The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:8598 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.5.2), redhat-virtualization-host (4.5.2), redhat-virtualization-host-productimg (4.5.2). (BZ#2070049,     BZ#2093195)

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177)

    * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178)

    * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674)

    * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an     abstract Unix socket (CVE-2022-41974)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libksba package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The     vulnerability can be exploited remotely for code execution on the target system by passing specially     crafted data to the application, for example, a malicious S/MIME attachment. (CVE-2022-3515)

  - Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
    (CVE-2022-47629)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7090 advisory.

    KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by     other applications.  Both specifications are building blocks of S/MIME and TLS.

    Security Fix(es):

    * libksba: integer overflow may lead to remote code execution (CVE-2022-3515)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7090 advisory.

    [1.5.1-5]
    - Fix for CVE-2022-3515 (#2135703)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7089 advisory.

    [1.3.5-8]
    - Fix for CVE-2022-3515 (#2135702)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libksba package has been released.

According to the versions of the libksba package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The     vulnerability can be exploited remotely for code execution on the target system by passing specially     crafted data to the application, for example, a malicious S/MIME attachment. (CVE-2022-3515)

  - Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
    (CVE-2022-47629)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
168136	RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.5.3-1] (Important) (RHSA-2022:8598)	Nessus	Red Hat Local Security Checks	11/23/2022	11/7/2024	critical
172286	EulerOS 2.0 SP9 : libksba (EulerOS-SA-2023-1447)	Nessus	Huawei Local Security Checks	3/8/2023	8/31/2023	critical
166445	RHEL 9 : libksba (RHSA-2022:7090)	Nessus	Red Hat Local Security Checks	10/25/2022	11/7/2024	critical
166472	Oracle Linux 9 : libksba (ELSA-2022-7090)	Nessus	Oracle Linux Local Security Checks	10/25/2022	10/22/2024	critical
166489	Oracle Linux 8 : libksba (ELSA-2022-7089)	Nessus	Oracle Linux Local Security Checks	10/25/2022	10/22/2024	critical
203285	Photon OS 4.0: Libksba PHSA-2023-4.0-0319	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	critical
174824	EulerOS Virtualization 2.9.1 : libksba (EulerOS-SA-2023-1640)	Nessus	Huawei Local Security Checks	4/27/2023	4/27/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical