 8 : grafana (RHSA-2022:5717)	high
163452	RHEL 9 : java-1.8.0-openjdk (RHSA-2022:5709)	high
163446	RHEL 7 : java-1.8.0-openjdk (RHSA-2022:5698)	high
163445	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5697)	high
163444	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5696)	high
163443	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5700)	high
163439	RHEL 8 : java-1.8.0-openjdk (RHSA-2022:5701)	high
163438	RHEL 9 : java-11-openjdk (RHSA-2022:5695)	high
163393	RHEL 7 : java-11-openjdk (RHSA-2022:5687)	high
163340	RHEL 8 : java-11-openjdk (RHSA-2022:5681)	high
163339	RHEL 8 : Red Hat Virtualization security, update [ovirt-4.5.1] (Important) (RHSA-2022:5678)	high
163338	RHEL 8 : java-11-openjdk (RHSA-2022:5683)	high
163337	RHEL 8 : java-11-openjdk (RHSA-2022:5685)	high
163336	RHEL 8 : java-11-openjdk (RHSA-2022:5684)	high
163303	RHEL 8 : container-tools:rhel8 (RHSA-2022:5622)	high
163300	RHEL 8 : 389-ds:1.4 (RHSA-2022:5620)	medium
163297	RHEL 6 : kernel (RHSA-2022:5640)	high
163296	RHEL 8 : kpatch-patch (RHSA-2022:5641)	high
163295	RHEL 8 : kpatch-patch (RHSA-2022:5648)	high
163291	RHEL 8 : kernel (RHSA-2022:5626)	high
163290	RHEL 8 : kernel-rt (RHSA-2022:5633)	high
163284	RHEL 8 : kernel (RHSA-2022:5636)	high
163269	RHEL 8 : pandoc (RHSA-2022:5597)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

medium

high

high

medium

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

critical