The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4590 advisory.

    Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency     manager, and required libraries.

    Security Fix(es):

    * Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source     attacks (CVE-2021-42574)

    The following changes were introduced in rust in order to facilitate detection of BiDi Unicode characters:

    Rust introduces two new lints to detect and reject code containing the affected codepoints. These new     deny-by-default lints detect affected codepoints in string literals and comments. The lints will prevent     source code file containing these codepoints from being compiled. If your code has legitimate uses for the     codepoints we recommend replacing them with the related escape sequence. The error messages will suggest     the right escapes to use.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4595 advisory.

  - Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks     (CVE-2021-42574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4694 advisory.

    Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency     manager, and required libraries.

    Security Fix(es):

    * Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source     attacks (CVE-2021-42574)

    The following changes were introduced in rust in order to facilitate detection of BiDi Unicode characters:

    Rust introduces two new lints to detect and reject code containing the affected codepoints. These new     deny-by-default lints detect affected codepoints in string literals and comments. The lints will prevent     source code file containing these codepoints from being compiled. If your code has legitimate uses for the     codepoints we recommend replacing them with the related escape sequence. The error messages will suggest     the right escapes to use.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4724 advisory.

    Annobin provides a compiler plugin to annotate and tools to examine compiled binary files.

    Security Fix(es):

    * Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source     attacks (CVE-2021-42574)

    The following changes were introduced in annobin in order to facilitate detection of BiDi Unicode     characters:

    This update of annobin adds a new annocheck test to detect the presence of multibyte characters in symbol     names.

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:4594 advisory.

  - Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks     (CVE-2021-42574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4593 advisory.

    [9.72-1.2]
    - Bump NVR and rebuild to use the new gcc. (#2017362)

    [9.72-1.1]
    - Annocheck: Add test for multibyte characters in symbol names.  (#2017362)

    [9.72-1]
    - Rebase to 9.72.  (#1960299)
    - annocheck: Accept 0 as a valid number for gcc minor versions and release numbers.
    - gcc-plugin: Add support for ARM and RISCV targets.
    - timing: do not initialise the clock if the timing tool is disabled.
    - gcc-plugin: Replace ICE messsages with verbose messages.
    - Fix the testsuite so that it can be run in parallel.
    - Annocheck: WARN if the annobin plugin was built for a newer version of the compiler than the one on     which it was run.  (#1950657)
    - Annocheck: Improve detection of missing GNU-stack support.
    - Correct a package rename (bug #1949570)
    - Require docs subpackage by the other ones because of a license
    - Build-requiring perl-interpreter is enough
    - Fix bz1949570
    - Fix anomolies reported by covscan.
    - Move documentation into a sub-package.

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4743 advisory.

    * Developer environment: Unicode's bidirectional (BiDi) override characters can cause trojan source     attacks (CVE-2021-42574)

    The following changes were introduced in clang in order to facilitate detection of BiDi Unicode     characters:

    clang-tidy now finds identifiers that contain Unicode characters with right-to-left direction, which can     be confusing as they may change the understanding of a whole statement.

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. (CVE-2021-42574)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. (CVE-2021-42574)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of gcc installed on the remote host is prior to 7.3.1-14. The version of gcc10 installed on the remote host is prior to 10.3.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1784 advisory.

    A flaw was found in the way Unicode standards are implemented in the context of development environments,     which have specialized requirements for rendering text. An attacker could exploit this to deceive a human     reviewer by creating a malicious patch containing well placed BiDi characters. The special handling and     rendering of those characters can be then used in an attempt to hide unexpected and potentially dangerous     behaviour from the reviewer. (CVE-2021-42574)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ** DISPUTED ** An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through     14.0. It permits the visual reordering of characters via control sequences, which can be used to craft     source code that renders different logic than the logical ordering of tokens ingested by compilers and     interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such     that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium     offers the following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

  - stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of     service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-     of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699. (CVE-2021-45078)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AHV installed on the remote host is prior to 20201105.2267. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.2267 advisory.

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the     following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

  - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an     attacker who can convince a victim to install a seemingly verifiable package, whose signature header was     modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is     to data integrity, confidentiality, and system availability. (CVE-2021-20271)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20220304.242. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.242 advisory.

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315)

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It     permits the visual reordering of characters via control sequences, which can be used to craft source code     that renders different logic than the logical ordering of tokens ingested by compilers and interpreters.
    Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted     vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the     following alternative approach to presenting this concern. An issue is noted in the nature of     international text that can affect applications that implement support for The Unicode Standard and the     Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-     right and right-to-left characters, the visual order of tokens may be different from their logical order.
    Additionally, control characters needed to fully support the requirements of bidirectional text can     further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such     that the ordering of tokens perceived by human reviewers does not match what will be processed by a     compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its     document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also     provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode     Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the     BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading     visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.
    (CVE-2021-42574)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
155218	RHEL 8 : rust-toolset:rhel8 (RHSA-2021:4590)	Nessus	Red Hat Local Security Checks	11/11/2021	3/6/2025	high
155342	CentOS 8 : binutils (CESA-2021:4595)	Nessus	CentOS Local Security Checks	11/13/2021	11/23/2023	high
155378	RHEL 7 : rust-toolset-1.54-rust (RHSA-2021:4694)	Nessus	Red Hat Local Security Checks	11/17/2021	11/7/2024	high
155542	RHEL 7 : devtoolset-10-annobin (RHSA-2021:4724)	Nessus	Red Hat Local Security Checks	11/17/2021	11/7/2024	high
155555	CentOS 8 : gcc-toolset-11-binutils (CESA-2021:4594)	Nessus	CentOS Local Security Checks	11/18/2021	11/23/2023	high
155563	Oracle Linux 8 : annobin (ELSA-2021-4593)	Nessus	Oracle Linux Local Security Checks	11/18/2021	10/23/2024	high
157580	AlmaLinux 8 : llvm-toolset:rhel8 (ALSA-2021:4743)	Nessus	Alma Linux Local Security Checks	2/9/2022	1/13/2025	high
158482	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2022-1262)	Nessus	Huawei Local Security Checks	3/1/2022	11/7/2023	high
159799	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2022-1422)	Nessus	Huawei Local Security Checks	4/18/2022	11/1/2023	high
160265	Amazon Linux 2 : gcc10, gcc (ALAS-2022-1784)	Nessus	Amazon Linux Local Security Checks	4/27/2022	12/11/2024	high
163222	EulerOS Virtualization 2.10.0 : binutils (EulerOS-SA-2022-2020)	Nessus	Huawei Local Security Checks	7/15/2022	10/17/2023	high
164577	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.2267)	Nessus	Misc.	9/1/2022	2/19/2025	critical
170564	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.242)	Nessus	Misc.	1/25/2023	2/19/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

critical

critical