An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.

The version of AHV installed on the remote host is prior to 20201105.1021. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.1021 advisory.

  - libpng before 1.6.32 does not properly check the length of chunks against the user limit. (CVE-2017-12652)

  - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons     could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be     usable for denial-of-service attacks). (CVE-2018-20843)

  - When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger     an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information     disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
    (CVE-2019-11719)

  - A vulnerability exists where it possible to force Network Security Services (NSS) to sign     CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in     CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This     vulnerability affects Firefox < 68. (CVE-2019-11727)

  - Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited     to a denial of service). This vulnerability affects Firefox < 71. (CVE-2019-11756)

  - file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file     permissions while a copy operation is in progress. Instead, default permissions are used. (CVE-2019-12450)

  - dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical     Upstart in Ubuntu 14.04 (and in some, less common, uses of dbus-daemon), allows cookie spoofing because of     symlink mishandling in the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. (This only     affects the DBUS_COOKIE_SHA1 authentication mechanism.) A malicious client with write access to its own     home directory could manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to     read and write in unintended locations. In the worst case, this could result in the DBusServer reusing a     cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent     client connection came from an attacker-chosen uid, allowing authentication bypass. (CVE-2019-12749)

  - A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and     send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A     local attacker may use this flaw to intercept all keystrokes of a victim user who is using the graphical     interface, change the input method engine, or modify other input related configurations of the victim     user. (CVE-2019-14822)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read. (CVE-2019-15903)

  - The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has     XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in     Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input, arbitrary     JavaScript can be delivered to clients that visit the http URL for this server. (CVE-2019-16935)

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting     in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming     Application Data records will be ignored. This vulnerability affects Firefox < 72. (CVE-2019-17023)

  - In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow     in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent     memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of     service condition on the client system when a user connects to the server. (CVE-2019-17498)

  - On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition,     allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass     ASLR for a setuid program. (CVE-2019-19126)

  - xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to     newDoc->oldNs. (CVE-2019-19956)

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.
    (CVE-2019-20388)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an     infinite loop when opened by tarfile.open, because _proc_pax lacks header validation. (CVE-2019-20907)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

  - An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A     specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code     execution. An attacker can corrupt a partition to trigger this vulnerability. (CVE-2019-5094)

  - A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4.
    A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code     execution. An attacker can corrupt a partition to trigger this vulnerability. (CVE-2019-5188)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can     result in denial of service (daemon crash). (CVE-2020-12243)

  - When converting coordinates from projective to affine, the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80     and Firefox for Android < 80. (CVE-2020-12400)

  - During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar     multiplication was removed, resulting in variable-time execution dependent on secret data. This     vulnerability affects Firefox < 80 and Firefox for Android < 80. (CVE-2020-12401)

  - During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean     Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform     electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes.
    *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected,     but products built on top of it might. This vulnerability affects Firefox < 78. (CVE-2020-12402)

  - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using     multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling     multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest     threat from this vulnerability is to confidentiality and system availability. (CVE-2020-12403)

  - libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to     stack consumption. (CVE-2020-12825)

  - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and     IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application     is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this     attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12;
    v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.
    (CVE-2020-14422)

  - Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15999)

  - A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability. (CVE-2020-25637)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions     that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2780)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported     versions that are affected are 5.6.47 and prior, 5.7.29 and prior and 8.0.19 and prior. Easily exploitable     vulnerability allows high privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2020-2812)

  - When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which     leaked partial information about the nonce used during signature generation. Given an electro-magnetic     trace of a few signature generations, the private key could have been computed. This vulnerability affects     Firefox < 80 and Firefox for Android < 80. (CVE-2020-6829)

  - xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file     situation. (CVE-2020-7595)

  - curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources     that can lead too overwriting a local file when the -J flag is used. (CVE-2020-8177)

  - Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1     allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client     because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking. (CVE-2020-8492)

  - In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating     the server receiving the TSIG-signed request, could send a truncated response to that request, triggering     an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to     correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and     message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
    (CVE-2020-8622)

  - In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the     BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted     query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with
    --enable-native-pkcs11 * be signing one or more zones with an RSA key * be able to receive queries from     a possible attacker (CVE-2020-8623)

  - In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also     affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An     attacker who has been granted privileges to change a specific subset of the zone's content could abuse     these unintended additional privileges to update other contents of the zone. (CVE-2020-8624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has systemd packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment     before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to     set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using     the allow_active element rather than allow_any. (CVE-2019-3842)

  - systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed     by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were     intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082. (CVE-2020-13776)

  - basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an     Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that     results in an operating system crash. (CVE-2021-33910)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1647 advisory.

    It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a     service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in     particularly configured services to inject, change, or corrupt the service state. (CVE-2018-15686)

    An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate     with a colon ':'. A local attacker can use this flaw to disclose process memory data. (CVE-2018-16866)

    A memory leak was discovered in the systemd-login when a power-switch event is received. A physical     attacker may trigger one of these events and leak bytes due to a missing free. (CVE-2019-20386)

    A memory leak was discovered in the backport of fixes forCVE-2018-16864in Red Hat Enterprise Linux.
    Function dispatch_message_real() in journald-server.c does not free the memory allocated by     set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-     journald crash. (CVE-2019-3815)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1643 advisory.

  - A vulnerability in unit_deserialize of systemd allows an attacker to supply arbitrary state across systemd     re-execution via NotifyAccess. This can be used to improperly influence systemd execution and possibly     lead to root privilege escalation. Affected releases are systemd versions up to and including 239.
    (CVE-2018-15686)

  - An allocation of memory without limits, that could result in the stack clashing with another memory     region, was discovered in systemd-journald when a program with long command line arguments calls syslog. A     local attacker may use this flaw to crash systemd-journald or escalate his privileges. Versions through     v240 are vulnerable. (CVE-2018-16864)

  - An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate     with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221     to v239 are vulnerable. (CVE-2018-16866)

  - It was discovered systemd does not correctly check the content of PIDFile files before using it to kill     processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a     local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick     systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
    (CVE-2018-16888)

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

  - A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux.
    Function dispatch_message_real() in journald-server.c does not free the memory allocated by     set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-     journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.
    (CVE-2019-3815)

  - An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c     allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus     messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1,     causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a     denial of service (systemd PID1 crash and kernel panic). (CVE-2019-6454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4553 advisory.

  - systemd: memory leak in button_open() in login/logind-button.c when udev events are received     (CVE-2019-20386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4553 advisory.

    [239-40.0.1]
    - backport upstream pstore tmpfiles patch [Orabug: 31420486]
    - udev rules: fix memory hot add and remove [Orabug: 31310273]
    - fix to enable systemd-pstore.service [Orabug: 30951066]
    - journal: change support URL shown in the catalog entries [Orabug: 30853009]
    - fix to generate systemd-pstore.service file [Orabug: 30230056]
    - fix _netdev is missing for iscsi entry in /etc/fstab (tony.l.lam@oracle.com) [Orabug: 25897792]
    - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [Orabug: 22224874]
    - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
    - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]
    - Backport upstream patches for the new systemd-pstore tool (Eric DeVolder) [OraBug: 30230056]

    [239-40]
    - units: add generic boot-complete.target (#1872243)
    - man: document new 'boot-complete.target' unit (#1872243)
    - core: make sure to restore the control command id, too (#1829867)

    [239-39]
    - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
    - device: dont emit PropetiesChanged needlessly (#1793533)

    [239-38]
    - spec: fix rpm verification (#1702300)

    [239-37]
    - spec: dont package /etc/systemd/system/dbus-org.freedesktop.resolve1.service (#1844465)

    [239-36]
    - core: dont consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
    - selinux: do preprocessor check only in selinux-access.c (#1830861)
    - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
    - shared: add generic logic for waiting for a unit to enter some state (#1830861)
    - shared: fix assert call (#1830861)
    - shared: Dont try calling NULL callback in bus_wait_for_units_clear (#1830861)
    - shared: add NULL callback check in one more place (#1830861)
    - core: introduce support for cgroup freezer (#1830861)
    - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
    - core: fix the return value in order to make sure we dont dipatch method return too early (#1830861)
    - test: add test for cgroup v2 freezer support (#1830861)
    - fix mis-merge (#1848421)
    - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)

    [239-35]
    - spec: fix rpm verification (#1702300)

    [239-34]
    - spec: fix rpm verification (#1702300)

    [239-33]
    - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
    - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
    - resolvconf: fixes for the compatibility interface (#1835594)
    - mount: dont add Requires for tmp.mount (#1748840)
    - core: coldplug possible nop_job (#1829798)
    - core: add IODeviceLatencyTargetSec (#1831519)
    - time-util: Introduce parse_sec_def_infinity (#1770379)
    - cgroup: use structured initialization (#1770379)
    - core: add CPUQuotaPeriodSec= (#1770379)
    - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
    - sd-bus: avoid magic number in SASL length calculation (#1838081)
    - sd-bus: fix SASL reply to empty AUTH (#1838081)
    - sd-bus: skip sending formatted UIDs via SASL (#1838081)
    - core: add MemoryMin (#1763435)
    - core: introduce cgroup_add_device_allow() (#1763435)
    - test: remove support for suffix in get_testdata_dir() (#1763435)
    - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
    - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
    - unit: Add DefaultMemoryMin (#1763435)
    - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
    - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
    - cgroup: Support 0-value for memory protection directives (#1763435)
    - cgroup: Test that its possible to set memory protection to 0 again (#1763435)
    - cgroup: Check ancestor memory min for unified memory config (#1763435)
    - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
    - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
    - meson: allow setting the version string during configuration (#1804252)

    [239-32]
    - pid1: fix DefaultTasksMax initialization (#1809037)
    - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
    - test: introduce TEST-36-NUMAPOLICY (#1808940)
    - test: replace 'tail -f' with journal cursor which should be... (#1808940)
    - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
    - test: make sure the strace process is indeed dead (#1808940)
    - test: skip the test on systems without NUMA support (#1808940)
    - test: give strace some time to initialize (#1808940)
    - test: add a simple sanity check for systems without NUMA support (#1808940)
    - test: drop the missed || exit 1 expression (#1808940)
    - test: replace cursor file with a plain cursor (#1808940)
    - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
    - swap: finish the secondary swap units jobs if deactivation of the primary swap unit fails (#1749622)
    - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
    - bus_open leak sd_event_source when udevadm trigger (#1798504)
    - core: rework StopWhenUnneeded= logic (#1798046)
    - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
    - core: fix re-realization of cgroup siblings (#1818054)
    - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
    - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
    - sd-journal: close journal files that were deleted by journald before weve setup inotify watch (#1796128)
    - sd-journal: remove the dead code and actually fix #14695 (#1796128)
    - udev: downgrade message when we fail to set inotify watch up (#1808051)
    - logind: check PolicyKit before allowing VT switch (#1797679)
    - test: do not use global variable to pass error (#1823767)
    - test: install libraries required by tests (#1823767)
    - test: introduce install_zoneinfo() (#1823767)
    - test: replace duplicated Makefile by symbolic link (#1823767)
    - test: add paths of keymaps in install_keymaps() (#1823767)
    - test: make install_keymaps() optionally install more keymaps (#1823767)
    - test-fs-util: skip some tests when running in unprivileged container (#1823767)
    - test-process-util: skip several verifications when running in unprivileged container (#1823767)
    - test-execute: also check python3 is installed or not (#1823767)
    - test-execute: skip several tests when running in container (#1823767)
    - test: introduce test_is_running_from_builddir() (#1823767)
    - test: make test-catalog relocatable (#1823767)
    - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
    - test: try to determine QEMU_SMP dynamically (#1823767)
    - test: store coredumps in journal (#1823767)
    - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
    - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
    - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
    - Add support for opening files for appending (#1809175)
    - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
    - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
    - job: when a job was skipped due to a failed condition, log about it (#1737283)
    - core: split out all logic that updates a Job on a units unit_notify() invocation (#1737283)
    - core: make log messages about units entering a 'failed' state recognizable (#1737283)
    - core: log a recognizable message when a unit succeeds, too (#1737283)
    - tests: always use the right vtable wrapper calls (#1737283)
    - test-execute: allow filtering test cases by pattern (#1737283)
    - test-execute: provide custom failure message (#1737283)
    - core: ExecCondition= for services (#1737283)
    - Drop support for lz4 < 1.3.0 (#1843871)
    - test-compress: add test for short decompress_startswith calls (#1843871)
    - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
    - fuzz-compress: add fuzzer for compression and decompression (#1843871)
    - seccomp: fix __NR__sysctl usage (#1843871)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4553 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: memory leak in button_open() in login/logind-button.c when udev events are received     (CVE-2019-20386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - systemd: memory leak in button_open() in     login/logind-button.c when udev events are received     (CVE-2019-20386)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4007 advisory.

  - An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the     udevadm trigger command, a memory leak may occur. (CVE-2019-20386)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4007 advisory.

    [219-78.0.1]
    - Backport upstream patches related to private-tmp (Sushmita Bhattacharya) [Orabug: 31561883]
    - backport upstream pstore tmpfiles patch (Eric DeVolder) [Orabug: 31414539]
    - udev rules: fix memory hot add and remove [Orabug: 31309730]
    - enable and start the pstore service [Orabug: 30950903]
    - fix to generate the systemd-pstore.service file [Orabug: 30235241]
    - Backport upstream patches for the new systemd-pstore tool [Orabug: 30235241]
    - do not create utmp update symlinks for reboot and poweroff [Orabug: 27854896]
    - OL7 udev rule for virtio net standby interface [Orabug: 28826743]
    - fix _netdev is missing for iscsi entry in /etc/fstab [Orabug: 25897792] (tony.l.lam@oracle.com)
    - set 'RemoveIPC=no' in logind.conf as default for OL7.2 [22224874]
    - allow dm remove ioctl to co-operate with UEK3 (Vaughan Cao) [Orabug: 18467469]
    - add hv dynamic memory support (Jerry Snitselaar) [Orabug: 18621475]

    [219-78]
    - avoid double free (#1832816)

    [219-77]
    - core: coldplug possible nop_job (#1829754)
    - core: make sure to restore the control command id, too (#1828953)

    [219-76]
    - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
    - core: rework StopWhenUnneeded= logic (#1775291)

    [219-75]
    - journal: break recursion (#1778744)

    [219-74]
    - sd-bus: bump message queue size again (#1770158)
    - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
    - add test for ExecStopPost (#1733998)
    - core: when restarting services, dont close fds (#1757704)
    - unit: rework a bit how we keep the service fdstore from being destroyed during service restart     (#1757704)
    - tests: add basic journal test (#1757704)
    - tests: add regression test for 'systemctl restart systemd-journald' (#1757704)
    - tests: add test that journald keeps fds over termination by signal (#1757704)
    - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
    - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
    - mount: dont propagate errors from mount_setup_unit() further up (#1804757)
    - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
    - fix the fix for #1691511 (#1804757)
    - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
    - Consider smb3 as remote filesystem (#1811700)
    - mount: dont add Requires for tmp.mount (#1813270)
    - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
    - sd-journal: close journal files that were deleted by journald before weve setup inotify watch (#1812889)
    - sd-journal: remove the dead code and actually fix #14695 (#1812889)
    - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
    - swap: finish the secondary swap units jobs if deactivation of the primary swap unit fails (#1749621)
    - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
    - run: add '-G' as shortcut for '--property=CollectMode=inactive-or-failed' (#1817576)
    - core: clarify that the CollectMode bus property is constant (#1817576)
    - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
    - logind: check PolicyKit before allowing VT switch (#1797672)
    - timer: dont use persietent file timestamps from the future (#6823) (#1769923)
    - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
    - bus_open leak sd_event_source when udevadm trigger (#1798503)
    - journal-remote: split-mode=host, remove port from journal filename (#1244691)
    - core: downgrade log message about inability to propagate cgroup release message (#1679934)
    - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
    - set kptr_restrict=1 (#1689344)

    [219-73.3]
    - journal: do not trigger assertion when journal_file_close() get NULL (#1807798)

    [219-73.2]
    - core: when restarting services, dont close fds (#1803802)
    - unit: rework a bit how we keep the service fdstore from being destroyed during service restart     (#1803802)
    - tests: add basic journal test (#1803802)
    - tests: add regression test for 'systemctl restart systemd-journald' (#1803802)
    - tests: add test that journald keeps fds over termination by signal (#1803802)

    [219-73.1]
    - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4007 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd: memory leak in button_open() in login/logind-button.c when udev events are received     (CVE-2019-20386)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for systemd fixes the following issues :

CVE-2019-20386: Fixed a memory leak when executing the udevadm trigger command (bsc#1161436).

Renamed the persistent link for ATA devices (bsc#1164538)

shared/install: try harder to find enablement symlinks when disabling a unit (bsc#1157315)

tmpfiles: removed unnecessary assert (bsc#1171145)

pid1: by default make user units inherit their umask from the user manager (bsc#1162698)

manager: fixed job mode when signalled to shutdown etc (bsc#1161262)

coredump: fixed bug that loses core dump files when core dumps are compressed and disk space is low. (bsc#1167622)

udev: inform systemd how many workers we can potentially spawn (#4036) (bsc#1165633)

libblkid: open device in nonblock mode. (bsc#1084671)

udev/cdrom_id: Do not open CD-rom in exclusive mode. (bsc#1154256)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the systemd package has been released.

A few bugfixes and hwdb update.

No need to log out or reboot.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for systemd fixes the following issues :

  - CVE-2020-1712 (bsc#bsc#1162108) Fix a heap     use-after-free vulnerability, when asynchronous Polkit     queries were performed while handling Dbus messages. A     local unprivileged attacker could have abused this flaw     to crash systemd services or potentially execute code     and elevate their privileges, by sending specially     crafted Dbus messages.

  - Use suse.pool.ntp.org server pool on SLE distros     (jsc#SLE-7683)

  - libblkid: open device in nonblock mode. (bsc#1084671)

  - udev/cdrom_id: Do not open CD-rom in exclusive mode.
    (bsc#1154256)

  - bus_open leak sd_event_source when udevadm     trigger&#x3002; (bsc#1161436 CVE-2019-20386)

  - fileio: introduce read_full_virtual_file() for reading     virtual files in sysfs, procfs (bsc#1133495 bsc#1159814)

  - fileio: initialize errno to zero before we do fread()

  - fileio: try to read one byte too much in     read_full_stream()

  - logind: consider 'greeter' sessions suitable as     'display' sessions of a user (bsc#1158485)

  - logind: never elect a session that is stopping as     display

  - journal: include kmsg lines from the systemd process     which exec()d us (#8078)

  - udevd: don't use monitor after manager_exit()

  - udevd: capitalize log messages in on_sigchld()

  - udevd: merge conditions to decrease indentation

  - Revert 'udevd: fix crash when workers time out after     exit is signal caught'

  - core: fragments of masked units ought not be considered     for NeedDaemonReload (#7060) (bsc#1156482)

  - udevd: fix crash when workers time out after exit is     signal caught

  - udevd: wait for workers to finish when exiting     (bsc#1106383)

  - Improve bash completion support (bsc#1155207)

  - shell-completion: systemctl: do not list template units     in (re,)start

  - shell-completion: systemctl: pass current word to all     list_unit*

  - bash-completion: systemctl: pass current partial unit to     list-unit* (bsc#1155207)

  - bash-completion: systemctl: use systemctl --no-pager

  - bash-completion: also suggest template unit files

  - bash-completion: systemctl: add missing options and     verbs

  - bash-completion: use the first argument instead of the     global variable (#6457)

  - networkd: VXLan Make group and remote variable separate     (bsc#1156213)

  - networkd: vxlan require Remote= to be a non multicast     address (#8117) (bsc#1156213)

  - fs-util: let's avoid unnecessary strerror()

  - fs-util: introduce inotify_add_watch_and_warn() helper

  - ask-password: improve log message when inotify limit is     reached (bsc#1155574)

  - shared/install: failing with -ELOOP can be due to the     use of an alias in install_error() (bsc#1151377)

  - man: alias names can't be used with enable command     (bsc#1151377)

  - Add boot option to not use swap at system start     (jsc#SLE-7689)

  - Allow YaST to select Iranian (Persian, Farsi) keyboard     layout (bsc#1092920) This update was imported from the     SUSE:SLE-15:Update update project.

This update for systemd fixes the following issues :

CVE-2020-1712 (bsc#bsc#1162108) Fix a heap use-after-free vulnerability, when asynchronous Polkit queries were performed while handling Dbus messages. A local unprivileged attacker could have abused this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted Dbus messages.

Use suse.pool.ntp.org server pool on SLE distros (jsc#SLE-7683)

libblkid: open device in nonblock mode. (bsc#1084671)

udev/cdrom_id: Do not open CD-rom in exclusive mode. (bsc#1154256)

bus_open leak sd_event_source when udevadm trigger&Atilde;&pound;&Acirc;&#128;&Acirc;&#130; (bsc#1161436 CVE-2019-20386)

fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (bsc#1133495 bsc#1159814)

fileio: initialize errno to zero before we do fread()

fileio: try to read one byte too much in read_full_stream()

logind: consider 'greeter' sessions suitable as 'display' sessions of a user (bsc#1158485)

logind: never elect a session that is stopping as display

journal: include kmsg lines from the systemd process which exec()d us (#8078)

udevd: don't use monitor after manager_exit()

udevd: capitalize log messages in on_sigchld()

udevd: merge conditions to decrease indentation

Revert 'udevd: fix crash when workers time out after exit is signal caught'

core: fragments of masked units ought not be considered for NeedDaemonReload (#7060) (bsc#1156482)

udevd: fix crash when workers time out after exit is signal caught

udevd: wait for workers to finish when exiting (bsc#1106383)

Improve bash completion support (bsc#1155207)

  - shell-completion: systemctl: do not list template units     in {re,}start

  - shell-completion: systemctl: pass current word to all     list_unit*

  - bash-completion: systemctl: pass current partial unit to     list-unit* (bsc#1155207)

  - bash-completion: systemctl: use systemctl --no-pager

  - bash-completion: also suggest template unit files

  - bash-completion: systemctl: add missing options and     verbs

  - bash-completion: use the first argument instead of the     global variable (#6457)

networkd: VXLan Make group and remote variable separate (bsc#1156213)

networkd: vxlan require Remote= to be a non multicast address (#8117) (bsc#1156213)

fs-util: let's avoid unnecessary strerror()

fs-util: introduce inotify_add_watch_and_warn() helper

ask-password: improve log message when inotify limit is reached (bsc#1155574)

shared/install: failing with -ELOOP can be due to the use of an alias in install_error() (bsc#1151377)

man: alias names can't be used with enable command (bsc#1151377)

Add boot option to not use swap at system start (jsc#SLE-7689)

Allow YaST to select Iranian (Persian, Farsi) keyboard layout (bsc#1092920)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4269-1 advisory.

    It was discovered that systemd incorrectly handled certain PIDFile files. A local attacker could possibly     use this issue to trick systemd into killing privileged processes. This issue only affected Ubuntu 16.04     LTS. (CVE-2018-16888)

    It was discovered that systemd incorrectly handled certain udevadm trigger commands. A local attacker     could possibly use this issue to cause systemd to consume resources, leading to a denial of service.
    (CVE-2019-20386)

    Jann Horn discovered that systemd incorrectly handled services that use the DynamicUser property. A local     attacker could possibly use this issue to access resources owned by a different service in the future.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2019-3843, CVE-2019-3844)

    Tavis Ormandy discovered that systemd incorrectly handled certain Polkit queries. A local attacker could     use this issue to cause systemd to crash, resulting in a denial of service, or possibly execute arbitrary     code and escalate privileges. (CVE-2020-1712)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164599	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.5)	Nessus	Misc.	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	critical
164556	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.0.5)	Nessus	Misc.	critical
164552	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.1021)	Nessus	Misc.	critical
160827	NewStart CGSL MAIN 6.02 : systemd Multiple Vulnerabilities (NS-SA-2022-0055)	Nessus	NewStart CGSL Local Security Checks	high
150993	Amazon Linux 2 : systemd (ALAS-2021-1647)	Nessus	Amazon Linux Local Security Checks	high
149869	Amazon Linux 2 : systemd (ALAS-2021-1643) (deprecated)	Nessus	Amazon Linux Local Security Checks	critical
145968	CentOS 8 : systemd (CESA-2020:4553)	Nessus	CentOS Local Security Checks	low
142800	Oracle Linux 8 : systemd (ELSA-2020-4553)	Nessus	Oracle Linux Local Security Checks	low
142403	RHEL 8 : systemd (RHSA-2020:4553)	Nessus	Red Hat Local Security Checks	low
141716	Scientific Linux Security Update : systemd on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	low
141588	CentOS 7 : systemd (RHSA-2020:4007)	Nessus	CentOS Local Security Checks	low
141225	Oracle Linux 7 : systemd (ELSA-2020-4007)	Nessus	Oracle Linux Local Security Checks	low
141022	RHEL 7 : systemd (RHSA-2020:4007)	Nessus	Red Hat Local Security Checks	low
138315	SUSE SLES12 Security Update : systemd (SUSE-SU-2020:1842-1)	Nessus	SuSE Local Security Checks	low
136330	Photon OS 2.0: Systemd PHSA-2020-2.0-0236	Nessus	PhotonOS Local Security Checks	low
136110	Photon OS 1.0: Systemd PHSA-2020-1.0-0290	Nessus	PhotonOS Local Security Checks	low
133893	Fedora 30 : systemd (2020-f8e267d6d0)	Nessus	Fedora Local Security Checks	high
133666	openSUSE Security Update : systemd (openSUSE-2020-208)	Nessus	SuSE Local Security Checks	high
133540	SUSE SLED15 / SLES15 Security Update : systemd (SUSE-SU-2020:0335-1)	Nessus	SuSE Local Security Checks	high
133523	Ubuntu 16.04 LTS / 18.04 LTS : systemd vulnerabilities (USN-4269-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2019-20386

low

Tenable Plugins

critical

critical

critical

critical

high

high

critical

low

low

low

low

low

low

low

low

low

low

high

high

high

high