The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7058 advisory.

    rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and     subscription management.

    Security Fix(es):

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7139 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190417)

    Security Fix(es):

    * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

    * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

    * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

    * samba: spotlight server-side share path disclosure (CVE-2023-34968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7109 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7042 advisory.

    Python is an interpreted, interactive, object-oriented programming language that supports modules,     classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a     stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and     PostgreSQL.

    Security Fix(es):

    * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7015 advisory.

    The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running     on a computer network.

    Security Fix(es):

    * wireshark: RTPS dissector crash (CVE-2023-0666)

    * wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856)

    * wireshark: NetScaler file parser crash (CVE-2023-2858)

    * wireshark: XRA dissector infinite loop (CVE-2023-2952)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7010 advisory.

    The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk,     network, and other I/O activity.

    Security Fix(es):

    * sysstat: check_overflow() function can work incorrectly that lead to an overflow (CVE-2023-33204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6944 advisory.

    The protobuf-c packages provide C bindings for Google's Protocol Buffers.

    Security Fix(es):

    * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6943 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6940 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

    * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6916 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7046 advisory.

    The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic     Host Configuration Protocol) server.

    Security Fix(es):

    * dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 (CVE-2023-28450)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7024 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: tarfile module directory traversal (CVE-2007-4559)

    * python: file path truncation at \0 characters (CVE-2023-41105)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7165 advisory.

    The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar     operating systems.

    Security Fix(es):

    * cups: heap buffer overflow may lead to DoS (CVE-2023-32324)

    * cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7090 advisory.

    GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another     application.

    Security Fix(es):

    * libmicrohttpd: remote DoS (CVE-2023-27371)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6886 advisory.

    The Plexus project provides a full software stack for creating and executing software projects. Based on     the Plexus container, the applications can utilise component-oriented programming to build modular,     reusable components that can easily be assembled and reused. The plexus-archiver component provides     functions to create and extract archives.

    Security Fix(es):

    * plexus-archiver: Arbitrary File Creation in AbstractUnArchiver (CVE-2023-37460)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6882 advisory.

    The squid34 packages provide version 3.4 of Squid, a high-performance proxy caching server for web     clients, supporting FTP, Gopher, and HTTP data objects. Note that apart from squid34, this version of     Red Hat Enterprise Linux also includes the squid packages which provide Squid version 3.1.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6883 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6885 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: TLS handshake bypass (CVE-2023-40217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6884 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6799 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6823 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: TLS handshake bypass (CVE-2023-40217)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6822 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6821 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL.

    Security Fix(es):

    * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6796 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6802 advisory.

    X.Org is an open-source implementation of the X Window System. It provides the basic low-level     functionality that full-fledged graphical user interfaces are designed upon.

    Security Fix(es):

    * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6798 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6811 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6793 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: rh-python38-python (3.8.18), rh-     python38-python-cryptography (2.8), rh-python38-python-pip (19.3.1), rh-python38-python-requests (2.22.0),     rh-python38-python-setuptools (41.6.0), rh-python38-python-wheel (0.33.6).

    Security Fix(es):

    * python: urllib.parse url blocklisting bypass (CVE-2023-24329)

    * python: TLS handshake bypass (CVE-2023-40217)

    * python: tarfile module directory traversal (CVE-2007-4559)

    * pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897)

    * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli     (CVE-2022-40898)

    * python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

    * python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

    * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6804 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6812 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Bug Fix(es) and Enhancement(s):

    * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6805 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6810 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6808 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6795 advisory.

    Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights-     client package can gather the required data (such as installed packages, running services, or software     configurations) to proactively identify threats to security, performance, and stability across your     environment.

    Security Fix(es):

    * insights-client: unsafe handling of temporary files and directories (CVE-2023-3972)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6801 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6813 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/sched: cls_u32 component reference counter leak if tcf_change_indev() fails (CVE-2023-3609)

    * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function     (CVE-2023-3776)

    * kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags (CVE-2023-3812)

    * kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head (CVE-2023-1095)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * netfilter: RHEL 8.8 phase 2 backports from upstream (BZ#2236820)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6803 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

    * squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6578 advisory.

    The libqb packages provide a library with the primary purpose of providing high performance client/server     reusable features, such as high performance logging, tracing, inter-process communication, and polling.

    Security Fix(es):

    * libqb: Buffer overflow in log_blackbox.c (CVE-2023-39976)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6738 advisory.

    The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025)

    * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 21.0.0     release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release,     21.0.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With     both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true.

    * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 20.0.0     release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some     JAR files. This release, 20.0.1, increases it to 16 MB. (RHEL-14954)

    * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many     threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel     transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages     into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a     guard page and prevent the creation of huge pages. (RHEL-14962)

    * Installing the same java-21-openjdk-headless package on two different systems resulted in distinct     classes.jsa files getting generated. This was because the CDS archive was being generated by a post script     action of the java-21-openjdk-headless package. This prevented the use of the dynamic dump feature,     because the checksum in the archive would be different on each system. This release resolves this issue by     using the .jsa files generated during the initial build. (RHEL-14946)

    * The /usr/bin/jfr alternative is now owned by the java-21-openjdk package. (RHEL-14959)

    * The jcmd tool is now provided by the java-21-openjdk-headless package, rather than java-21-openjdk-     devel, to make it more accessible. (RHEL-14948)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6712 advisory.

    Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427.

    Security Fix(es):

    * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli     (CVE-2022-40898)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6496 advisory.

    The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based     applications.

    Security Fix(es):

    * haproxy: data leak via fcgi requests (CVE-2023-0836)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6508 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Empty entry in Java class path (CVE-2022-38745)

    * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950)

    * libreoffice: Arbitrary file write (CVE-2023-1183)

    * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6569 advisory.

    The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk,     network, and other I/O activity.

    Security Fix(es):

    * sysstat: check_overflow() function can work incorrectly, which could lead to an overflow     (CVE-2023-33204)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6403 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    The following packages have been upgraded to a later upstream version: httpd (2.4.57). (BZ#2184403)

    Security Fix(es):

    * httpd: mod_proxy_uwsgi HTTP response splitting (CVE-2023-27522)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6409 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785)

    Security Fix(es):

    * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6705 advisory.

    The procps-ng packages contain a set of system utilities that provide system information, including ps,     free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx.

    Security Fix(es):

    * procps: ps buffer overflow (CVE-2023-4016)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6371 advisory.

    The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special     scripts to run during initialization to retrieve and install SSH keys, and to let the user run various     scripts.

    Security Fix(es):

    * cloud-init: sensitive data could be exposed in logs (CVE-2023-1786)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6587 advisory.

    The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on     cards that support cryptographic operations and enables their use for authentication, mail encryption, or     digital signatures.

    Security Fix(es):

    * opensc: buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package (CVE-2023-2977)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6593 advisory.

    The binutils packages provide a collection of binary utilities for the manipulation of object code in     various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf,     size, strings, strip, and addr2line utilities.

    Security Fix(es):

    * binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault     (CVE-2022-4285)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6744 advisory.

    Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common     Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and     various information.

    Security Fix(es):

    * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961)

    * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091)

    * samba: rpcecho development server allows denial of service via sleep() call on AD DC (CVE-2023-42669)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
185664	RHEL 8 : rhc (RHSA-2023:7058)	high
185663	RHEL 8 : samba (RHSA-2023:7139)	medium
185662	RHEL 8 : linux-firmware (RHSA-2023:7109)	medium
185661	RHEL 8 : python27:2.7 (RHSA-2023:7042)	critical
185660	RHEL 8 : wireshark (RHSA-2023:7015)	medium
185659	RHEL 8 : sysstat (RHSA-2023:7010)	high
185658	RHEL 8 : protobuf-c (RHSA-2023:6944)	medium
185657	RHEL 8 : cloud-init (RHSA-2023:6943)	medium
185656	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2023:6940)	medium
185655	RHEL 8 : xorg-x11-server (RHSA-2023:6916)	high
185654	RHEL 8 : dnsmasq (RHSA-2023:7046)	high
185652	RHEL 8 : python3.11 (RHSA-2023:7024)	high
185651	RHEL 8 : cups (RHSA-2023:7165)	high
185650	RHEL 8 : libmicrohttpd (RHSA-2023:7090)	medium
185498	RHEL 7 : plexus-archiver (RHSA-2023:6886)	critical
185495	RHEL 6 : squid34 (RHSA-2023:6882)	high
185494	RHEL 9 : galera and mariadb (RHSA-2023:6883)	high
185493	RHEL 7 : python (RHSA-2023:6885)	critical
185492	RHEL 6 : squid (RHSA-2023:6884)	high
185419	RHEL 8 : kpatch-patch (RHSA-2023:6799)	critical
185381	RHEL 7 : python3 (RHSA-2023:6823)	critical
185380	RHEL 8 : mariadb:10.5 (RHSA-2023:6822)	high
185379	RHEL 8 : mariadb:10.5 (RHSA-2023:6821)	high
185376	RHEL 9 : insights-client (RHSA-2023:6796)	high
185375	RHEL 7 : xorg-x11-server (RHSA-2023:6802)	high
185370	RHEL 8 : insights-client (RHSA-2023:6798)	high
185369	RHEL 8 : insights-client (RHSA-2023:6811)	high
185367	RHEL 7 : rh-python38-python (RHSA-2023:6793)	critical
185363	RHEL 8 : squid:4 (RHSA-2023:6804)	medium
185362	RHEL 8 : fence-agents (RHSA-2023:6812)	critical
185361	RHEL 7 : squid (RHSA-2023:6805)	high
185360	RHEL 8 : squid:4 (RHSA-2023:6810)	medium
185359	RHEL 8 : tigervnc (RHSA-2023:6808)	high
185358	RHEL 7 : insights-client (RHSA-2023:6795)	high
185357	RHEL 8 : squid:4 (RHSA-2023:6801)	medium
185356	RHEL 8 : kernel (RHSA-2023:6813)	critical
185355	RHEL 8 : squid:4 (RHSA-2023:6803)	medium
185159	RHEL 9 : libqb (RHSA-2023:6578)	critical
185158	RHEL 9 : java-21-openjdk (RHSA-2023:6738)	low
185157	RHEL 9 : python-wheel (RHSA-2023:6712)	high
185156	RHEL 9 : haproxy (RHSA-2023:6496)	high
185155	RHEL 9 : libreoffice (RHSA-2023:6508)	high
185154	RHEL 9 : sysstat (RHSA-2023:6569)	high
185153	RHEL 9 : httpd and mod_http2 (RHSA-2023:6403)	high
185152	RHEL 9 : libvirt (RHSA-2023:6409)	medium
185151	RHEL 9 : procps-ng (RHSA-2023:6705)	low
185150	RHEL 9 : cloud-init (RHSA-2023:6371)	medium
185149	RHEL 9 : opensc (RHSA-2023:6587)	high
185148	RHEL 9 : binutils (RHSA-2023:6593)	medium
185147	RHEL 9 : samba (RHSA-2023:6744)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

medium

medium

critical

medium

high

medium

medium

medium

high

high

high

high

medium

critical

high

high

critical

high

critical

critical

high

high

high

high

high

high

critical

medium

critical

high

medium

high

high

medium

critical

medium

critical

low

high

high

high

high

high

medium

low

medium

high

medium

critical