The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6754-1 advisory.

    It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could     possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue     only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)

    It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly     use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only     affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

    It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames.
    A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial     of service. (CVE-2024-28182)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2799 advisory.

    - Resolves: #1744811 - CVE-2019-9511 nginx:1.14/nginx: HTTP/2: large amount of       data request leads to denial of service
    - Resolves: #1744325 - CVE-2019-9513 nginx:1.14/nginx: HTTP/2: flood using       PRIORITY frames resulting in excessive resource consumption

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3932 advisory.

    This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services     offering.

    This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and     includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant     bug fixes and enhancements included in this release.

    Security Fix(es):

    * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm     (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl:
    Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) *     mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded     request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2:
    read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads     to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive     resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service     (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2799 advisory.

  - HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  - HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  - HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2746 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)

    * HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)

    * HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nginx package has been released.

An update of the nodejs package has been released.

ID	Name	Product	Family	Published	Updated	Severity
193905	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : nghttp2 vulnerabilities (USN-6754-1)	Nessus	Ubuntu Local Security Checks	4/25/2024	9/3/2025	medium
129087	Oracle Linux 8 : nginx:1.14 (ELSA-2019-2799)	Nessus	Oracle Linux Local Security Checks	9/20/2019	11/1/2024	high
131215	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 (Important) (RHSA-2019:3932)	Nessus	Red Hat Local Security Checks	11/22/2019	11/7/2024	high
145622	CentOS 8 : nginx:1.14 (CESA-2019:2799)	Nessus	CentOS Local Security Checks	1/29/2021	1/25/2024	high
194174	RHEL 7 : rh-nginx112-nginx (RHSA-2019:2746)	Nessus	Red Hat Local Security Checks	4/28/2024	11/6/2024	high
203418	Photon OS 4.0: Nginx PHSA-2023-4.0-0342	Nessus	PhotonOS Local Security Checks	7/23/2024	11/2/2026	high
203266	Photon OS 4.0: Nodejs PHSA-2022-4.0-0298	Nessus	PhotonOS Local Security Checks	7/23/2024	11/2/2026	high

Detections

Analytics

Plugins Search

medium

high

high

high

high

high

high