The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6834 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6832 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6833 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6831 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6820 advisory.

    Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and     expose MBeans of a JMX target.

    Security Fix(es):

    * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6815 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6783 advisory.

    Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.5.3 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin     (CVE-2022-2668)

    * keycloak: Stored XSS in groups dropdown (CVE-2022-0225)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6780 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6782 advisory.

    Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.5.3 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.5.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

    * wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security     enabled (CVE-2022-0866)

    * xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr (CVE-2022-0084)

    * netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)

    * keycloak-saml-core: keycloak: Uploading of SAML javascript protocol mapper scripts through the admin     (CVE-2022-2668)

    * keycloak: Stored XSS in groups dropdown (CVE-2022-0225)

    * h2: Remote Code Execution in Console (CVE-2021-42392)

    * keycloak-core: keycloak: improper input validation permits script injection (CVE-2022-2256)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6777 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6779 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6781 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate     unexpectedly (CVE-2022-3080)

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6774 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6778 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6775 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6776 advisory.

    Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data     objects.

    Security Fix(es):

    * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6764 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6763 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate     unexpectedly (CVE-2022-3080)

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6765 advisory.

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols.
    BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing     with DNS); and tools for verifying that the DNS server is operating correctly.

    Security Fix(es):

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6766 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    The following packages have been upgraded to a later upstream version: rh-python38-python (3.8.14).

    Security Fix(es):

    * python(mailcap): findmatch() function does not sanitise the second argument (CVE-2015-20107)

    * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading     to DoS (CVE-2020-10735)

    * python: an open redirection vulnerability in lib/http/server.py may lead to information disclosure     (CVE-2021-28861)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6750 advisory.

    Barbican is a ReST API designed for the secure storage, provisioning and     management of secrets, including in OpenStack environments.

    Security Fix(es):

    * openstack-barbican: access policy bypass via query string injection (CVE-2022-3100)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6755 advisory.

    IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software     Development Kit.

    This update upgrades IBM Java SE 7 to version 7R1 SR5-FP15.

    Security Fix(es):

    * OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6753 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943)

    * httpd: Request splitting via HTTP/2 method injection and mod_proxy (CVE-2021-33193)

    * httpd: NULL pointer dereference via malformed requests (CVE-2021-34798)

    * httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path (CVE-2021-36160)

    * httpd: Out-of-bounds write in ap_escape_quotes() via malicious input (CVE-2021-39275)

    * httpd: possible NULL dereference or SSRF in forward proxy configurations (CVE-2021-44224)

    * httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719)

    * httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721)

    * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377)

    * httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404)

    * httpd: mod_sed: DoS vulnerability (CVE-2022-30522)

    * httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813)

    * httpd: out-of-bounds read via ap_rwrite() (CVE-2022-28614)

    * httpd: out-of-bounds read in ap_strcmp_match() (CVE-2022-28615)

    * httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * proxy rewrite to unix socket fails with CVE-2021-40438 fix (BZ#2022319)

    Additional changes:

    * To fix CVE-2022-29404, the default value for the LimitRequestBody directive in the Apache HTTP Server     has been changed from 0 (unlimited) to 1 GiB.

    On systems where the value of LimitRequestBody is not explicitly specified in an httpd configuration     file, updating the httpd package sets LimitRequestBody to the default value of 1 GiB. As a consequence,     if the total size of the HTTP request body exceeds this 1 GiB default limit, httpd returns the 413 Request     Entity Too Large error code.

    If the new default allowed size of an HTTP request message body is insufficient for your use case, update     your httpd configuration files within the respective context (server, per-directory, per-file, or per-     location) and set your preferred limit in bytes. For example, to set a new 2 GiB limit, use:

    LimitRequestBody 2147483648

    Systems already configured to use any explicit value for the LimitRequestBody directive are unaffected     by this change.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6756 advisory.

    IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit.

    This update upgrades IBM Java SE 8 to version 8 SR7-FP15.

    Security Fix(es):

    * OpenJDK: Incomplete enforcement of JAR signing disabled algorithms (Libraries, 8249906) (CVE-2021-2163)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6741 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Posix ACL object is leaked in several places upon setattr and fsetxattr syscalls (BZ#2106586)

    * netfilter: backports from upstream (BZ#2120634)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6702 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6716 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6707 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6701 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6703 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6711 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6708 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6710 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6715 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6713 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6700 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 102.3.0 ESR.

    Security Fix(es):

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6717 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    This update upgrades Thunderbird to version 102.3.0.

    Security Fix(es):

    * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh     tag (CVE-2022-3033)

    * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)

    * Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)

    * Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)

    * Mozilla: Remote content specified in an HTML document that was nested inside an iframe's srcdoc     attribute was not blocked (CVE-2022-3032)

    * Mozilla: An iframe element in an HTML email could trigger a network request (CVE-2022-3034)

    * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2022-36059)

    * Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix     (CVE-2022-40958)

    * Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)

    * Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6551 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.5.2), redhat-virtualization-host (4.5.2), redhat-virtualization-host-productimg (4.5.2). (BZ#2070049,     BZ#2093195)

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    * systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526)

    * kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

    * rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6590 advisory.

    MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld)     and many client programs and libraries.

    The following packages have been upgraded to a later upstream version: mysql (8.0.30). (BZ#2122589)

    Security Fix(es):

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21412,     CVE-2022-21414, CVE-2022-21435, CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440,     CVE-2022-21452, CVE-2022-21459, CVE-2022-21462, CVE-2022-21478, CVE-2022-21479)

    * mysql: Server: DML unspecified vulnerability (CPU Apr 2022) (CVE-2022-21413)

    * mysql: Server: Replication unspecified vulnerability (CPU Apr 2022) (CVE-2022-21415)

    * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21417, CVE-2022-21418,     CVE-2022-21451, CVE-2022-21423)

    * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21425, CVE-2022-21444)

    * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427)

    * mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21454)

    * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022) (CVE-2022-21455)

    * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21457)

    * mysql: Server: Logging unspecified vulnerability (CPU Apr 2022) (CVE-2022-21460)

    * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21509,     CVE-2022-21525, CVE-2022-21526, CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530,     CVE-2022-21531, CVE-2022-21553, CVE-2022-21556, CVE-2022-21569)

    * mysql: Server: Options unspecified vulnerability (CPU Jul 2022) (CVE-2022-21515)

    * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21517, CVE-2022-21537,     CVE-2022-21539)

    * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21522,     CVE-2022-21534)

    * mysql: Server: Federated unspecified vulnerability (CPU Jul 2022) (CVE-2022-21547)

    * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022) (CVE-2022-21538)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Default logrotate set to wrong log file (BZ#2122592)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6602 advisory.

    The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures,     compliant with OpenPGP and S/MIME standards.

    Security Fix(es):

    * gpg: Signature spoofing via status line injection (CVE-2022-34903)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6595 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon     (2.0.19). (BZ#2124230, BZ#2124233)

    Security Fix(es):

    * nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788)

    * nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469)

    * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes     (CVE-2021-3807)

    * normalize-url: ReDoS for data URLs (CVE-2021-33502)

    * nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a     workspace (CVE-2022-29244)

    * nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212)

    * nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213)

    * nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214)

    * nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215)

    * got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2121019)

    * nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6592 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6634 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.36.7).

    Security Fix(es):

    * webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-32893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6585 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text     files and to perform system management tasks.

    The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428)

    Security Fix(es):

    * Ruby: Double free in Regexp compilation (CVE-2022-28738)

    * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6610 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918)

    * kernel: vulnerability of buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RDMA/mlx5: Fix number of allocated XLT entries (BZ#2092270)

    * mlx5, Setup hanged when run test-route-nexthop-object.sh (BZ#2092535)

    * many call traces from unchecked MSR access error: WRMSR to 0x199 in amazon i4.32xlarge instance     (BZ#2099417)

    * X86/platform/UV: Kernel Support Fixes for UV5 platform (BZ#2107732)

    * block layer: fixes for md sync slow and softlockup at blk_mq_sched_dispatch_requests [9.0.0.z]     (BZ#2111395)

    * Fixes for NVMe/TCP dereferences an invalid, non-canonical pointer, kernel panic (BZ#2117755)

    * Adding missing nvme fix to RHEL-9.1 (BZ#2117756)

    * nvme/tcp mistakenly uses blk_mq_tag_to_rq(nvme_tcp_tagset(queue) (BZ#2118698)

    * Important ice bug fixes (BZ#2119290)

    * Power 9/ppc64le Incorrect Socket(s) & Core(s) per socket reported by lscpu command. (BZ#2121719)

    Enhancement(s):

    * lscpu does not show all of the support AMX flags (amx_int8, amx_bf16)  (BZ#2108203)

    * ice: Driver Update (BZ#2108204)

    * iavf: Driver Update (BZ#2119477)

    * i40e: Driver Update (BZ#2119479)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6582 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918)

    * kernel: vulnerability of buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel-rt: update RT source tree to the latest RHEL-9.0.z3 Batch (BZ#2119577)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6608 advisory.

    dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to     provide high performance and reliability, while keeping compatibility to the D-Bus reference     implementation. It is exclusively written for Linux systems, and makes use of many modern features     provided by recent Linux kernel releases.

    Security Fix(es):

    * dbus-broker: a stack buffer over-read if a malicious Exec line is supplied (CVE-2022-31212)

    * dbus-broker: null pointer reference when supplying a malformed XML config file (CVE-2022-31213)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6541 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

    Security Fix(es):

    * Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked     (CVE-2020-28948)

    * Archive_Tar: improper filename sanitization leads to file overwrites (CVE-2020-28949)

    * Archive_Tar: directory traversal due to inadequate checking of symbolic links (CVE-2020-36193)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6540 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.36.7).

    Security Fix(es):

    * webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution     (CVE-2022-32893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6539 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.109 and .NET Runtime 6.0.9.

    Security Fix(es):

    * dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary     recursion. (CVE-2022-38013)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
165730	RHEL 7 : expat (RHSA-2022:6834)	high
165729	RHEL 8 : expat (RHSA-2022:6832)	high
165728	RHEL 8 : expat (RHSA-2022:6833)	high
165724	RHEL 8 : expat (RHSA-2022:6831)	high
165720	RHEL 8 : prometheus-jmx-exporter (RHSA-2022:6820)	high
165696	RHEL 7 : squid (RHSA-2022:6815)	high
165673	RHEL 8 : Red Hat Single Sign-On 7.5.3 security update on RHEL 8 (Moderate) (RHSA-2022:6783)	critical
165665	RHEL 8 : bind (RHSA-2022:6780)	high
165657	RHEL 7 : Red Hat Single Sign-On 7.5.3 security update on RHEL 7 (Moderate) (RHSA-2022:6782)	critical
165655	RHEL 8 : squid:4 (RHSA-2022:6777)	high
165652	RHEL 8 : bind (RHSA-2022:6779)	high
165649	RHEL 8 : bind9.16 (RHSA-2022:6781)	high
165646	RHEL 8 : squid:4 (RHSA-2022:6774)	high
165645	RHEL 8 : bind (RHSA-2022:6778)	high
165644	RHEL 8 : squid:4 (RHSA-2022:6775)	high
165643	RHEL 8 : squid:4 (RHSA-2022:6776)	high
165640	RHEL 8 : bind (RHSA-2022:6764)	high
165637	RHEL 9 : bind (RHSA-2022:6763)	high
165636	RHEL 7 : bind (RHSA-2022:6765)	high
165635	RHEL 7 : rh-python38-python (RHSA-2022:6766)	high
165628	RHEL 7 / 8 / 9 : Red Hat OpenStack Platform (openstack-barbican) (RHSA-2022:6750)	medium
165567	RHEL 7 : java-1.7.1-ibm (RHSA-2022:6755)	medium
165553	RHEL 7 : httpd24-httpd (RHSA-2022:6753)	critical
165552	RHEL 7 : java-1.8.0-ibm (RHSA-2022:6756)	high
165522	RHEL 7 : kernel (RHSA-2022:6741)	high
165475	RHEL 8 : firefox (RHSA-2022:6702)	high
165474	RHEL 8 : thunderbird (RHSA-2022:6716)	high
165473	RHEL 8 : firefox (RHSA-2022:6707)	high
165472	RHEL 8 : firefox (RHSA-2022:6701)	high
165471	RHEL 8 : firefox (RHSA-2022:6703)	high
165469	RHEL 7 : firefox (RHSA-2022:6711)	high
165468	RHEL 8 : thunderbird (RHSA-2022:6708)	high
165467	RHEL 7 : thunderbird (RHSA-2022:6710)	high
165464	RHEL 8 : thunderbird (RHSA-2022:6715)	high
165462	RHEL 8 : thunderbird (RHSA-2022:6713)	high
165460	RHEL 9 : firefox (RHSA-2022:6700)	high
165458	RHEL 9 : thunderbird (RHSA-2022:6717)	high
165429	RHEL 8 : Red Hat Virtualization (RHSA-2022:6551)	critical
165274	RHEL 9 : mysql (RHSA-2022:6590)	medium
165271	RHEL 9 : gnupg2 (RHSA-2022:6602)	medium
165270	RHEL 9 : nodejs and nodejs-nodemon (RHSA-2022:6595)	critical
165269	RHEL 9 : kpatch-patch (RHSA-2022:6592)	high
165268	RHEL 9 : webkit2gtk3 (RHSA-2022:6634)	high
165267	RHEL 9 : ruby (RHSA-2022:6585)	critical
165266	RHEL 9 : kernel (RHSA-2022:6610)	high
165264	RHEL 9 : kernel-rt (RHSA-2022:6582)	high
165263	RHEL 9 : dbus-broker (RHSA-2022:6608)	high
165236	RHEL 8 : php:7.4 (RHSA-2022:6541)	high
165195	RHEL 8 : webkit2gtk3 (RHSA-2022:6540)	high
165190	RHEL 8 : .NET 6.0 (RHSA-2022:6539)	high

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

medium

medium

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

medium

medium

critical

high

high

critical

high

high

high

high

high

high