The remote host is affected by the vulnerability described in GLSA-202211-01 (OpenSSL: Multiple Vulnerabilities)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3843-1 advisory.

  - OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated     function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged     to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5     incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and     EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation     functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher     from the available providers. An equivalent cipher is found based on the NID passed to     EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is     possible for an application to incorrectly pass NID_undef as this value in the call to     EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation     function will match the NULL cipher as being equivalent and will fetch this from the available providers.
    This will succeed if the default provider has been loaded (or if a third party provider has been loaded     that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext.
    Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and     subsequently use it in a call to an encryption/decryption initialisation function. Applications that only     use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5). (CVE-2022-3358)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9968 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL     3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6) Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0844671c-5a09-11ed-856e-d4c9ef517024 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Node.js installed on the remote host is prior to 14.21.1, 16.18.1, 18.12.1, 19.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Nov 3 2022 Security Releases advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Impacts: (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the . character (decimal 46) on the stack.
    This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be     triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. OpenSSL versions 3.0.0 to 3.0.6 are     vulnerable to this issue. Impacts: (CVE-2022-3786)

  - The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal     format. An example of an octal IP address is 1.09.0.0, the 09 octet is invalid because 9 is not a number     in the base 8 number system. Browsers such as Firefox (tested on latest version m105) will still attempt     to resolve this invalid octal address via DNS. When combined with an active --inspect session, such as     when using VSCode, an attacker can perform DNS rebinding and execute arbitrary code Thank you to     @haxatron1 for reporting this vulnerability. Impacts: (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-157 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-502f096dce advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7288 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Nessus Network Monitor (NNM) installed on the remote host is prior to 6.0.1. It is, therefore, affected by multiple vulnerabilities in third-party software.

  Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported   version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.3.2. It is, therefore, affected by multiple vulnerabilities, including:

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
  (CVE-2022-3786, CVE-2022-3602)

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7288 advisory.

  - OpenSSL: X.509 Email Address Buffer Overflow (CVE-2022-3602)

  - OpenSSL: X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus agent running on the remote host is 10.x prior to 10.2.1. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
    (CVE-2022-3786, CVE-2022-3602)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.7. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.7 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. (CVE-2022-3786)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. (CVE-2022-3602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7288 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.4.x prior to 10.4.1. It is, therefore, affected by multiple vulnerabilities, including:

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
    (CVE-2022-3786, CVE-2022-3602)

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)


Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote Ubuntu 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5710-1 advisory.

  - OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated     function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged     to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5     incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and     EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation     functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher     from the available providers. An equivalent cipher is found based on the NID passed to     EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is     possible for an application to incorrectly pass NID_undef as this value in the call to     EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation     function will match the NULL cipher as being equivalent and will fetch this from the available providers.
    This will succeed if the default provider has been loaded (or if a third party provider has been loaded     that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext.
    Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and     subsequently use it in a call to an encryption/decryption initialisation function. Applications that only     use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5). (CVE-2022-3358)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. Fixed in OpenSSL 3.0.7 (Affected     3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3786)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10004 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. (CVE-2022-3786)

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed the malicious certificate or for the application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to     overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash     (causing a denial of service) or potentially remote code execution. Many platforms implement stack     overflow protections which would mitigate against the risk of remote code execution. The risk may be     further mitigated based on stack layout for any given platform/compiler. Pre-announcements of     CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors     described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new     version as soon as possible. In a TLS client, this can be triggered by connecting to a malicious server.
    In a TLS server, this can be triggered if the server requests client authentication and a malicious client     connects. Fixed in OpenSSL 3.0.7 (Affected 3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6). (CVE-2022-3602)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4586-1 advisory.

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint     checking. Note that this occurs after certificate chain signature verification and requires either a CA to     have signed a malicious certificate or for an application to continue certificate verification despite     failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a     certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the     stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this     can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server     requests client authentication and a malicious client connects. (CVE-2022-3786)

  - If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a     write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results     in a denial of service when the affected process hangs. Policy processing being enabled on a publicly     facing server is not considered to be a common setup. Policy processing is enabled by passing the     `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or     `X509_VERIFY_PARAM_set1_policies()' functions. (CVE-2022-3996)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
166788	GLSA-202211-01 : OpenSSL: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	11/2/2022	12/15/2022	high
166796	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openssl-3 (SUSE-SU-2022:3843-1)	Nessus	SuSE Local Security Checks	11/2/2022	2/8/2023	high
166774	Oracle Linux 9 : openssl (ELSA-2022-9968)	Nessus	Oracle Linux Local Security Checks	11/1/2022	12/15/2022	high
166787	FreeBSD : OpenSSL -- Buffer overflows in Email verification (0844671c-5a09-11ed-856e-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	11/2/2022	12/15/2022	high
167024	Node.js 14.x < 14.21.1 / 16.x < 16.18.1 / 18.x < 18.12.1 / 19.x < 19.0.1 Multiple Vulnerabilities (Nov 3 2022 Security Releases).	Nessus	Misc.	11/5/2022	3/6/2023	high
166782	Amazon Linux 2022 : (ALAS2022-2022-157)	Nessus	Amazon Linux Local Security Checks	11/2/2022	12/15/2022	high
166781	Fedora 36 : 1:openssl (2022-502f096dce)	Nessus	Fedora Local Security Checks	11/1/2022	12/15/2022	high
166801	Oracle Linux 9 : openssl (ELSA-2022-7288)	Nessus	Oracle Linux Local Security Checks	11/2/2022	12/15/2022	high
167263	Nessus Network Monitor < 6.1.1 Multiple Vulnerabilities (TNS-2022-25)	Nessus	Misc.	11/10/2022	12/5/2022	high
166959	Tenable Nessus 10.x < 10.3.2 Multiple Vulnerabilities (TNS-2022-23)	Nessus	Misc.	11/4/2022	2/8/2023	high
166789	RHEL 9 : openssl (RHSA-2022:7288)	Nessus	Red Hat Local Security Checks	11/2/2022	2/2/2023	high
166960	Tenable Nessus Agent 10.x < 10.2.1 Multiple Vulnerabilities (TNS-2022-22)	Nessus	Misc.	11/4/2022	12/15/2022	high
166773	OpenSSL 3.0.0 < 3.0.7 Multiple Vulnerabilities	Nessus	Web Servers	11/1/2022	12/15/2022	high
166808	AlmaLinux 9 : openssl (ALSA-2022:7288)	Nessus	Alma Linux Local Security Checks	11/2/2022	12/15/2022	high
166965	Tenable Nessus 10.4.x < 10.4.1 Multiple Vulnerabilities (TNS-2022-24)	Nessus	Misc.	11/4/2022	2/8/2023	high
166798	Ubuntu 22.04 LTS / 22.10 : OpenSSL vulnerabilities (USN-5710-1)	Nessus	Ubuntu Local Security Checks	11/2/2022	1/17/2023	high
167841	Oracle Linux 9 : openssl (ELSA-2022-10004)	Nessus	Oracle Linux Local Security Checks	11/18/2022	12/15/2022	high
168955	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openssl-3 (SUSE-SU-2022:4586-1)	Nessus	SuSE Local Security Checks	12/21/2022	2/8/2023	high

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high