The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3145 advisory.

    [1.5.2-6.0.1.1]
    - Rebuild bumping release

    [1.5.2-6.1]
    - Resolves: #2196120 - CVE-2022-25147 apr-util: out-of-bounds writes       in the apr_base64

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of apr-util installed on the remote host is prior to 1.6.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-032-02 advisory.

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the apr-util  package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the apr-util package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility     (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable     Runtime Utility (APR-util) 1.6.1 and prior versions. (CVE-2022-25147)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the apr package has been released.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3354 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 Service Pack 2 serves as a     replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.51 Service Pack 1, and includes bug     fixes and enhancements, which are documented in the Release Notes document linked to in the References.

    Security Fix(es):

    * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147)
    * curl: HSTS bypass via IDN (CVE-2022-43551)
    * curl: HTTP Proxy deny use-after-free (CVE-2022-43552)
    * curl: HSTS ignored on multiple requests (CVE-2023-23914)
    * curl: HSTS amnesia with --parallel (CVE-2023-23915)
    * curl: HTTP multi-header compression denial of service (CVE-2023-23916)
    * curl: TELNET option IAC injection (CVE-2023-27533)
    * curl: SFTP path ~ resolving discrepancy (CVE-2023-27534)
    * httpd: mod_dav: out-of-bounds read/write of zero byte (CVE-2006-20001)
    * httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690)
    * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)
    * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)
    * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)
    * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.5.4 advisory.

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting     in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note     that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is     not enabled by default and must be explicitly configured. (CVE-2023-24998)

  - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting     methods by supplying a URL that starts with blank characters. (CVE-2023-24329)

  - A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations,     impacting the confidentiality and integrity of the guest virtual machine. (CVE-2023-20867)

  - A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if     a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response     which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the     previous request leading to an information leak. (CVE-2023-34981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
176135	Oracle Linux 7 : apr-util (ELSA-2023-3145)	Nessus	Oracle Linux Local Security Checks	5/19/2023	11/2/2024	medium
170931	Slackware Linux 15.0 / current apr-util Vulnerability (SSA:2023-032-02)	Nessus	Slackware Local Security Checks	2/1/2023	9/5/2023	medium
177942	EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2023-2283)	Nessus	Huawei Local Security Checks	7/4/2023	7/4/2023	medium
179009	EulerOS Virtualization 2.10.1 : apr-util (EulerOS-SA-2023-2448)	Nessus	Huawei Local Security Checks	7/28/2023	7/28/2023	medium
204314	Photon OS 5.0: Apr PHSA-2023-5.0-0110	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	medium
176683	RHEL 7 / 8 : Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 (RHSA-2023:3354)	Nessus	Red Hat Local Security Checks	6/5/2023	11/7/2024	critical
182975	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.5.4)	Nessus	Misc.	10/12/2023	2/17/2025	critical

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical

critical