The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0336 advisory.

  - rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)

  - foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to     that Organization (CVE-2014-8183)

  - V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

  - foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)

  - pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)

  - pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)

  - foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)

  - foreman: Information disclosure in provisioning template previews (CVE-2016-4995)

  - foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)

  - foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)

  - foreman: Foreman information leak through unauthorized multiple_checkboxes helper (CVE-2016-7077)

  - foreman: Information leak through organizations and locations feature (CVE-2016-7078)

  - foreman: Stored XSS vulnerability in remote execution plugin (CVE-2016-8613)

  - foreman: Stored XSS in org/loc wizard (CVE-2016-8634)

  - foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)

  - foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)

  - katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)

  - puppet: Unsafe YAML deserialization (CVE-2017-2295)

  - rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

  - foreman: Image password leak (CVE-2017-2672)

  - Interconnect: Denial of Service vulnerability in Red Hat JBoss AMQ Interconnect (CVE-2017-15699)

  - katello: SQL inject in errata-related REST API (CVE-2018-14623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
196654	RHEL 7 : rubygem-hammer_cli (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
107053	RHEL 7 : Satellite 6.3 (RHSA-2018:0336)	Nessus	Red Hat Local Security Checks	2/28/2018	4/27/2024	high
196736	RHEL 6 : rubygem-hammer_cli (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

high

high

high