The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210215, 12.2.1.3.x prior to 12.2.1.3.210405, 12.2.1.4.x prior to 12.2.1.4.210402, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.210331. It is, therefore, affected by multiple vulnerabilities as noted in the April 2021 Critical Patch Update advisory, including the following:

  - An unspecified vulnerability exists in the Analytics Server component of Oracle BI Enterprise Edition     subcomponent Apache Spark. An unauthenticated, remote attacker can exploit this, via HTTP, to take over     Oracle BI Enterprise Edition. (CVE-2020-9480)

  - A denial of service vulnerability exists in the BI Platform Security component of Oracle BI Enterprise     Edition subcomponent OpenSSL. An unauthenticated, remote attacker can exploit this, via HTTPS, to hang or     repeatedly crash the product. (CVE-2020-1971)

  - An unspecified vulnerability exists in the BI Platform Security component of Oracle BI Enterprise Edition     subcomponent Apache Tomcat.  An unauthenticated, remote attacker can exploit this, via HTTP, to result in     unauthorized update, insert, or delete access to some of Oracle BI accessible data, as well as     unauthorized read access to a subset of Oracle BI accessible data. (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The X.509 GeneralName type is a generic type for     representing different types of names. One of those     name types is known as EDIPartyName. OpenSSL provides a     function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or     not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer     dereference and a crash may occur leading to a possible     denial of service attack. OpenSSL itself uses the     GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an     available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp     response token signer matches the timestamp authority     name (exposed via the API functions     TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then     that attacker could trigger a crash. For example if the     attacker can trick a client or server into checking a     malicious certificate against a malicious CRL then this     may occur. Note that some applications automatically     download CRLs based on a URL embedded in a certificate.
    This checking happens prior to the signatures on the     certificate and CRL being verified. OpenSSL's s_server,     s_client and verify tools have support for the     '-crl_download' option which implements automatic CRL     downloading and this attack has been demonstrated to     work against those tools. Note that an unrelated bug     means that affected versions of OpenSSL cannot parse or     construct correct encodings of EDIPARTYNAME. However it     is possible to construct a malformed EDIPARTYNAME that     OpenSSL's parser will accept and hence trigger this     attack. All OpenSSL 1.1.1 and 1.0.2 versions are     affected by this issue. Other OpenSSL releases are out     of support and have not been checked. Fixed in OpenSSL     1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x     (Affected 1.0.2-1.0.2w).(CVE-2020-1971)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and     EVP_DecryptUpdate may overflow the output length     argument in some cases where the input length is close     to the maximum permissable length for an integer on the     platform. In such cases the return value from the     function call will be 1 (indicating success), but the     output length value will be negative. This could cause     applications to behave incorrectly or crash. OpenSSL     versions 1.1.1i and below are affected by this issue.
    Users of these versions should upgrade to OpenSSL     1.1.1j. OpenSSL versions 1.0.2x and below are affected     by this issue. However OpenSSL 1.0.2 is out of support     and no longer receiving public updates. Premium support     customers of OpenSSL 1.0.2 should upgrade to 1.0.2y.
    Other users should upgrade to 1.1.1j. Fixed in OpenSSL     1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y     (Affected 1.0.2-1.0.2x).(CVE-2021-23840)

  - The OpenSSL public API function     X509_issuer_and_serial_hash() attempts to create a     unique hash value based on the issuer and serial number     data contained within an X509 certificate. However it     fails to correctly handle any errors that may occur     while parsing the issuer field (which might occur if     the issuer field is maliciously constructed). This may     subsequently result in a NULL pointer deref and a crash     leading to a potential denial of service attack. The     function X509_issuer_and_serial_hash() is never     directly called by OpenSSL itself so applications are     only vulnerable if they use this function directly and     they use it on certificates that may have been obtained     from untrusted sources. OpenSSL versions 1.1.1i and     below are affected by this issue. Users of these     versions should upgrade to OpenSSL 1.1.1j. OpenSSL     versions 1.0.2x and below are affected by this issue.
    However OpenSSL 1.0.2 is out of support and no longer     receiving public updates. Premium support customers of     OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users     should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j     (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y     (Affected 1.0.2-1.0.2x).(CVE-2021-23841)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of IBM Cognos Analytics installed on the remote host is prior to 11.1.7 FP8, 11.2.4 FP3, or 12.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No. 7123154, including the following:

  - When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the   allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using   Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which   addresses this issue. (CVE-2023-39410)

  - In order to decrypt SM2 encrypted data an application is expected to call the API function   EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the   'out' parameter can be NULL and, on exit, the 'outlen' parameter is populated with the buffer size required   to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call   EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the 'out' parameter. A bug in the   implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the   plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by   the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a   second time with a buffer that is too small. A malicious attacker who is able present SM2 content for   decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of   62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour   or causing the application to crash. The location of the buffer is application dependent but is typically   heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). (CVE-2021-3711)

  - SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization.
  Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using   SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend   upgrading to version 2.0 and beyond. (CVE-2022-1471)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5639 advisory.

  - openssl: EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
148980	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	4/26/2021	1/3/2024	critical
151385	EulerOS Virtualization 3.0.2.2 : openssl (EulerOS-SA-2021-2154)	Nessus	Huawei Local Security Checks	7/6/2021	12/11/2023	high
193868	IBM Cognos Analytics 11.1.1 < 11.1.7 FP8 / 11.2.x < 11.2.4 FP3 / 12.0.x < 12.0.2 (7123154)	Nessus	CGI abuses	4/25/2024	4/26/2024	critical
144505	RHEL 7 : openssl (RHSA-2020:5639)	Nessus	Red Hat Local Security Checks	12/21/2020	4/28/2024	medium
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	9/1/2022	4/8/2024	critical

Detections

Analytics

Plugins Search

critical

high

critical

medium

critical