crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6753-1 advisory.

    Thomas Neil James Shadwell discovered that CryptoJS was using an insecure cryptographic default     configuration. A remote attacker could possibly use this issue to expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0806 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0805 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.116 and .NET Runtime 7.0.16.

    Security Fix(es):

    * dotnet: Denial of Service in SignalR server (CVE-2024-21386)

    * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0156 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0151 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0157 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 7.0.115 and .NET Runtime 7.0.15.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0158 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 6.0.126 and .NET Runtime 6.0.26.

    Security Fix(es):

    * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056)

    * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057)

    * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3669 advisory.

  - crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000     times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry     standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure     since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at     1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and     collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the     impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use     SHA256 with at least 250,000 iterations. (CVE-2023-46233)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
193904	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : CryptoJS vulnerability (USN-6753-1)	Nessus	Ubuntu Local Security Checks	critical
190500	RHEL 8 : dotnet7.0 (RHSA-2024:0806)	Nessus	Red Hat Local Security Checks	critical
190495	RHEL 9 : dotnet7.0 (RHSA-2024:0805)	Nessus	Red Hat Local Security Checks	critical
187915	RHEL 9 : .NET 6.0 (RHSA-2024:0156)	Nessus	Red Hat Local Security Checks	critical
187914	RHEL 9 : .NET 7.0 (RHSA-2024:0151)	Nessus	Red Hat Local Security Checks	critical
187913	RHEL 8 : .NET 7.0 (RHSA-2024:0157)	Nessus	Red Hat Local Security Checks	critical
187910	RHEL 8 : .NET 6.0 (RHSA-2024:0158)	Nessus	Red Hat Local Security Checks	critical
186304	Debian DLA-3669-1 : cryptojs - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2023-46233

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical