The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0648-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2150 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

  - atomic-openshift: cross-namespace owner references can trigger deletions of valid children (CVE-2019-3884)

  - kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

  - containerd: credentials leak during image pull (CVE-2020-15157)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3932-1 advisory.

  - It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw     via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. (CVE-2020-25658)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1716 advisory.

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - ceph object gateway: radosgw: CRLF injection (CVE-2021-3524)

  - ceph: Ceph volume does not honour osd_dmcrypt_key_size (CVE-2021-3979)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0637 advisory.

  - ant: insecure temporary file vulnerability (CVE-2020-1945)

  - jenkins-2-plugins/subversion: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2304)

  - jenkins-2-plugins/mercurial: XML parser is not preventing XML external entity (XXE) attacks     (CVE-2020-2305)

  - jenkins-2-plugins/mercurial: Missing permission check in an HTTP endpoint could result in information     disclosure (CVE-2020-2306)

  - jenkins-2-plugins/kubernetes: Jenkins controller environment variables are accessible in Kubernetes Plugin     (CVE-2020-2307)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows listing pod templates     (CVE-2020-2308)

  - jenkins-2-plugins/kubernetes: Missing permission check in Kubernetes Plugin allows enumerating credentials     IDs (CVE-2020-2309)

  - ant: insecure temporary file (CVE-2020-11979)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - jenkins: Arbitrary file read vulnerability in workspace browsers (CVE-2021-21602)

  - jenkins:  XSS vulnerability in notification bar (CVE-2021-21603)

  - jenkins:  Improper handling of REST API XML deserialization errors (CVE-2021-21604)

  - jenkins:  Path traversal vulnerability in agent names (CVE-2021-21605)

  - jenkins:  Arbitrary file existence check in file fingerprints (CVE-2021-21606)

  - jenkins:  Excessive memory allocation in graph URLs leads to denial of service (CVE-2021-21607)

  - jenkins: Stored XSS vulnerability in button labels (CVE-2021-21608)

  - jenkins:  Missing permission check for paths with specific prefix (CVE-2021-21609)

  - jenkins:  Reflected XSS vulnerability in markup formatter preview (CVE-2021-21610)

  - jenkins:  Stored XSS vulnerability on new item page (CVE-2021-21611)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
172252	SUSE SLES12 Security Update : python-rsa (SUSE-SU-2023:0648-1)	Nessus	SuSE Local Security Checks	3/8/2023	7/14/2023	medium
178495	Amazon Linux 2 : python-rsa (ALAS-2023-2150)	Nessus	Amazon Linux Local Security Checks	7/20/2023	7/20/2023	medium
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	2/24/2021	4/28/2024	high
167331	SUSE SLED15 / SLES15 Security Update : python-rsa (SUSE-SU-2022:3932-1)	Nessus	SuSE Local Security Checks	11/13/2022	7/14/2023	medium
160541	RHEL 7 / 8 : Red Hat Ceph Storage 4.3 Security and Bug Fix update (Moderate) (RHSA-2022:1716)	Nessus	Red Hat Local Security Checks	5/5/2022	4/28/2024	medium
147013	RHEL 7 : OpenShift Container Platform 3.11.394 (RHSA-2021:0637)	Nessus	Red Hat Local Security Checks	3/3/2021	4/28/2024	high

Detections

Analytics

Plugins Search

medium

medium

high

medium

medium

high