The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8906 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * mosquitto: sending specific sequences of packets may trigger memory leak     (CVE-2024-8376)
    * micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)     urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
    * python-django: Username enumeration through timing difference for users with unusable passwords     (CVE-2024-39329)
    * python-django: Potential directory-traversal in django.core.files.storage.Storage.save()     (CVE-2024-39330)
    * python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()     (CVE-2024-39614)
    * github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp     (CVE-2024-5569)
    * puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
    * python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
    * grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the     backend (CVE-2024-7246)
    * puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
    * foreman: Read-only access to entire DB from templates (CVE-2024-8553)

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3771-1 advisory.

    - CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
    - CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
    - CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
    - CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being     processed as protocol relative URLs in axios (bsc#1229423)
    - CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS)     (bsc#1224366)
    - CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to     Memory Exhaustion (bsc#1224295)
    - CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS     (bsc#1229861)
    - CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject     legitimate transactions in elliptic (bsc#1231684)
    - CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification     (bsc#1231564)
    - CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-9820d9491f advisory.

    Backport security fixes for CVE-2024-4216, CVE-2024-4068, CVE-2024-4067.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-eef12396fc advisory.

    Backport fix for CVE-2024-4067.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Mozilla: Type confusion for special arguments in IonMonkey (CVE-2020-15656)

  - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows (CVE-2020-6823)

  - Mozilla Firefox through 27 sends HTTP Cookie headers without first validating that they have the required     character-set restrictions, which allows remote attackers to conduct the equivalent of a persistent Logout     CSRF attack via a crafted parameter that forces a web application to set a malformed cookie within an HTTP     response. (CVE-2013-6167)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pcs: Cross-Site Request Forgery in web UI (CVE-2016-0720)

  - Session fixation vulnerability in pcsd in pcs before 0.9.157. (CVE-2016-0721)

  - ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to     improper validation of Node name field when creating new cluster or adding existing cluster.
    (CVE-2017-2661)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Severity
210402	RHEL 8 / 9 : Satellite 6.16.0 (Critical) (RHSA-2024:8906)	Nessus	Red Hat Local Security Checks	high
209968	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : pgadmin4 (SUSE-SU-2024:3771-1)	Nessus	SuSE Local Security Checks	critical
202327	Fedora 39 : pgadmin4 (2024-9820d9491f)	Nessus	Fedora Local Security Checks	high
202324	Fedora 40 : yarnpkg (2024-eef12396fc)	Nessus	Fedora Local Security Checks	medium
202214	RHEL 6 : gjs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
200049	RHEL 6 : firefox (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199124	RHEL 6 : pcs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-4067

medium

Tenable Plugins

high

critical

high

medium

medium

critical

high