The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.5 / 15.1.4.1 / 15.1.5 / 16.1.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K40508224 advisory.

    Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)ImpactAn attacker may be able to exploit this vulnerability to cause a denial-     of-service (DoS) attack.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1678 advisory.

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20201105.1082. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.1082 advisory.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular     expression quantifiers have an integer overflow. (CVE-2020-10543)

  - regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of     recursive S_study_chunk calls. (CVE-2020-12723)

  - The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-     byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1425:04 advisory.

    * perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)
      * perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)
      * perl: corruption of intermediate language state of compiled regular expression due to recursive     S_study_chunk() calls leads to DoS (CVE-2020-12723)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.2 advisory.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

  - A flaw was found in the HDLC_PPP module of the Linux kernel in versions before 5.9-rc7. Memory corruption     and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause     the system to crash or cause a denial of service. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25643)

  - Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB     provides the ability to run arbitrary commands as root. (CVE-2020-15862)

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

  - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4     bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of     service. (CVE-2020-10769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory.

  - Vulnerability in the RDBMS Scheduler component of Oracle Database Server. Supported versions that are     affected are 12.1.0.2, 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows low privileged     attacker having Export Full Database privilege with network access via Oracle Net to compromise RDBMS     Scheduler. Successful attacks of this vulnerability can result in takeover of RDBMS Scheduler. (CVE-2021-2035)

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 18c and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human     interaction from a person other than the attacker and while the vulnerability is in Advanced Networking     Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can     result in takeover of Advanced Networking Option. Note: CVE-2021-2018 affects Windows platform only. (CVE-2021-2018)

  - Vulnerability in the RDBMS Sharding component of Oracle Database Server. Supported versions that are     affected are 12.2.0.1, 18c and 19c. Easily exploitable vulnerability allows high privileged attacker     having Create Any Procedure, Create Any View, Create Any Trigger privilege with network access via Oracle     Net to compromise RDBMS Sharding. Successful attacks of this vulnerability can result in takeover of RDBMS     Sharding. (CVE-2021-2054)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fixed CVE-2020-10543, CVE-2020-10878 and CVE-2020-12723

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - Perl before 5.30.3 on 33-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Perl before 5.30.3 on 32-bit platforms allows a     heap-based buffer overflow because nested regular     expression quantifiers have an integer     overflow.(CVE-2020-10543)

  - Perl before 5.30.3 has an integer overflow related to     mishandling of a 'PL_regkind[OP(n)] == NOTHING'     situation. A crafted regular expression could lead to     malformed bytecode with a possibility of instruction     injection.(CVE-2020-10878)

  - regcomp.c in Perl before 5.30.3 allows a buffer     overflow via a crafted regular expression because of     recursive S_study_chunk calls.(CVE-2020-12723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1678 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: heap-based buffer overflow in regular expression compiler leads to DoS (CVE-2020-10543)

    * perl: corruption of intermediate language state of compiled regular expression due to integer overflow     leads to DoS (CVE-2020-10878)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2023 CPU advisory.

  - Vulnerability in the Oracle Database - Machine Learning for Python (Python) component of Oracle Database     Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows low     privileged attacker having Database User privilege with network access via Oracle Net to compromise Oracle     Database - Machine Learning for Python (Python). Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Database -     Machine Learning for Python (Python). (CVE-2021-3737)

  - Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     RDBMS Security. Successful attacks require human interaction from a person other than the attacker.
    Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification     access to critical data or all Oracle Database RDBMS Security accessible data as well as unauthorized read     access to a subset of Oracle Database RDBMS Security accessible data. (CVE-2023-21829)

  - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are     19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create Procedure     privilege with network access via Oracle Net to compromise Java VM. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Java VM. (CVE-2022-39429)

  - Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. Supported     versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged     attacker having Create Session privilege with network access via Oracle Net to compromise Oracle Database     Data Redaction. Successful attacks of this vulnerability can result in unauthorized read access to a     subset of Oracle Database Data Redaction accessible data. (CVE-2023-21827)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Perl before 5.30.3 has an integer overflow related to mishandling of a PL_regkind[OP(n)] == NOTHING     situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction     injection. (CVE-2020-10878)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
157367	F5 Networks BIG-IP : Perl vulnerability (K40508224)	Nessus	F5 Networks Local Security Checks	2/3/2022	4/30/2026	high
157593	AlmaLinux 8 : perl (ALSA-2021:1678)	Nessus	Alma Linux Local Security Checks	2/9/2022	4/30/2026	high
164563	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.1082)	Nessus	Misc.	9/1/2022	2/17/2025	high
293885	MiracleLinux 7 : perl-5.16.3-299.el7 (AXSA:2021-1425:04)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/21/2026	high
164578	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.2)	Nessus	Misc.	9/1/2022	7/22/2025	high
145266	Oracle Database Server Multiple Vulnerabilities (Jan 2021 CPU)	Nessus	Databases	1/22/2021	11/29/2024	high
137437	Fedora 31 : 4:perl (2020-fd73c08076)	Nessus	Fedora Local Security Checks	6/17/2020	4/30/2026	high
140164	EulerOS 2.0 SP5 : perl (EulerOS-SA-2020-1943)	Nessus	Huawei Local Security Checks	9/2/2020	2/22/2024	high
140337	EulerOS Virtualization for ARM 64 3.0.2.0 : perl (EulerOS-SA-2020-1967)	Nessus	Huawei Local Security Checks	9/8/2020	2/21/2024	high
140852	EulerOS 2.0 SP3 : perl (EulerOS-SA-2020-2085)	Nessus	Huawei Local Security Checks	9/28/2020	2/19/2024	high
149678	RHEL 8 : perl (RHSA-2021:1678)	Nessus	Red Hat Local Security Checks	5/19/2021	4/30/2026	high
170191	Oracle Database Server for Unix (Jan 2023 CPU)	Nessus	Databases	1/20/2023	10/24/2023	high
223007	Linux Distros Unpatched Vulnerability : CVE-2020-10878	Nessus	Misc.	3/4/2025	7/24/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high