The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1396 advisory.

    The podman tool manages Pods, container images, and containers. It is part of the libpod library, which is     for applications that use container Pods. Container Pods is a concept in Kubernetes.

    Security Fix(es):

    * buildah: a crafted input tar file could overwrite local files during the image build process     (CVE-2020-10696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1276 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * kubernetes: crafted requests to kubelet API allowed for memory exhaustion (CVE-2020-8551)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4174 advisory.

    MariaDB is a multi-user, multi-threaded SQL database server. For all practical purposes, MariaDB is     binary-compatible with MySQL.

    The following packages have been upgraded to a later upstream version: rh-mariadb102-mariadb (10.2.33),     rh-mariadb102-galera (25.3.29). (BZ#1880319, BZ#1880328)

    Security Fix(es):

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2019) (CVE-2019-2614)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2019) (CVE-2019-2627)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2019) (CVE-2019-2628)

    * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2019) (CVE-2019-2737)

    * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2019) (CVE-2019-2739)

    * mysql: Server: XML unspecified vulnerability (CPU Jul 2019) (CVE-2019-2740)

    * mysql: InnoDB unspecified vulnerability (CPU Jul 2019) (CVE-2019-2758)

    * mysql: Server: Parser unspecified vulnerability (CPU Jul 2019) (CVE-2019-2805)

    * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938)

    * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780)

    * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812)

    * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814)

    * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2922)

    * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249)

    * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0553 advisory.

    RabbitMQ is an implementation of AMQP, the emerging standard for high     performance enterprise messaging. The RabbitMQ server is a robust and     scalable implementation of an AMQP broker.

    Security Fix(es):

    * not properly sanitized user input may lead to XSS (CVE-2019-11291)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2895 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.2).

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0288 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.7.0 ESR.

    Security Fix(es):

    * Mozilla: libusrsctp library out of date (CVE-2022-46871)

    * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)

    * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)

    * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)

    * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)

    * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers     (CVE-2023-23602)

    * Mozilla: Fullscreen notification bypass (CVE-2022-46877)

    * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive     (CVE-2023-23603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0296 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.7.0 ESR.

    Security Fix(es):

    * Mozilla: libusrsctp library out of date (CVE-2022-46871)

    * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)

    * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)

    * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)

    * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)

    * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers     (CVE-2023-23602)

    * Mozilla: Fullscreen notification bypass (CVE-2022-46877)

    * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive     (CVE-2023-23603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0295 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.7.0 ESR.

    Security Fix(es):

    * Mozilla: libusrsctp library out of date (CVE-2022-46871)

    * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)

    * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)

    * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)

    * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)

    * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers     (CVE-2023-23602)

    * Mozilla: Fullscreen notification bypass (CVE-2022-46877)

    * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive     (CVE-2023-23603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0291 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:0284 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0195 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) (BZ#2150192)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:0292 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:0283 advisory.

    The sudo packages contain the sudo utility which allows system administrators to provide certain users     with the permission to execute privileged commands, which are used for system management purposes, without     having to log in as root.

    Security Fix(es):

    * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0285 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.7.0 ESR.

    Security Fix(es):

    * Mozilla: libusrsctp library out of date (CVE-2022-46871)

    * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598)

    * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605)

    * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599)

    * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601)

    * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers     (CVE-2023-23602)

    * Mozilla: Fullscreen notification bypass (CVE-2022-46877)

    * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive     (CVE-2023-23603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0198 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0190 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0192 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only     mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS     database.  This update allows more control over database use using two new properties - fips.nssdb.path     and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via     command-line arguments to the Java virtual machine (RHBZ#2147473)

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [rhel-8] (BZ#2153010)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0199 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0197 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0191 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only     mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS     database. This update allows more control over database use using two new properties - fips.nssdb.path and     fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-     line arguments to the Java virtual machine (BZ#2147475)

    * With previous Red Hat builds of OpenJDK 17, Mac key generation and import     would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of     the NSS FIPS configuration. (BZ#2108191)

    * NSS has offered a SQLite SecMod database for some time, and this has been available in RHEL as far back     as RHEL 6. With newer NSS versions removing the Berkeley DB one, this update switches the FIPS support     backed by NSS to use the SQLite backend (BZ#2023536)

    * [rpminspect] Disable Java bytecode checks [java-17-openjdk, rhel-8] (BZ#2109107)

    * Use the NSS SQL Database in FIPS Mode [rhel-8, openjdk-17] (BZ#2147479)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0196 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0200 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [rhel-8] (BZ#2157797)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0201 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0202 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [rhel-9] (BZ#2157798)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0193 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835)

    * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0187 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * hw: cpu: LFENCE/JMP Mitigation Update for CVE-2017-5715 (CVE-2021-26401)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0168 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0167 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0173 advisory.

    The libxml2 library is a development toolbox providing the implementation of various XML standards.

    Security Fix(es):

    * libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303)

    * libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0170 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0172 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0166 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0169 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0171 advisory.

    The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast     packet processing in the user space.

    Security Fix(es):

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0163 advisory.

    Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly     application runtime.

    This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.4.

    Security Fix(es):

    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0160 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version:
    rh-postgresql10-postgresql (10.23).

    Security Fix(es):

    * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh-postgresql10-postgresql: Update to the latest PostgreSQL version 10.23 (BZ#2157611)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0087 advisory.

    The USBGuard software framework provides system protection against intrusive USB devices by implementing     basic whitelisting and blacklisting capabilities based on device attributes. To enforce a user-defined     policy, USBGuard uses the Linux kernel USB device authorization feature.

    Security Fix(es):

    * usbguard: Fix unauthorized access via D-Bus (CVE-2019-25058)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0113 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0095 advisory.

    The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF)     files.

    Security Fix(es):

    * LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058)

    * libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519)

    * libtiff: uint32_t underflow leads to out of bounds read and write in tiffcrop.c (CVE-2022-2867)

    * libtiff: tiffcrop.c has uint32_t underflow which leads to out of bounds read and write in     extractContigSamples8bits() (CVE-2022-2869)

    * libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953)

    * libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520)

    * libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521)

    * libtiff: Invalid crop_width and/or crop_length could cause an out-of-bounds read in     reverseSamples16bits() (CVE-2022-2868)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0101 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL8.4 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127849)

    * vfio zero page mappings fail after 2M instances (BZ#2128515)

    * ice: Driver Update up to 5.19 (BZ#2130992)

    * atlantic: missing hybernate/resume fixes (BZ#2131935)

    * Bluefield 2 DPU would crash and reboot due to a kernel panic (BZ#2134084)

    * Fix issue that enables STABLE_WRITES by default and causes performance regressions (BZ#2135813)

    * ice: Intel E810 PTP clock glitching (BZ#2136036)

    * ice: configure link-down-on-close on and change interface mtu to 9000,the interface can't up     (BZ#2136216)

    * ice: dump additional CSRs for Tx hang debugging (BZ#2136513)

    * ice,iavf: system panic during sriov sriov_test_cntvf_reboot testing (BZ#2137270)

    * After upgrading to ocp4.11.1, our dpdk application using vlan strip offload is not working (BZ#2138157)

    * i40e: orphaned-leaky memory when interacting with driver memory parameters (BZ#2138205)

    * WARNING: CPU: 0 PID: 9637 at kernel/time/hrtimer.c:1309 hrtimer_start_range_ns+0x35d/0x400 (BZ#2138953)

    * DELL EMC 8.6-RT: System is not booting into RT Kernel with perc12. (BZ#2139216)

    * Lenovo 8.7: The VGA display shows no signal when install RHEL8.7 (BZ#2140152)

    * Host Pod -> NodePort Service traffic (Host Backend - Same Node) Flow Iperf Cannot Pass Traffic     (BZ#2141878)

    * mlx5_core: mlx5_cmd_check messages scrolling with hardware offload enabled (BZ#2141957)

    * net/ice: VIRTCHNL_OP_CONFIG_VSI_QUEUES command handling failure with in-tree driver (BZ#2142017)

    * RHEL:8.6+ IBM Partner issue - Loopback driver with ABORT_TASKS causing hangs in scsi eh, this bug was     cloned for RHEL8.6 and need this patch in 8.6+ (BZ#2144583)

    * AMdCLIENT 8.8: The kernel command line parameter nomodeset not working properly (BZ#2145218)

    * Path loss during Volume Ownership Change on RHEL 8.7 SAS (BZ#2147374)

    * net/ice: OP_SET_RSS_HENA command not supported with in-tree driver (BZ#2148130)

    * iavf panic: iavf 0000:ca:01.0: Failed to init adminq: -53 (BZ#2149081)

    * Intel 8.8 iavf: Driver Update (bugfixes) (BZ#2149742)

    * Azure RHEL-8 PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150912)

    * RHEL-8.7: System fails to boot with soft lockup while loading/unloading an unsigned (E) kernel module.
    (BZ#2152206)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0096 advisory.

    D-Bus is a system for sending messages between applications. It is used both for the system-wide message     bus service, and as a per-user-login-session messaging facility.

    Security Fix(es):

    * dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets     (CVE-2022-42010)

    * dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type     (CVE-2022-42011)

    * dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with foreign endianness correctly     (CVE-2022-42012)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0110 advisory.

    SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A     complete database is stored in a single disk file. The API is designed for convenience and ease of use.
    Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the     administrative hassles of supporting a separate database server.

    Security Fix(es):

    * sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API     (CVE-2022-35737)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0100 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: buffer overrun in format_timespan() function (CVE-2022-3821)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * ShutdownWatchdogSec value is not taken into account on reboot (BZ#2127170)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0128 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR7-FP20.

    Security Fix(es):

    * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)

    * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)

    * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)

    * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0116 advisory.

    A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T     recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690)     encoding and decoding functions.

    Security Fix(es):

    * libtasn1: Out-of-bound access in ETYPE_OK (CVE-2021-46848)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0089 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Macro URL arbitrary script execution (CVE-2022-3140)

    * libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation (CVE-2022-26305)

    * libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without     Knowing the Master Password (CVE-2022-26306)

    * libreoffice: Weak Master Keys (CVE-2022-26307)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:0123 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0099 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for     Linux on numerous hardware platforms. The virt:rhel module contains packages     which provide user-space components used to run virtual machines using KVM. The packages also provide APIs     for managing and interacting with the virtualized systems.

    Security Fix(es):

    * QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * libvirt kills virtual machine on restart when 2M and 1G hugepages are mounted (BZ#2132176)

    * VMs hung on vnc_clipboard_send (BZ#2148504)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0114 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964)

    * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The latest RHEL 8.7.z1 kernel changes need to be merged into the RT source tree to keep source parity     between the two kernels. (BZ#2137411)

    * [DELL EMC 8.6-RT BUG] System is not booting into RT Kernel with perc12. (BZ#2139867)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0103 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate (CVE-2022-43680)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
170288	RHEL 8 : OpenShift Container Platform 4.3.12 podman (RHSA-2020:1396)	high
170287	RHEL 7 / 8 : OpenShift Container Platform 4.3.10 openshift (RHSA-2020:1276)	medium
170286	RHEL 6 / 7 : rh-mariadb102-mariadb and rh-mariadb102-galera (RHSA-2020:4174)	high
170285	RHEL 8 : rabbitmq-server (RHSA-2020:0553)	medium
170284	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:2895)	high
170283	RHEL 8 : firefox (RHSA-2023:0288)	high
170282	RHEL 7 : firefox (RHSA-2023:0296)	high
170281	RHEL 8 : firefox (RHSA-2023:0295)	high
170279	RHEL 7 : sudo (RHSA-2023:0291)	high
170278	RHEL 8 : sudo (RHSA-2023:0284)	high
170277	RHEL 7 : java-11-openjdk (RHSA-2023:0195)	low
170276	RHEL 8 : sudo (RHSA-2023:0292)	high
170275	RHEL 8 : sudo (RHSA-2023:0283)	high
170274	RHEL 9 : firefox (RHSA-2023:0285)	high
170142	RHEL 8 : java-11-openjdk (RHSA-2023:0198)	low
170141	RHEL 8 : java-17-openjdk (RHSA-2023:0190)	low
170139	RHEL 8 : java-17-openjdk (RHSA-2023:0192)	low
170138	RHEL 8 : java-11-openjdk (RHSA-2023:0199)	low
170134	RHEL 8 : java-11-openjdk (RHSA-2023:0197)	low
170133	RHEL 8 : java-17-openjdk (RHSA-2023:0191)	low
170132	RHEL 8 : java-11-openjdk (RHSA-2023:0196)	low
170131	RHEL 8 : java-11-openjdk (RHSA-2023:0200)	low
170130	RHEL 9 : java-11-openjdk (RHSA-2023:0201)	low
170129	RHEL 9 : java-11-openjdk (RHSA-2023:0202)	low
170128	RHEL 9 : java-17-openjdk (RHSA-2023:0193)	low
170104	RHEL 6 : kernel (RHSA-2023:0187)	medium
170075	RHEL 8 : dpdk (RHSA-2023:0168)	high
170074	RHEL 7 : dpdk (RHSA-2023:0167)	high
170073	RHEL 8 : libxml2 (RHSA-2023:0173)	high
170072	RHEL 8 : dpdk (RHSA-2023:0170)	high
170071	RHEL 9 : dpdk (RHSA-2023:0172)	high
170070	RHEL 8 : dpdk (RHSA-2023:0166)	high
170069	RHEL 8 : dpdk (RHSA-2023:0169)	high
170068	RHEL 8 : dpdk (RHSA-2023:0171)	high
170027	RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4 (RHSA-2023:0163)	critical
169981	RHEL 7 : rh-postgresql10-postgresql (RHSA-2023:0160)	high
169973	RHEL 8 : usbguard (RHSA-2023:0087)	high
169971	RHEL 8 : postgresql:10 (RHSA-2023:0113)	high
169970	RHEL 8 : libtiff (RHSA-2023:0095)	medium
169969	RHEL 8 : kernel (RHSA-2023:0101)	high
169967	RHEL 8 : dbus (RHSA-2023:0096)	medium
169966	RHEL 8 : sqlite (RHSA-2023:0110)	high
169965	RHEL 8 : systemd (RHSA-2023:0100)	medium
169964	RHEL 8 : java-1.8.0-ibm (RHSA-2023:0128)	low
169963	RHEL 8 : libtasn1 (RHSA-2023:0116)	critical
169961	RHEL 8 : libreoffice (RHSA-2023:0089)	high
169960	RHEL 8 : kpatch-patch (RHSA-2023:0123)	high
169959	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:0099)	medium
169958	RHEL 8 : kernel-rt (RHSA-2023:0114)	high
169957	RHEL 8 : expat (RHSA-2023:0103)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

medium

high

medium

high

high

high

high

high

high

low

high

high

high

low

low

low

low

low

low

low

low

low

low

low

medium

high

high

high

high

high

high

high

high

critical

high

high

high

medium

high

medium

high

medium

low

critical

high

high

medium

high

high