Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735)

  - edk2: numeric truncation in MdeModulePkg/PiDxeS3BootScriptLib (CVE-2019-14563)

  - If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a     truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a     crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to     1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that     algorithm should update to 1.0.2k. (CVE-2017-3731)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1415 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230)

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    * edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0408 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler()     (CVE-2019-14560)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated due to only referencing a CVE that has been rejected.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6919 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2019. Notes: none. (CVE-2019-14560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated due to only referencing a CVE that has been rejected.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6919 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2019. Notes: none. (CVE-2019-14560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated due to only referencing a CVE that has been rejected.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:6919 advisory.

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA     pool that was not assigned to any issues during 2019. Notes: none. (CVE-2019-14560)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198734	RHEL 7 : ovmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
192272	RHEL 8 : edk2 (RHSA-2024:1415)	Nessus	Red Hat Local Security Checks	high
189566	RHEL 8 : edk2 (RHSA-2024:0408)	Nessus	Red Hat Local Security Checks	critical
186108	Oracle Linux 8 : edk2 (ELSA-2023-6919) (deprecated)	Nessus	Oracle Linux Local Security Checks	high
185653	RHEL 8 : edk2 (RHSA-2023:6919) (deprecated)	Nessus	Red Hat Local Security Checks	high
185627	CentOS 8 : edk2 (CESA-2023:6919) (deprecated)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2019-14560

No Score

Tenable Plugins

high

high

critical

high

high

high