Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."

oracle CPUOct2024: MySQL Cluster 8.0.39

oracle CPUOct2024: MySQL Cluster 8.0.40

oracle CPUOct2024: MySQL Cluster 7.5.36

oracle CPUOct2024: MySQL Cluster 8.4.2

oracle CPUOct2024: MySQL Cluster 8.4.3

An update of the python3 package has been released.

The version of AOS installed on the remote host is prior to 6.8.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.6 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

  - An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for     XML_ParseBuffer. (CVE-2024-45490)

  - An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for     nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10.0.5 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure     temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions     of the running user provides a window of opportunity for attackers to escalate privileges through a     malicious symlink. (CVE-2024-5742)

  - An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for     XML_ParseBuffer. (CVE-2024-45490)

  - An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for     nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2023.2.68-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2607 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to     2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates     from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust     store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified     long-running and unresolved compliance issues. (CVE-2024-39689)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-682 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to     2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates     from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust     store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified     long-running and unresolved compliance issues. (CVE-2024-39689)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The detected version of Certifi python package, certifi, is prior to version 2024.07.04. It is, therefore, it contains untrusted root certificates from GLOBALTRUST. An unauthenticated, remote attacker can exploit this to gain arbitrary permissions within the applicaiton.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-599bb2cb73 advisory.

    Update to 2024.7.4.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
213604	Photon OS 5.0: Python3 PHSA-2024-5.0-0356	Nessus	PhotonOS Local Security Checks	high
213539	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.6)	Nessus	Misc.	critical
213288	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10.0.5)	Nessus	Misc.	critical
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	medium
205712	Amazon Linux 2 : ca-certificates (ALAS-2024-2607)	Nessus	Amazon Linux Local Security Checks	high
205106	Amazon Linux 2023 : ca-certificates (ALAS2023-2024-682)	Nessus	Amazon Linux Local Security Checks	high
204790	Python Library Certifi < 2024.07.04 Untrusted Root Certificate	Nessus	Misc.	high
202455	Fedora 40 : mingw-python-certifi (2024-599bb2cb73)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-39689

high

Tenable Plugins

Coming Soon

high

critical

critical

medium

high

high

high

high