The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7987 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.
    Security Fix(es):

    * python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers     (CVE-2024-1135)
    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
    * python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called     with a non-matching certificate and private key and an hmac_hash override (CVE-2024-26130)
    * python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and     AdminURLFieldWidget (CVE-2024-41991)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6673-3 advisory.

    USN-6673-1 provided a security update for python-cryptography. This update provides the corresponding     update for Ubuntu 24.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202407-06 (cryptography: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in cryptography. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0763-1 advisory.

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    Starting in version 38.0.0 and prior to version 42.0.4, if `pkcs12.serialize_key_and_certificates` is     called with both a certificate whose public key did not match the provided private key and an     `encryption_algorithm` with `hmac_hash` set (via     `PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)`, then a NULL pointer dereference would occur,     crashing the Python process. This has been resolved in version 42.0.4, the first version in which a     `ValueError` is properly raised. (CVE-2024-26130)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:1335 advisory.

    Red Hat Update Infrastructure (RHUI) provides a highly scalable and redundant framework for managing     repositories and content. It also allows cloud providers to deliver content and updates to Red Hat     Enterprise Linux (RHEL) instances.

    Security Fixes:
    * Cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a     non-matching certificate and private key and an hmac_hash override (CVE-2024-26130)

    * Gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers (CVE-2024-1135)

    * Aiohttp: aiohttp: XSS on index pages for static file handling (CVE-2024-27306)

    * Aiohttp: aiohttp: DoS when trying to parse malformed POST requests (CVE-2024-30251)

    * Sqlparse: sqlparse: parsing heavily nested list leads to denial of service (CVE-2024-4340)

    * Jinja2: jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)

    * Django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()     (CVE-2024-39614)

    * Django: Memory exhaustion in django.utils.numberformat.floatformat() (CVE-2024-41989)

    * Django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)

    * Django: Potential denial-of-service vulnerability in django.utils.html.urlize() (CVE-2024-41990)

    * Django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget     (CVE-2024-41991)

    * Grpcio: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the     backend (CVE-2024-7246)

    * Requests: subsequent requests to the same host ignore cert verification (CVE-2024-35195)

    For detailed information on other changes in this release, see the Red Hat Update Infrastructure Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (SciPy)). Supported versions that are affected are 7.0.0.0.0 and 7.6.0.0.0.     Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can     result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2023-29824)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security (OpenSSL)). Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0     and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via     TLS to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business     Intelligence Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition. (CVE-2024-5535)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server, Pipeline Test Failures, Installation (Spring Framework)). Supported versions     that are affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause     a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition.     (CVE-2024-38809)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2138-1 advisory.

    - CVE-2024-26130: Fix a NULL pointer dereference in pkcs12.serialize_key_and_certificates(). (bsc#1220210)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6673-1 advisory.

    Hubert Kario discovered that python-cryptography incorrectly handled

    errors returned by the OpenSSL API when processing incorrect padding in

    RSA PKCS#1 v1.5. A remote attacker could possibly use this issue to expose

    confidential or sensitive information. (CVE-2023-50782)

    It was discovered that python-cryptography incorrectly handled memory

    operations when processing mismatched PKCS#12 keys. A remote attacker could

    possibly use this issue to cause python-cryptography to crash, leading to a denial of service. This issue     only affected Ubuntu 23.10. (CVE-2024-26130)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Azure CycleCloud product is missing security updates. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability exists due to a disclosure of the storage credentials. An     authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands     with root privileges. (CVE-2024-38195)

  - A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt     captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or     sensitive data. (CVE-2023-50782)

  - A denial of service (DoS) vulnerability exists in python-cryptography due to the     pkcs12.serialize_key_and_certificates function. An unauthenticated, remote attacker can exploit this     issue, via specially crafted certificate, to cause the process to stop responding. (CVE-2024-26130)

  - A denial of service (DoS) vulnerability exists in ws, an open source WebSocket client and server for     Node.js, due to the handling of headers. An unauthenticated, remote attacker can exploit this issue, via     specially crafted request, to cause the application to stop responding. (CVE-2024-37890)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3781 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: aiohttp: DoS when trying to parse malformed POST requests (CVE-2024-30251)
    * automation-controller: Django: Potential regular expression denial-of-service in     django.utils.text.Truncator.words() (CVE-2024-27351)
    * automation-controller: pip: Mercurial configuration injectable in repo revision when installing via pip     (CVE-2023-5752)
    * automation-controller: pydantic: regular expression denial of service via crafted email string     (CVE-2024-3772)
    * automation-hub, python3/python39-galaxy-ng: follow-redirects: Possible credential leak (CVE-2024-28849)
    * python3/python39-aiohttp: DoS when trying to parse malformed POST requests (CVE-2024-30251)
    * python3/python39-aiohttp: XSS on index pages for static file handling (CVE-2024-27306)
    * python3/python39-black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file     (CVE-2024-21503)
    * python3/python39-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when     called with a non-matching certificate and private key and an hmac_hash override (CVE-2024-26130)
    * python3/python39-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)
    * python3/python39-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)
    * python3/python39-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding     headers (CVE-2024-1135)
    * python3/python39-idna: potential DoS via resource consumption via specially crafted inputs to     idna.encode() (CVE-2024-3651)
    * python3/python39-jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)
    * python3/python39-pillow: buffer overflow in _imagingcms.c (CVE-2024-28219)
    * python3/python39-pillow: Arbitrary Code Execution via the environment parameter (CVE-2023-50447)
    * python3/python39-pydantic: regular expression denial of service via crafted email string (CVE-2024-3772)
    * python3/python39-requests: subsequent requests to the same host ignore cert verification     (CVE-2024-35195)
    * python3/python39-social-auth-app-django: Improper Handling of Case Sensitivity in social-auth-app-django     (CVE-2024-32879)
    * python3/python39-sqlparse: parsing heavily nested list leads to denial of service (CVE-2024-4340)
    * receptor: golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm     (CVE-2024-24783)
    * receptor: golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS     (CVE-2023-45288)
    * receptor: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed Redis connection leak on version 4.5.6 (AAP-24286)
    * automation-controller has been updated to 4.5.7

    Updates and fixes for automation hub:
    * Fixed repository sync issues (AAH-3111, AAH-3218)
    * automation-hub/python3-galaxy-ng/python39-galaxy-ng have been updated to 4.9.2

    Additional changes:
    * ansible-core has been updated to 2.15.11
    * automation-eda-controller has been updated to 1.0.7
    * installer and setup have been updated to 2.4-7
    * receptor has been updated to 1.4.8

    For more details about the updates and fixes included in this release, refer to the Release Notes.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
208713	RHEL 8 : Satellite 6.15.4 Security Update (Moderate) (RHSA-2024:7987)	Nessus	Red Hat Local Security Checks	10/10/2024	10/10/2024	critical
197940	Ubuntu 24.04 LTS : python-cryptography vulnerability (USN-6673-3)	Nessus	Ubuntu Local Security Checks	5/27/2024	10/29/2024	high
201182	GLSA-202407-06 : cryptography: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	7/1/2024	7/1/2024	critical
191623	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-cryptography (SUSE-SU-2024:0763-1)	Nessus	SuSE Local Security Checks	3/6/2024	3/6/2024	high
216436	RHEL 8 : RHUI 4.11 (RHSA-2025:1335)	Nessus	Red Hat Local Security Checks	2/18/2025	2/18/2025	high
203581	Photon OS 5.0: Python3 PHSA-2024-5.0-0231	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	high
204308	Photon OS 4.0: Python3 PHSA-2024-4.0-0586	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
214600	Oracle Business Intelligence Enterprise Edition (OAS 7.0) (January 2025 CPU)	Nessus	Misc.	1/24/2025	1/27/2025	critical
200842	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-cryptography (SUSE-SU-2024:2138-1)	Nessus	SuSE Local Security Checks	6/22/2024	6/22/2024	high
191499	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : python-cryptography vulnerabilities (USN-6673-1)	Nessus	Ubuntu Local Security Checks	3/5/2024	8/27/2024	high
205459	Security Updates for Azure CycleCloud (August 2024)	Nessus	Web Servers	8/13/2024	8/16/2024	high
200272	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:3781)	Nessus	Red Hat Local Security Checks	6/10/2024	11/7/2024	high

Detections

Analytics

Plugins Search

critical

high

critical

high

high

high

high

critical

high

high

high

high