quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID` frame. The attacker can prevent the receiver from sending out (the vast majority of) these `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the issue. No known workarounds are available.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bd8fe42929 advisory.

    Automatic update for caddy-2.8.4-1.fc41.

    ##### **Changelog**

    ```
    * Fri Jul  5 2024 Carl George <carlwgeorge@fedoraproject.org> - 2.8.4-1
    - Update to version 2.8.4 rhbz#2278549
    - Resolves CVE-2023-49295 rhbz#2257829
    - Resolves CVE-2024-27304 rhbz#2268278
    - Resolves CVE-2024-27289 rhbz#2268468
    - Resolves CVE-2024-28180 rhbz#2268877
    - Resolves CVE-2024-22189 rhbz#2273517
    - Remove LimitNPROC from systemd unit files

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8534 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django: Memory exhaustion in django.utils.numberformat.floatformat()     (CVE-2024-41989)
    * automation-controller: Django: Potential denial-of-service vulnerability in django.utils.html.urlize()     (CVE-2024-45230)
    * automation-gateway: XSS on automation-gateway (CVE-2024-10033)
    * receptor: quic-go: memory exhaustion attack against QUIC's connection ID mechanism (CVE-2024-22189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    * With this update, upgrades from Ansible Automation Platform 2.4 to 2.5 are supported for RPM and     Operator-based deployments for Automation controller and Automation hub. For more information on how to     upgrade, refer to the Upgrading section of the AAP landing page. (ANSTRAT-809)

    Container-based Ansible Automation Platform
    * The TLS Certificate Authority private key can now use a passphrase. (AAP-33594)
    * Automation hub is populated with container images (decision and execution environments) and Ansible     collections. (AAP-33759)
    * The Automation controller, Event-Driven Ansible, and automation hub legacy UIs now display a redirect     page to the Platform UI rather than a blank page. (AAP-33794)
    * Fixed the uninstall playbook execution when the environment was already uninstalled. (AAP-32981)
    * containerized installer setup has been updated to 2.5-3

    RPM-based Ansible Automation Platform
    * Added platform Redis to RPM-based Ansible Automation Platform. This allows a 6 node cluster for a Redis     high availability (HA) deployment. (AAP-33773)
    * Removed the variable aap_caching_mtls and replaced it with redis_disable_tls and redis_disable_mtls     which are boolean flags that disable Redis server TLS and Redis client certificate authentication.
    (AAP-33773)
    * An informative redirect page is now shown when going to automation controller, Event-Driven Ansible, or     automation hub URL. (AAP-33827)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-4

    Additional changes:
    * automation-controller has been updated to 4.6.2
    * automation-eda-controller has been updated to 1.1.2
    * automation-gateway has been updated to 2.5.3
    * automation-hub/python3.11-galaxy-ng has been updated to 4.10.1
    * python3.11-django-ansible-base has been updated to 2.5.3
    * receptor has been updated to 1.4.9

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0319-1 advisory.

    Update to version 1.11.3:

      * optimize the performance for high qps (#6767)
      * bump deps
      * Fix zone parser error handling (#6680)
      * Add alternate option to forward plugin (#6681)
      * fix: plugin/file: return error when parsing the file fails (#6699)
      * [fix:documentation] Clarify autopath README (#6750)
      * Fix outdated test (#6747)
      * Bump go version from 1.21.8 to 1.21.11 (#6755)
      * Generate zplugin.go correctly with third-party plugins (#6692)
      * dnstap: uses pointer receiver for small response writer (#6644)
      * chore: fix function name in comment (#6608)
      * [plugin/forward] Strip local zone from IPV6 nameservers (#6635)
    - fixes CVE-2023-30464
    - fixes CVE-2023-28452

    Update to upstream head (git commit #5a52707):

      * bump deps to address security issue CVE-2024-22189
      * Return RcodeServerFailure when DNS64 has no next plugin (#6590)
      * add plusserver to adopters (#6565)
      * Change the log flags to be a variable that can be set prior to calling Run (#6546)
      * Enable Prometheus native histograms (#6524)
      * forward: respect context (#6483)
      * add client labels to k8s plugin metadata (#6475)
      * fix broken link in webpage (#6488)
      * Repo controlled Go version (#6526)
      * removed the mutex locks with atomic bool (#6525)

    Update to version 1.11.2:

      * rewrite: fix multi request concurrency issue in cname rewrite  (#6407)
      * plugin/tls: respect the path specified by root plugin (#6138)
      * plugin/auto: warn when auto is unable to read elements of the directory tree (#6333)
      * fix: make the codeowners link relative (#6397)
      * plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (#6351)
      * plugin/cache: key cache on Checking Disabled (CD) bit (#6354)
      * Use the correct root domain name in the proxy plugin's TestHealthX tests (#6395)
      * Add PITS Global Data Recovery Services as an adopter (#6304)
      * Handle UDP responses that overflow with TC bit with test case (#6277)
      * plugin/rewrite: add rcode as a rewrite option (#6204)

    - CVE-2024-0874: coredns: CD bit response is cached and served later

    - Update to version 1.11.1:

      * Revert plugin/forward: Continue waiting after receiving malformed responses
      * plugin/dnstap: add support for extra field in payload
      * plugin/cache: fix keepttl parsing

    - Update to version 1.11.0:

      * Adds support for accepting DNS connections over QUIC (doq).
      * Adds CNAME target rewrites to the rewrite plugin.
      * Plus many bug fixes, and some security improvements.
      * This release introduces the following backward incompatible changes:
       + In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta,          since all supported K8s versions now use Endpointslice.
       + The bufsize plugin changed its default size limit value to 1232        + Some changes to forward plugin metrics.

    - Update to version 1.10.1:

      * Corrected architecture labels in multi-arch image manifest
      * A new plugin timeouts that allows configuration of server listener timeout durations
      * acl can drop queries as an action
      * template supports creating responses with extended DNS errors
      * New weighted policy in loadbalance
      * Option to serve original record TTLs from cache

    - Update to version 1.10.0:

            * core: add log listeners for k8s_event plugin (#5451)
            * core: log DoH HTTP server error logs in CoreDNS format (#5457)
            * core: warn when domain names are not in RFC1035 preferred syntax (#5414)
            * plugin/acl: add support for extended DNS errors (#5532)
            * plugin/bufsize: do not expand query UDP buffer size if already set to a smaller value (#5602)
            * plugin/cache: add cache disable option (#5540)
            * plugin/cache: add metadata for wildcard record responses (#5308)
            * plugin/cache: add option to adjust SERVFAIL response cache TTL (#5320)
            * plugin/cache: correct responses to Authenticated Data requests (#5191)
            * plugin/dnstap: add identity and version support for the dnstap plugin (#5555)
            * plugin/file: add metadata for wildcard record responses (#5308)
            * plugin/forward: enable multiple forward declarations (#5127)
            * plugin/forward: health_check needs to normalize a specified domain name (#5543)
            * plugin/forward: remove unused coredns_forward_sockets_open metric (#5431)
            * plugin/header: add support for query modification (#5556)
            * plugin/health: bypass proxy in self health check (#5401)
            * plugin/health: don't go lameduck when reloading (#5472)
            * plugin/k8s_external: add support for PTR requests (#5435)
            * plugin/k8s_external: resolve headless services (#5505)
            * plugin/kubernetes: make kubernetes client log in CoreDNS format (#5461)
            * plugin/ready: reset list of readiness plugins on startup (#5492)
            * plugin/rewrite: add PTR records to supported types (#5565)
            * plugin/rewrite: fix a crash in rewrite plugin when rule type is missing (#5459)
            * plugin/rewrite: fix out-of-index issue in rewrite plugin (#5462)
            * plugin/rewrite: support min and max TTL values (#5508)
            * plugin/trace : make zipkin HTTP reporter more configurable using Corefile (#5460)
            * plugin/trace: read trace context info from headers for DOH (#5439)
            * plugin/tsig: add new plugin TSIG for validating TSIG requests and signing responses (#4957)
            * core: update gopkg.in/yaml.v3 to fix CVE-2022-28948
            * core: update golang.org/x/crypto to fix CVE-2022-27191
            * plugin/acl: adding a check to parse out zone info
            * plugin/dnstap: support FQDN TCP endpoint
            * plugin/errors: add stacktrace option to log a stacktrace during panic recovery
            * plugin/template: return SERVFAIL for zone-match regex-no-match case

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22189 advisory.

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause     its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old     connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID`     frame. The attacker can prevent the receiver from sending out (the vast majority of) these     `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging     received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the     issue. No known workarounds are available. (CVE-2024-22189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211175	Fedora 41 : caddy (2024-bd8fe42929)	Nessus	Fedora Local Security Checks	medium
209894	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Release Update (Moderate) (RHSA-2024:8534)	Nessus	Red Hat Local Security Checks	medium
207881	openSUSE 15 Security Update : coredns (openSUSE-SU-2024:0319-1)	Nessus	SuSE Local Security Checks	high
203015	openSUSE 15 Security Update : caddy (openSUSE-SU-2024:0211-1)	Nessus	SuSE Local Security Checks	high
193706	CBL Mariner 2.0 Security Update: coredns (CVE-2024-22189)	Nessus	MarinerOS Local Security Checks	high

Detections

Analytics

CVE-2024-22189

high

Tenable Plugins

medium

medium

high

high

high