The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2430 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: NULL pointer dereference due to KEYCTL_READ on negative key (CVE-2017-12192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register     Buffer Data Sampling (SRBDS) (BZ#1827185)

    * Bonding not failing over in mode=1 under 2.6.32-754.28.1 (...27.1 works OK) (BZ#1828604)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2427 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body (CVE-2020-12657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register     Buffer Data Sampling (SRBDS) (BZ#1827191)

    * ipsec interfaces: fix sending with bpf_redirect() / AF_PACKET sockets (BZ#1821375)

    * IB/core: deadlock on rdma_nl_mutex when netlink triggers on-demand modprobe rdma_cm (BZ#1821381)

    * dm: fix excessive bio splitting that results in performance regressions (BZ#1821382)

    * system time jumps when hotplug vcpu on a long uptime guest (BZ#1822498)

    * [DELL 8.2 BUG]Ethernet : e1000e doesn't work after S2I (BZ#1825262)

    * NFSv3 sec=krb5p fails against an ONTAP server (BZ#1826219)

    * Stand-alone CPU Linpack test reports bad residual on HPC Cluster node(s) while running RHEL 8     (BZ#1827619)

    * [DELL 8.2 BUG]bluetooth Scanning  block S3 and  Suspend to idle (BZ#1827620)

    * RHEL8.2 Beta - SMC-R connection with vlan-id fails (BZ#1827631)

    * RHEL8.1 - RHEL8.1 kernel 4.18.0-147.3.1.el8.bz181950_test001.ppc64le+debug failed during LPM test     (p8/p9):idahop08:LPM (vtpm) (BZ#1827632)

    * missing version.h dependency for modpost may cause build to fail (BZ#1828229)

    * efi: kernel panic during ltp fs test - read_all -d /sys -q -r 10 (BZ#1829527)

    * Let isolcpus= skip unknown sub-parameters (BZ#1832367)

    * RHEL8.0 - Very bad performance with small blocks in FC-IO found by SAP HANA on POWER tests on RHEL8.0     (compared to RHEL7.4) (BZ#1834517)

    * [FJ8.2 Bug]: [REG] NFS-client panic at nfs4_get_valid_delegation+0x1c/0x40 [nfsv4] (BZ#1837969)

    * [RHEL-8.3] upstream bonding driver refresh (BZ#1838477)

    * Enable xt_u32 module (BZ#1840799)

    * Move xt_u32 module to kernel-modules-extra (BZ#1840800)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2450 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address a security vulnerability are now available. The updated versions     are .NET Core SDK 3.1.105 and .NET Core Runtime 3.1.5.

    Security Fixes:

    * dotnet: Denial of service via untrusted input (CVE-2020-1108)

    This is an additional update to comprehensively address CVE-2020-1108.

    Default inclusions for applications built with .NET Core have been updated to reference the newest     versions and their security fixes.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2431 advisory.

    Security Fix(es):

    * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

    * hw: L1D Cache Eviction Sampling (CVE-2020-0549)

    * hw: Vector Register Data Sampling (CVE-2020-0548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es) and Enhancement(s):

    * Update Intel CPU microcode to microcode-20200602 release, addresses:
      - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f         up to 0x621;
      - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718         up to 0x71a;
      - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
      - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e         up to 0x2f;
      - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25         up to 0x26;
      - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
      - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21         up to 0x22;
      - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6         up to 0xdc;
      - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151         up to 0x1000157;
      - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode         (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065         up to 0x2006906;
      - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c         up to 0x4002f01;
      - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c         up to 0x5002f01;
      - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6         up to 0xdc;
      - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46         up to 0x78;
      - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode         from revision 0xca up to 0xd6;
      - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision         0xca up to 0xd6;
      - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
      - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.
       - Change the URL to point to the GitHub repository since the microcode download section at Intel     Download Center does not exist anymore.

    * Narrow down SKL-SP/W/X blacklist to exclude Server/FPGA/Fabric segment       models.

    * Re-generate initramfs not only for the currently running kernel,       but for several recently installed kernels as well.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2429 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    * Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation     (CVE-2020-11884)

    * kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body (CVE-2020-12657)

    * kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register     Buffer Data Sampling (SRBDS) (BZ#1840684)

    * missing version.h dependency for modpost may cause build to fail (BZ#1828227)

    * efi: kernel panic during ltp fs test - read_all -d /sys -q -r 10 (BZ#1829525)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2428 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: use-after-free in block/bfq-iosched.c related to bfq_idle_slice_timer_body (CVE-2020-12657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register     Buffer Data Sampling (SRBDS) (BZ#1827193)

    * kernel-rt: update RT source tree to the RHEL-8.2.z1 source tree (BZ#1816271)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2433 advisory.

    The microcode_ctl packages provide microcode updates for Intel and AMD processors.

    Security Fix(es):

    * hw: Special Register Buffer Data Sampling (SRBDS) (CVE-2020-0543)

    * hw: L1D Cache Eviction Sampling (CVE-2020-0549)

    * hw: Vector Register Data Sampling (CVE-2020-0548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es) and Enhancement(s):

    * Update Intel CPU microcode to microcode-20200602 release, addresses:
      - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
      - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e         up to 0x2f;
      - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25         up to 0x26;
      - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
      - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21         up to 0x22;
      - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6         up to 0xdc;
      - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151         up to 0x1000157;
      - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode         (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065         up to 0x2006906;
      - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c         up to 0x4002f01;
      - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c         up to 0x5002f01;
      - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6         up to 0xdc;
      - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode         from revision 0xca up to 0xd6;
      - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision         0xca up to 0xd6;
      - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
      - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca         up to 0xd6;
      - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.

    * Update Intel CPU microcode to microcode-20200520 release:
      - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f         up to 0x621;
      - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718         up to 0x71a;
      - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46         up to 0x78.

    (BZ#1839193)

    * Narrow down SKL-SP/W/X blacklist to exclude Server/FPGA/Fabric segment       models. (BZ#1835555)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1406 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.7.0 ESR.

    Security Fix(es):

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)

    * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)

    * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1404 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.7.0 ESR.

    Security Fix(es):

    * Mozilla: Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)

    * Mozilla: Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)

    * Mozilla: Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1403 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6] (BZ#1791680)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2417 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2419 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: amplification of an incoming query into a large number of queries directed to a target     (CVE-2020-12662)

    * unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2416 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: amplification of an incoming query into a large number of queries directed to a target     (CVE-2020-12662)

    * unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2415 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2418 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: amplification of an incoming query into a large number of queries directed to a target     (CVE-2020-12662)

    * unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2414 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * unbound: amplification of an incoming query into a large number of queries directed to a target     (CVE-2020-12662)

    * unbound: infinite loop via malformed DNS answers received from upstream servers (CVE-2020-12663)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2405 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2407 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2404 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

    * bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2406 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in crypto_rsa_common in libfreerdp/crypto/crypto.c (CVE-2020-13398)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2381 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.9.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)

    * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)

    * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2344 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

    * bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2383 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

    * bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2379 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.9.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)

    * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)

    * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2380 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.9.0 ESR.

    Security Fix(es):

    * Mozilla: Use-after-free in SharedWorkerService (CVE-2020-12405)

    * Mozilla: JavaScript Type confusion with NativeTypes (CVE-2020-12406)

    * Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9 (CVE-2020-12410)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2362 advisory.

    Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for     installation into an on-premise OpenShift Container Platform installation.

    Security Fix(es):

    * nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties     (CVE-2019-10744)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2345 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND does not sufficiently limit the number of fetches performed when processing referrals     (CVE-2020-8616)

    * bind: A logic error in code which checks TSIG validity can be used to trigger an assertion failure in     tsig.c (CVE-2020-8617)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2277 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2285 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2289 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

    * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in     drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Observed a memory leak while using dm-multipath (BZ#1812935)

    * Backport: Guest microcode version mismatch on secondary processors (BZ#1814001)

    * dm-multipath high load backport incorrect (BZ#1814533)

    * ixgbe reports Detected Tx Unit Hang with adapter reset on RHEL 7 (BZ#1816990)

    * RHEL7: block mq hang of a blk_mq_freeze_queue_wait(),  which waits for a zero of a q_usage_counter,     which never happens (BZ#1824543)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2354 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

    * freerdp: Integer overflow in region.c (CVE-2020-11523)

    * freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2218 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * containers/image: Container images were reading the entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2217 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * jquery: Cross-site scripting was present due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2336 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

    * freerdp: Integer overflow in region.c (CVE-2020-11523)

    * freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2335 advisory.

    FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

    Security Fix(es):

    * freerdp: Out-of-bounds write in planar.c (CVE-2020-11521)

    * freerdp: Integer overflow in region.c (CVE-2020-11523)

    * freerdp: Out-of-bounds write in interleaved.c (CVE-2020-11524)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2298 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * OVS causing high pings and latency inside guest VM when an active DPDK port fails (BZ#1822198)

    * SEGV after recirculation in batch processing in vswitchd 2.9.0 (BZ#1826886)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2297 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [RHEL8] Update OVS 2.11 to last branch-2.11 commit and DPDK 18.11.7 (BZ#1822654)

    * [RHEL8] ingress qdisc gets removed (BZ#1826827)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2286 advisory.

    The ipmitool packages contain a command-line utility for interfacing with devices that support the     Intelligent Platform Management Interface (IPMI) specification. IPMI is an open standard for machine     health, inventory, and remote power control.

    Security Fix(es):

    * ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c (CVE-2020-5208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2295 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * dpdk: librte_vhost Malicious guest could cause segfault by sending invalid Virtio descriptor     (CVE-2020-10725)

    * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

    * dpdk: librte_vhost VHOST_USER_GET_INFLIGHT_FD message flooding to result in a DoS (CVE-2020-10726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * DPDK virtio_user lack of notifications make vhost_net+napi stops tx buffers (BZ#1803082)

    * Update internal DPDK to 19.11.1 (BZ#1824825)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2296 advisory.

    Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote     per-flow control of traffic.

    Security Fix(es):

    * dpdk: librte_vhost Interger overflow in vhost_user_set_log_base() (CVE-2020-10722)

    * dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair() (CVE-2020-10723)

    * dpdk: librte_vhost Missing inputs validation in Vhost-crypto (CVE-2020-10724)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [RHEL7] Update OVS 2.11 to last branch-2.11 commit and DPDK 18.11.7 (BZ#1822653)

    * [RHEL7] ingress qdisc gets removed (BZ#1826826)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2250 advisory.

    .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several     new APIs, and it includes a CLR implementation.

    New versions of .NET Core that address security vulnerabilities are now available. The updated versions     are .NET Core SDK 3.1.104 and .NET Core Runtime 3.1.4.

    Security Fixes:

    * dotnet: Denial of service via untrusted input (CVE-2020-1108)
    * dotnet: Denial of service due to infinite loop (CVE-2020-1161)

    Default inclusions for applications built with .NET Core have been updated to reference the newest     versions and their security fixes.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2239 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP10.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2236 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP65.

    Security Fix(es):

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2241 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP10.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2242 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * update the MRG 2.5.z 3.10 realtime-kernel sources (BZ#1823371)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2237 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR6-FP10.

    Security Fix(es):

    * OpenJDK: Improper handling of Kerberos proxy credentials (Kerberos, 8220302) (CVE-2019-2949)

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Misplaced regular expression syntax error check in RegExpScanner (Scripting, 8223898)     (CVE-2020-2754)

    * OpenJDK: Incorrect handling of empty string nodes in regular expression Parser (Scripting, 8223904)     (CVE-2020-2755)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2238 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR4-FP65.

    Security Fix(es):

    * OpenJDK: Incorrect bounds checks in NIO Buffers (Libraries, 8234841) (CVE-2020-2803)

    * OpenJDK: Incorrect type checks in MethodType.readObject() (Libraries, 8235274) (CVE-2020-2805)

    * OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037)     (CVE-2020-2654)

    * OpenJDK: Re-use of single TLS session for new connections (JSSE, 8234408) (CVE-2020-2781)

    * OpenJDK: CRLF injection into HTTP headers in HttpServer (Lightweight HTTP Server, 8234825)     (CVE-2020-2800)

    * OpenJDK: Regular expression DoS in Scanner (Concurrency, 8236201) (CVE-2020-2830)

    * OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization     (Serialization, 8224541) (CVE-2020-2756)

    * OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass (Serialization, 8224549)     (CVE-2020-2757)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2212 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    Security Fix(es):

    * ruby: HTTP response splitting in WEBrick (CVE-2017-17742)

    * ruby: Buffer under-read in String#unpack (CVE-2018-8778)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2199 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    * Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation     (CVE-2020-11884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [FJ8.1 Bug]: A system panic occurs when an I/O timeout occurs. (BZ#1787296)

    * [i40e]BUG: unable to handle kernel NULL pointer dereference at 0000000000000029 (BZ#1802483)

    * [OSP16] [offload] [mellanox] VF representors of 2nd nic of bond is NOT renamed as <PF>_<VFid>     (BZ#1802484)

    * The kernel crashes in nbd_check_sock_type() due to stack corruption if the socket address family is     AF_INET6. (BZ#1807605)

    * Hung kernel tasks with LPm16004B-L when fabric paths are returning (BZ#1807831)

    * bitops: protect variables in set_mask_bits() macro (kernel) (BZ#1809042)

    * [RHEL8] blktests block/007 test failed (BZ#1812806)

    * [RHEL8.2 Alpha] Server panics with NULL pointer dereference during boot in selinux_task_to_inode()     (BZ#1812807)

    * [RHEL8] Kernel panic on job cleanup, related to SyS_getdents64 (BZ#1812808)

    * [HPE 8.2 Bug] kernel ignores NMI from ilo (BZ#1816830)

    * [RHEL8.2][Azure]Commits to resolve high network latency (BZ#1817944)

    * cpu.share scheduling performance issue (BZ#1819908)

    * [RHEL8] Scheduler - backport asymetrical and misfit enhancements (BZ#1821370)

    * RHEL8.0 - powerpc/powernv: Enhance opal message read interface (BZ#1822205)

    * SCSI updates for 8.2 (BZ#1822252)

    Enhancement(s):

    * [RFE] Backport RCU dependecies for kernel-rt (rhel-rt-8.2.0) from stable (BZ#1826215)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2214 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
137305	RHEL 6 : kernel (RHSA-2020:2430)	medium
137278	RHEL 8 : kernel (RHSA-2020:2427)	high
137277	RHEL 8 : .NET Core 3.1 on Red Hat Enterprise Linux 8 (RHSA-2020:2450)	high
137276	RHEL 8 : microcode_ctl (RHSA-2020:2431)	medium
137275	RHEL 8 : kernel (RHSA-2020:2429)	high
137274	RHEL 8 : kernel-rt (RHSA-2020:2428)	high
137273	RHEL 6 : microcode_ctl (RHSA-2020:2433)	medium
137246	RHEL 8 : firefox (RHSA-2020:1406)	critical
137245	RHEL 8 : firefox (RHSA-2020:1404)	critical
137244	RHEL 6 : qemu-kvm (RHSA-2020:1403)	medium
137240	RHEL 8 : freerdp (RHSA-2020:2417)	high
137239	RHEL 8 : unbound (RHSA-2020:2419)	high
137238	RHEL 8 : unbound (RHSA-2020:2416)	high
137237	RHEL 8 : freerdp (RHSA-2020:2415)	high
137236	RHEL 8 : unbound (RHSA-2020:2418)	high
137204	RHEL 7 : unbound (RHSA-2020:2414)	high
137186	RHEL 7 : freerdp (RHSA-2020:2405)	high
137140	RHEL 8 : freerdp (RHSA-2020:2407)	high
137139	RHEL 8 : bind (RHSA-2020:2404)	high
137138	RHEL 6 : freerdp (RHSA-2020:2406)	high
137083	RHEL 7 : firefox (RHSA-2020:2381)	high
137082	RHEL 7 : bind (RHSA-2020:2344)	high
137070	RHEL 6 : bind (RHSA-2020:2383)	high
137069	RHEL 8 : firefox (RHSA-2020:2379)	high
137066	RHEL 8 : firefox (RHSA-2020:2380)	high
137064	RHEL 7 / 8 : Red Hat OpenShift Service Mesh (RHSA-2020:2362)	critical
137063	RHEL 8 : bind (RHSA-2020:2345)	high
137062	RHEL 7 : kernel (RHSA-2020:2277)	high
137061	RHEL 7 : kernel (RHSA-2020:2285)	high
137060	RHEL 7 : kernel (RHSA-2020:2289)	critical
137059	RHEL 8 : freerdp (RHSA-2020:2354)	medium
136977	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2218)	low
136976	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2217)	medium
136975	RHEL 8 : freerdp (RHSA-2020:2336)	medium
136974	RHEL 8 : freerdp (RHSA-2020:2335)	medium
136913	RHEL 7 : openvswitch (RHSA-2020:2298)	medium
136912	RHEL 8 : openvswitch2.11 (RHSA-2020:2297)	medium
136900	RHEL 7 : ipmitool (RHSA-2020:2286)	high
136899	RHEL 8 : openvswitch2.13 (RHSA-2020:2295)	medium
136898	RHEL 7 : openvswitch2.11 (RHSA-2020:2296)	medium
136820	RHEL 8 : dotnet3.1 (RHSA-2020:2250)	high
136740	RHEL 6 : java-1.8.0-ibm (RHSA-2020:2239)	high
136739	RHEL 6 : java-1.7.1-ibm (RHSA-2020:2236)	high
136738	RHEL 8 : java-1.8.0-ibm (RHSA-2020:2241)	high
136737	RHEL 6 : kernel-rt (RHSA-2020:2242)	high
136736	RHEL 7 : java-1.8.0-ibm (RHSA-2020:2237)	high
136735	RHEL 7 : java-1.7.1-ibm (RHSA-2020:2238)	high
136718	RHEL 7 : ruby (RHSA-2020:2212)	high
136717	RHEL 8 : kernel (RHSA-2020:2199)	high
136714	RHEL 7 : kernel (RHSA-2020:2214)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

medium

high

high

medium

high

high

medium

critical

critical

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

critical

medium

low

medium

medium

medium

medium

medium

high

medium

medium

high

high

high

high

high

high

high

high

high

high