EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality.

According to the versions of the edk2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or     Availability.(CVE-2023-45235)

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can     be exploited by an attacker to gain unauthorized access and potentially lead to a loss of     Confidentiality.(CVE-2023-45234)

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality.(CVE-2023-45229)

    EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability.(CVE-2023-45230)

    EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability.(CVE-2023-45232)

    EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized  access and potentially lead to a loss of Availability.(CVE-2023-45233)

    EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality.(CVE-2023-45231)

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can     be exploited by an attacker to gain unauthorized  access and potentially lead to a loss of     Confidentiality.(CVE-2023-45236)

    EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can     be exploited by an attacker to gain unauthorized  access and potentially lead to a loss of     Confidentiality.(CVE-2023-45237)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization edk2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4419 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message     (CVE-2023-45235)

    * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message     (CVE-2023-45229)

    * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231)

    * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236)

    * edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of edk2 / hvloader installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45229 advisory.

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12408 advisory.

    - Create new 1.7.0 release for OL7 which includes the following fixed CVEs:
      {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234}     {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
    - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
      {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215}     {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274}     {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}

    * Tue Aug 22 2023 Aaron Young <aaron.young@oracle.com>
    - Create new 1.6.6 release for OL7 which includes the following fixed CVEs:
      {CVE-2019-14560}
    - Update to OpenSSL 1.1.1v which includes the following fixed CVEs:
      {CVE-2023-3817} {CVE-2023-3446} {CVE-2023-2650} {CVE-2023-0465} {CVE-2023-0466} {CVE-2023-0464}     {CVE-2023-0286} {CVE-2023-0215} {CVE-2022-4450} {CVE-2022-4304} {CVE-2022-2097} {CVE-2022-2068}     {CVE-2022-1292} {CVE-2022-0778} {CVE-2021-4160} {CVE-2021-3712} {CVE-2021-3711} {CVE-2021-3450}     {CVE-2021-3449} {CVE-2021-23841} {CVE-2021-23840} {CVE-2020-1971} {CVE-2020-1967} {CVE-2019-1551}     {CVE-2019-1563} {CVE-2019-1549} {CVE-2019-1547} {CVE-2019-1552} {CVE-2019-1543} {CVE-2018-0734}     {CVE-2018-0735}

    * Tue Jun 13 2023 Aaron Young <aaron.young@oracle.com>
    - Create new 1.6.4.cvm release for OL7 which includes the following fixed CVEs:
      {CVE-2021-38578}

    * Tue Jun 28 2022 Aaron Young <aaron.young@oracle.com>
    - Create new 1.6.0 release for OL7 which includes the following fixed CVEs:
      {CVE-2022-0778}

    * Tue Nov 23 2021 Aaron Young <aaron.young@oracle.com>
    - Create new 1.5.0 release for OL7 which includes the following fixed CVEs:
      {CVE-2021-23840} {CVE-2021-23841} {CVE-2021-38575}

    * Thu Feb 18 2021 Aaron Young <aaron.young@oracle.com>
    - Create new 1.4.0 release for OL7 which includes the following fixed CVEs:
      {CVE-2019-14584} {CVE-2019-14562} {CVE-2019-11098} {CVE-2019-14559} {CVE-2019-14575} {CVE-2019-14559}     {CVE-2019-14587} {CVE-2019-14558} {CVE-2019-14586} {CVE-2019-14563}

    * Sat Oct 10 2020 Aaron Young <aaron.young@oracle.com>
    - Create new 1.3 release for OL7 which includes the following fixed CVEs:
      {CVE-2018-12182} {CVE-2019-13224} {CVE-2019-13225} {CVE-2019-14553}

    * Fri May 17 2019 Aaron Young <aaron.young@oracle.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12409 advisory.

    - Create new 20240227 release for OL9 which includes the following fixed CVEs:
      {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234}     {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-23120 advisory.

    - Create new 20240227 release for OL9 which includes the following fixed CVEs:
      {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234}     {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
    - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
      {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215}     {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274}     {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}

    * Tue Aug 22 2023 Aaron Young

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3017 advisory.

    - Resolves: RHEL-21158       (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846     RHEL-21848 RHEL-21850 RHEL-21852]
    - Resolves: RHEL-21840       (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise     message [rhel-8])
    - Resolves: RHEL-21844       (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options     [rhel-8])
    - Resolves: RHEL-21846       (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header     [rhel-8])
    - Resolves: RHEL-21848       (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header     [rhel-8])
    - Resolves: RHEL-21850       (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message     [rhel-8])
    - Resolves: RHEL-21852       (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise     message [rhel-8])
    - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842]
    - Resolves: RHEL-21154       (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8])
    - Resolves: RHEL-21156       (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8])
    - Resolves: RHEL-21840       (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise     message [rhel-8])
    - Resolves: RHEL-21842       (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])
    - Resolves: RHEL-7560       (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3017 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message     (CVE-2023-45235)

    * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763)

    * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764)

    * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765)

    * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message     (CVE-2023-45229)

    * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231)

    * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232)

    * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:3017 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2264 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:
    Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key     or DH parameters may experience long delays. Where the key or parameters that are being checked have been     obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs     various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too     large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is     over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or     parameters that have been supplied. Some of those checks use the supplied modulus value even if it has     already been found to be too large. An application that calls DH_check() and supplies a key or parameters     obtained from an untrusted source could be vulernable to a Denial of Service attack. The function     DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those     other functions may similarly be affected. The other functions affected by this are DH_check_ex() and     EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications     when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The     OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. (CVE-2023-3446)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2264 advisory.

    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21841 RHEL-21843 RHEL-21845     RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
    - Resolves: RHEL-21841       (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise     message [rhel-9])
    - Resolves: RHEL-21843       (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-9])
    - Resolves: RHEL-21845       (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options     [rhel-9])
    - Resolves: RHEL-21847       (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header     [rhel-9])
    - Resolves: RHEL-21849       (TRIAGE CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header     [rhel-9])
    - Resolves: RHEL-21851       (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message     [rhel-9])
    - Resolves: RHEL-21853       (TRIAGE CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy     Advertise message [rhel-9])
    - Resolves: RHEL-21157       (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-9])
    - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21155]
    - Resolves: RHEL-21155       (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-9])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2264 advisory.

    EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package     contains a sample 64-bit UEFI firmware for QEMU and KVM.

    Security Fix(es):

    * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message     (CVE-2023-45235)

    * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763)

    * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764)

    * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message     (CVE-2023-45229)

    * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231)

    * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232)

    * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233)

    * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12343 advisory.

    - Create new 20240227 release for OL8 which includes the following fixed CVEs:
      {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234}     {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
    - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
      {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215}     {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274}     {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}

    * Tue Aug 22 2023 Aaron Young

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-20865 advisory.

    - Create new 20240227 release for OL8 which includes the following fixed CVEs:
      {CVE-2023-45229} {CVE-2023-45230} {CVE-2023-45231} {CVE-2023-45232} {CVE-2023-45233} {CVE-2023-45234}     {CVE-2023-45235} {CVE-2022-36763} {CVE-2022-36764} {CVE-2022-36765}
    - Update to OpenSSL 3.0.10 which includes the following fixed CVEs:
      {CVE-2023-2975} {CVE-2023-1255} {CVE-2023-0401} {CVE-2023-0217} {CVE-2023-0216} {CVE-2023-0215}     {CVE-2022-4203} {CVE-2022-3996} {CVE-2022-3602} {CVE-2022-3786} {CVE-2022-3358} {CVE-2022-2274}     {CVE-2022-1473} {CVE-2022-1434} {CVE-2022-1343} {CVE-2021-4044} {CVE-2021-23839}

    * Tue Aug 22 2023 Aaron Young

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2483 advisory.

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a     potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from     untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and     may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL     does not correctly check for this case. This can lead to a NULL pointer dereference that results in     OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs     then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are:
    PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and     PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function     is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and     3.0 are not affected by this issue. (CVE-2024-0727)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5624 advisory.

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36763)

  - EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a     heap buffer overflow via a local network. Successful exploitation of this vulnerability may result in a     compromise of confidentiality, integrity, and/or availability. (CVE-2022-36764)

  - EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer     overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result     in a compromise of confidentiality, integrity, and/or availability. (CVE-2022-36765)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing the IA_NA or     IA_TA option in a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality. (CVE-2023-45229)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability via a long server ID option in     DHCPv6 client. This vulnerability can be exploited by an attacker to gain unauthorized access and     potentially lead to a loss of Confidentiality, Integrity and/or Availability. (CVE-2023-45230)

  - EDK2's Network Package is susceptible to an out-of-bounds read vulnerability when processing Neighbor     Discovery Redirect message. This vulnerability can be exploited by an attacker to gain unauthorized access     and potentially lead to a loss of Confidentiality. (CVE-2023-45231)

  - EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in     the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45232)

  - EDK2's Network Package is susceptible to an infinite lop vulnerability when parsing a PadN option in the     Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Availability. (CVE-2023-45233)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option     from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45235)

  - An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-     resident attacker to bypass Secure Boot. (CVE-2023-48733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202684	EulerOS Virtualization 2.10.0 : edk2 (EulerOS-SA-2024-1996)	Nessus	Huawei Local Security Checks	high
202668	EulerOS Virtualization 2.10.1 : edk2 (EulerOS-SA-2024-2014)	Nessus	Huawei Local Security Checks	high
202012	RHEL 9 : edk2 (RHSA-2024:4419)	Nessus	Red Hat Local Security Checks	high
201813	CBL Mariner 2.0 Security Update: edk2 / hvloader (CVE-2023-45229)	Nessus	MarinerOS Local Security Checks	medium
200100	Oracle Linux 7 : edk2 (ELSA-2024-12408)	Nessus	Oracle Linux Local Security Checks	high
200092	Oracle Linux 9 : edk2 (ELSA-2024-12409)	Nessus	Oracle Linux Local Security Checks	high
200091	Oracle Linux 9 : edk2 (ELSA-2024-23120)	Nessus	Oracle Linux Local Security Checks	high
198013	Oracle Linux 8 : edk2 (ELSA-2024-3017)	Nessus	Oracle Linux Local Security Checks	high
197746	RHEL 8 : edk2 (RHSA-2024:3017)	Nessus	Red Hat Local Security Checks	high
197674	CentOS 8 : edk2 (CESA-2024:3017)	Nessus	CentOS Local Security Checks	high
196955	Rocky Linux 9 : edk2 (RLSA-2024:2264)	Nessus	Rocky Linux Local Security Checks	high
195049	Oracle Linux 9 : edk2 (ELSA-2024-2264)	Nessus	Oracle Linux Local Security Checks	critical
194810	RHEL 9 : edk2 (RHSA-2024:2264)	Nessus	Red Hat Local Security Checks	critical
193858	Oracle Linux 8 : edk2 (ELSA-2024-12343)	Nessus	Oracle Linux Local Security Checks	high
193857	Oracle Linux 8 : edk2 (ELSA-2024-20865)	Nessus	Oracle Linux Local Security Checks	high
191527	Amazon Linux 2 : edk2 (ALAS-2024-2483)	Nessus	Amazon Linux Local Security Checks	high
190574	Debian dsa-5624 : ovmf - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2023-45229

medium

Tenable Plugins

high

high

high

medium

high

high

high

high

high

high

high

critical

critical

high

high

high

high