The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4256 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * s390/qeth: cache link_info for ethtool (BZ#2174365)

    * RHEL8.4 - kernel: fix __clear_user() inline assembly constraints (BZ#2192605)

    * ice: ptp4l cpu usage spikes (BZ#2203288)

    * 40%~70% block performance regression for localfs backend write between kernel-4.18.0-235.el8.x86_64 and     kernel-4.18.0-277.el8.x86_64 (BZ#2204516)

    * Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst     (BZ#2208287)

    * simultaneous writes to a page on xfs can result in zero-byte data (BZ#2208413)

    * Windows Server 2019 guest randomly pauses with KVM: entry failed, hardware error 0x80000021     [rhel8.8GA] (BZ#2211662)

    * [Marvell 8.7 Bug] qedi shutdown handler hangs upon reboot (BZ#2215333)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4262 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4255 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-8.4z18 Batch (BZ#2209986)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4166 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) (BZ#2217708)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4233 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) (BZ#2217709)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4159 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct     classes.jsa files getting generated. This was because the CDS archive was being generated by a post script     action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the     checksum in the archive would be different on each system. This is resolved in this release by using the     .jsa files generated during the initial build. (RHBZ#2221655)

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [rhel-8] (BZ#2222368)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4178 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) [rhel-9] (BZ#2220662)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4158 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [rhel-9] (BZ#2223100)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4175 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found     that although the root cause of the crash is an old issue, a recent fix for a rare issue in the C2     compiler (JDK-8297951) made the crash much more likely. To mitigate this, the fix has been reverted in JDK     11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222493)

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [rhel-8] (BZ#2223101)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4177 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct     classes.jsa files getting generated. This was because the CDS archive was being generated by a post script     action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the     checksum in the archive would be different on each system. This is resolved in this release by using the     .jsa files generated during the initial build. (RHBZ#2221653)

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [rhel-9] (BZ#2222852)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4176 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) [rhel-8] (BZ#2219727)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4230 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c     (CVE-2022-42896)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4163 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix     for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the     fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222495)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4165 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix     for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the     fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222497)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4172 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4157 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4164 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix     for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the     fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222494)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4173 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4168 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4171 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4215 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4170 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4162 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A virtual machine crash was observed in JDK 11.0.19 when executing the GregorianCalender.computeTime()     method (JDK-8307683). It was found that although the root cause of the crash is an old issue, a recent fix     for a rare issue in the C2 compiler (JDK-8297951) made the crash much more likely. To mitigate this, the     fix has been reverted in JDK 11.0.20 and will be reapplied once JDK-8307683 is resolved. (RHBZ#2222496)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4169 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036)

    * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041)

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193)

    * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006)

    * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4174 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4167 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049)

    * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4202 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-32435)

    * webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2023-32439)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4203 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * python: urllib.parse url blocklisting bypass (CVE-2023-24329)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4201 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-32435)

    * webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2023-32439)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4138 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c     (CVE-2022-42896)

    * kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance     Events (CVE-2023-2235)

    * kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

    * kernel: use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z10 Batch (BZ#2209984)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4150 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update to the latest RHEL7.9.z24 source tree (BZ#2212577)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4145 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4154 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4130 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.4 - s390/smp,vdso: fix ASCE handling (BZ#2176464)

    * After powerstore LUNs are mapped,  OS crashed and host reboot. (BZ#2179068)

    * qla2xxx NVMe-FC:  WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70     qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2181529)

    * iscsi target deadlocks when the same host acts as an initiator to itself (i.e. connects via 127.0.0.1)     (BZ#2182095)

    * Dying percpu kworkers cause issues on isolated CPUs [rhel-8] (BZ#2189597)

    * Azure RHEL8: Live resize of disk does not trigger a rescan of the device capacity (BZ#2192345)

    * RHEL8.4 - kernel: fix __clear_user() inline assembly constraints (BZ#2192604)

    * RHEL8.6, lockd : oops on nlmsvc_mark_host (BZ#2196386)

    * xfs: deadlock in xfs_btree_split_worker (BZ#2196392)

    * Intel E810 card unable to create a MACVLAN on interface already configured as SRIOV (BZ#2203217)

    * ice: ptp4l cpu usage spikes (BZ#2203287)

    * Kernel - Significant performance drop for getrandom system call when FIPS is enabled (compared to RHEL     8.x for all x < 6.z) (BZ#2208130)

    * Azure RHEL8: CVM patch list requirement-storvsc patch (BZ#2208601)

    * BUG_ON kernel BUG at mm/rmap.c:1041! in __page_set_anon_rmap() when vma->anon_vma==NULL (BZ#2211661)

    * RHEL 8.6 opening console with mkvterm on novalink terminal fails due to drmgr reporting failure (L3:)     (BZ#2212374)

    * ESXi RHEL8: Haswell generation CPU are impacted with performance due to IBRS (BZ#2213367)

    * Hyper-V RHEL-8: Fix VM crash/hang Issues due to fast VF add/remove events (BZ#2216544)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4139 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: POST following PUT confusion (CVE-2022-32221)

    * curl: HTTP multi-header compression denial of service (CVE-2023-23916)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4128 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)

    * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4151 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * perf record -ag does not capture user space stack frames on s390x (BZ#2207745)

    * RHEL7.9 - kernel: handle new reply code FILTERED_BY_HYPERVISOR (BZ#2212672)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4125 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: remote DoS in TIPC kernel module (CVE-2023-1390)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.1 Snapshot3 - PVT:940:virt:4TB:LPM operation failed by returning HSCLA2CF, HSCL365C SRC's - Linux     partition suspend timeout (-> documentation/Linux Alert through LTC bug 182549) (BZ#2151218)

    * i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (BZ#2171382)

    * Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst     (BZ#2208288)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4153 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4146 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: remote DoS in TIPC kernel module (CVE-2023-1390)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4152 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4137 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c     (CVE-2022-42896)

    * kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance     Events (CVE-2023-2235)

    * kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM     (CVE-2022-1016)

    * kernel: use-after-free related to leaf anon_vma double reuse (CVE-2022-42703)

    * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002)

    * kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport kernel audit enhancements and fixes from v5.13-rc1 to v5.16-rc6 (BZ#2098210)

    * INTEL 9.0 BUG VROC: RAID rebuild doesn't start after removing drive during FIO (BZ#2174890)

    * HPEMC RHEL 9 BUG: acpi-cpufreq: Skip initializtion if a cpufreq driver exists (BZ#2186564)

    * RHEL9.3: Update locking code to upstream 6.1 and further fixes (BZ#2187517)

    * block layer: update with upstream v6.0 (BZ#2196175)

    * rhel-9: Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-     number.rst (BZ#2208244)

    * Trouble getting callstacks when signal has interrupted clock_gettime (BZ#2210076)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4126 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461)

    * kernel: tcindex: use-after-free vulnerability in traffic control index filter allows privilege     escalation (CVE-2023-1281)

    * kernel: remote DoS in TIPC kernel module (CVE-2023-1390)

    * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege     escalation (CVE-2023-32233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the RHEL-8.2.z27 source tree (BZ#2209127)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4124 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4103 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR8-FP5.

    Security Fix(es):

    * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930)

    * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939)

    * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967)

    * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937)

    * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938)

    * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4101 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * named-pkcs11 crashing into dns-pkcs11 library red-black tree [bind rhel-8.6.0.z] (BZ#2131784)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4099 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4102 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:4100 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4066 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.13.0.

    Security Fix(es):

    * Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201)

    * Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202)

    * Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13     (CVE-2023-37211)

    * Mozilla: Fullscreen notification obscured (CVE-2023-37207)

    * Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
178767	RHEL 8 : kernel (RHSA-2023:4256)	high
178766	RHEL 8 : kpatch-patch (RHSA-2023:4262)	high
178765	RHEL 8 : kernel-rt (RHSA-2023:4255)	high
178733	RHEL 7 : java-1.8.0-openjdk (RHSA-2023:4166)	low
178732	RHEL 7 : java-11-openjdk (RHSA-2023:4233)	medium
178682	RHEL 8 : java-17-openjdk (RHSA-2023:4159)	medium
178681	RHEL 9 : java-1.8.0-openjdk (RHSA-2023:4178)	low
178634	RHEL 9 : java-11-openjdk (RHSA-2023:4158)	medium
178633	RHEL 8 : java-11-openjdk (RHSA-2023:4175)	medium
178632	RHEL 9 : java-17-openjdk (RHSA-2023:4177)	medium
178631	RHEL 8 : java-1.8.0-openjdk (RHSA-2023:4176)	low
178630	RHEL 9 : kpatch-patch (RHSA-2023:4230)	high
178574	RHEL 8 : java-11-openjdk (RHSA-2023:4163)	medium
178573	RHEL 8 : java-11-openjdk (RHSA-2023:4165)	medium
178572	RHEL 8 : java-1.8.0-openjdk (RHSA-2023:4172)	low
178571	RHEL 9 : java-11-openjdk (RHSA-2023:4157)	medium
178570	RHEL 8 : java-11-openjdk (RHSA-2023:4164)	medium
178569	RHEL 8 : java-1.8.0-openjdk (RHSA-2023:4173)	low
178568	RHEL 8 : java-1.8.0-openjdk (RHSA-2023:4168)	low
178567	RHEL 8 : java-17-openjdk (RHSA-2023:4171)	medium
178566	RHEL 7 : kpatch-patch (RHSA-2023:4215)	high
178565	RHEL 8 : java-17-openjdk (RHSA-2023:4170)	medium
178564	RHEL 8 : java-11-openjdk (RHSA-2023:4162)	medium
178563	RHEL 9 : java-17-openjdk (RHSA-2023:4169)	medium
178562	RHEL 9 : java-1.8.0-openjdk (RHSA-2023:4174)	low
178561	RHEL 8 : java-1.8.0-openjdk (RHSA-2023:4167)	low
178440	RHEL 8 : webkit2gtk3 (RHSA-2023:4202)	high
178439	RHEL 9 : python3.9 (RHSA-2023:4203)	high
178438	RHEL 9 : webkit2gtk3 (RHSA-2023:4201)	high
178435	RHEL 9 : kernel-rt (RHSA-2023:4138)	critical
178434	RHEL 7 : kernel-rt (RHSA-2023:4150)	high
178433	RHEL 8 : kpatch-patch (RHSA-2023:4145)	high
178432	RHEL 8 : bind (RHSA-2023:4154)	high
178431	RHEL 8 : kernel (RHSA-2023:4130)	high
178430	RHEL 9 : curl (RHSA-2023:4139)	critical
178429	RHEL 8 : edk2 (RHSA-2023:4128)	critical
178428	RHEL 7 : kernel (RHSA-2023:4151)	high
178427	RHEL 8 : kernel (RHSA-2023:4125)	high
178426	RHEL 8 : bind (RHSA-2023:4153)	high
178425	RHEL 8 : kpatch-patch (RHSA-2023:4146)	high
178424	RHEL 7 : bind (RHSA-2023:4152)	high
178423	RHEL 9 : kernel (RHSA-2023:4137)	critical
178422	RHEL 8 : kernel-rt (RHSA-2023:4126)	high
178421	RHEL 8 : edk2 (RHSA-2023:4124)	critical
178336	RHEL 8 : java-1.8.0-ibm (RHSA-2023:4103)	critical
178335	RHEL 8 : bind (RHSA-2023:4101)	high
178334	RHEL 9 : bind (RHSA-2023:4099)	high
178333	RHEL 8 : bind (RHSA-2023:4102)	high
178332	RHEL 8 : bind9.16 (RHSA-2023:4100)	high
178274	RHEL 9 : thunderbird (RHSA-2023:4066)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

low

medium

medium

low

medium

medium

medium

low

high

medium

medium

low

medium

medium

low

low

medium

high

medium

medium

medium

low

low

high

high

high

critical

high

high

high

high

critical

critical

high

high

high

high

high

critical

high

critical

critical

high

high

high

high

high