The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2553 advisory.

    Red Hat Openshift Application Runtimes provides an application platform that reduces the complexity of     developing and operating applications (monoliths and microservices) for OpenShift as a containerized     platform.

    This release of RHOAR Node.js 10.9.0 serves as a replacement for RHOAR Node.js 10.8.0, and includes bug     fixes and enhancements. For further information, refer to the Release Notes linked to in the References     section.

    Security Fix(es):

    * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client     to hang (CVE-2018-0732)

    * nodejs: Unintentional exposure of uninitialized memory (CVE-2018-7166)

    * nodejs: Out of bounds (OOB) write via UCS-2 encoding (CVE-2018-12115)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : Red Hat OpenShift Application Runtimes Node.js 10.9.0 (RHSA-2018:2553)

high Nessus Plugin ID 119403

Version 1.6