The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5634 advisory.

  - atomic-openshift: cross-namespace owner references can trigger deletions of valid children (CVE-2019-3884)

  - kubernetes: Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (CVE-2020-8566)

  - containerd: credentials leak during image pull (CVE-2020-15157)

  - python-rsa: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25658)

  - golang: math/big: panic during recursive division of very large numbers (CVE-2020-28362)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the consul package has been released.

  - An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index     validation, aka the skippy peanut butter issue. (CVE-2021-3121)

  - HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid     certificate signed by the same CA to access server-only functionality, enabling privilege escalation.
    Fixed in 1.8.15, 1.9.9 and 1.10.2. (CVE-2021-37219)

  - HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for     other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. (CVE-2021-38698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1276 advisory.

  - golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)

  - golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)

  - ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)

  - golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

  - golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

  - golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)

  - envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)

  - envoy: Use-after-free when response filters increase response data (CVE-2021-43825)

  - envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)

  - envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654)

  - envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)

  - envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)

  - istio: unauthenticated control plane denial of service attack (CVE-2022-23635)

  - istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CockroachDB installed on the remote host is prior to 19.2.12, 20.1.x prior to 20.1.11, or 20.2.x prior  to 20.2.4. Therefore, a denial of service (DoS) vulnerability exists in protobuf binary decode functions. An  unauthenticated, remote attacker can exploit this issue by sending a specially crafted HTTP request to cause the  full-cluster to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2437 advisory.

  - python-eventlet: improper handling of highly compressed data and memory allocation with excessive size     allows DoS (CVE-2021-21419)

  - jenkins-2-plugins/matrix-auth: Incorrect permission checks in Matrix Authorization Strategy Plugin     (CVE-2021-21623)

  - jenkins: lack of type validation in agent related REST API (CVE-2021-21639)

  - jenkins: view name validation bypass (CVE-2021-21640)

  - jenkins-2-plugins/credentials: Reflected XSS vulnerability in Credentials Plugin (CVE-2021-21648)

  - kubernetes: Validating Admission Webhook does not observe some previous fields (CVE-2021-25735)

  - kubernetes: Holes in EndpointSlice Validation Enable Host Network Hijack (CVE-2021-25737)

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - openshift: Injected service-ca.crt incorrectly contains additional internal CAs (CVE-2021-3636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1006 advisory.

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

  - fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise     (CVE-2021-20218)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
146810	RHEL 7 / 8 : OpenShift Container Platform 4.7.0 (RHSA-2020:5634)	Nessus	Red Hat Local Security Checks	2/24/2021	4/28/2024	high
153745	Photon OS 4.0: Consul PHSA-2021-4.0-0105	Nessus	PhotonOS Local Security Checks	9/27/2021	5/9/2022	high
159603	RHEL 8 : Red Hat OpenShift Service Mesh 2.0.9 (RHSA-2022:1276)	Nessus	Red Hat Local Security Checks	4/8/2022	4/28/2024	critical
159484	CockroachDB 19.2 < 19.2.12 / 20.1 < 20.1.11 / 20.2 < 20.2.4 DoS (A58932)	Nessus	Databases	4/4/2022	4/26/2022	high
153751	Photon OS 3.0: Consul PHSA-2021-3.0-0303	Nessus	PhotonOS Local Security Checks	9/27/2021	5/9/2022	high
152103	RHEL 7 / 8 : OpenShift Container Platform 4.8.2 packages and (RHSA-2021:2437)	Nessus	Red Hat Local Security Checks	7/27/2021	12/6/2023	high
148316	RHEL 7 / 8 : OpenShift Container Platform 4.7.5 (RHSA-2021:1006)	Nessus	Red Hat Local Security Checks	4/5/2021	4/28/2024	high
195687	RHEL 7 : gogo_protobuf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

high

high

critical

high

high

high

high

high