MySQL Enterprise Monitor installed on the remote host is 8.0.x prior to 8.0.24. Therefore, it's affected by multiple vulnerabilities as referenced in the April 2021 CPU advisory.

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Tomcat)). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Enterprise Monitor.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to     all MySQL Enterprise Monitor accessible data (CVE-2020-17527).

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General     (Apache Struts)). Supported versions that are affected are 8.0.23 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Monitor. Successful     attacks of this vulnerability can result in takeover of MySQL Enterprise Monitor (CVE-2020-17530).

  - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL (component: Monitoring: General (OpenSSL)).
    Supported versions that are affected are 8.0.23 and prior. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Monitor. Successful attacks     of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or     all MySQL Enterprise Monitor accessible data as well as unauthorized access to critical data or complete access     to all MySQL Enterprise Monitor accessible data (CVE-2021-3450).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there were two issues in the 1.0 branch of the OpenSSL cryptographic system :

  - CVE-2021-23840: Prevent an issue where 'Digital     EnVeloPe' EVP-related calls could cause applications to     behave incorrectly or even crash.

  - CVE-2021-23841: Prevent an issue in the X509 certificate     handling caused by the lack of error handling whilst     parsing 'issuer' fields.

For Debian 9 'Stretch', these problems have been fixed in version 1.0.2u-1~deb9u4. For the equivalent changes for the 1.1 branch of OpenSSL, please see DLA-2563-1.

We recommend that you upgrade your openssl1.0 packages.

For the detailed security status of openssl1.0 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openssl1.0

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 fixes the following issues :

CVE-2021-23840: Fixed an Integer overflow in CipherUpdate (bsc#1182333)

CVE-2021-23841: Fixed a NULL pointer dereference in X509_issuer_and_serial_hash() (bsc#1182331)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 fixes the following issues :

CVE-2021-23840: Fixed an Integer overflow in CipherUpdate (bsc#1182333)

CVE-2021-23841: Fixed a NULL pointer dereference in X509_issuer_and_serial_hash() (bsc#1182331)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The OpenSSL public API function     X509_issuer_and_serial_hash() attempts to create a     unique hash value based on the issuer and serial number     data contained within an X509 certificate. However it     fails to correctly handle any errors that may occur     while parsing the issuer field (which might occur if     the issuer field is maliciously constructed). This may     subsequently result in a NULL pointer deref and a crash     leading to a potential denial of service attack. The     function X509_issuer_and_serial_hash() is never     directly called by OpenSSL itself so applications are     only vulnerable if they use this function directly and     they use it on certificates that may have been obtained     from untrusted sources.(CVE-2021-23841)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and     EVP_DecryptUpdate may overflow the output length     argument in some cases where the input length is close     to the maximum permissable length for an integer on the     platform. In such cases the return value from the     function call will be 1 (indicating success), but the     output length value will be negative. This could cause     applications to behave incorrectly or     crash.(CVE-2021-23840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14667-1 advisory.

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202103-03 (OpenSSL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSL. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The version of OpenSSL installed on the remote host is prior to 1.1.1j. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1j advisory.

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2463:03 advisory.

    * openssl: integer overflow in CipherUpdate (CVE-2021-23840)
      * openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017587 advisory.

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_4424 advisory.

    * openssl: integer overflow in CipherUpdate (CVE-2021-23840)

    * openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
148986	Oracle MySQL Enterprise Monitor Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	CGI abuses	4/26/2021	4/25/2023	critical
146604	Debian DLA-2565-1 : openssl1.0 security update	Nessus	Debian Local Security Checks	2/19/2021	12/6/2022	high
147511	SUSE SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2021:0725-1)	Nessus	SuSE Local Security Checks	3/10/2021	1/11/2024	high
147529	SUSE SLES12 Security Update : openssl-1_1 (SUSE-SU-2021:0752-1)	Nessus	SuSE Local Security Checks	3/10/2021	1/11/2024	high
150188	EulerOS 2.0 SP9 : openssl (EulerOS-SA-2021-1956)	Nessus	Huawei Local Security Checks	6/3/2021	12/27/2023	high
150559	SUSE SLES11 Security Update : openssl1 (SUSE-SU-2021:14667-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	high
148271	GLSA-202103-03 : OpenSSL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	4/1/2021	1/12/2024	high
148402	OpenSSL 1.1.1 < 1.1.1j Multiple Vulnerabilities	Nessus	Web Servers	4/9/2021	10/23/2024	high
294271	MiracleLinux 7 : openssl-1.0.2k-22.el7 (AXSA:2021-2463:03)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/21/2026	high
313928	Unity Linux 20.1060e / 20.1070e Security Update: openssl (UTSA-2026-017587)	Nessus	Unity Linux Local Security Checks	5/11/2026	5/11/2026	medium
358730	Rocky Linux 8 [CIQ] Security Update: openssl / openssl-debuginfo / openssl-debugsource / openssl-devel / etc Multiple Vulnerabilities (crlsa-2021_4424)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/2/2026	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high

high

medium

high