The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9968 advisory.

    - Add units tests for CVE-2022-3786, CVE-2022-3602 patches
    - Fix CVE-2022-3786, CVE-2022-3602
    - CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86       Resolves: CVE-2022-2097
    - CVE-2022-2068: the c_rehash script allows command injection
    - CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
    - CVE-2022-1343 openssl: Signer certificate verification returned       inaccurate response when using OCSP_NOCHECKS
    - CVE-2022-1292 openssl: c_rehash script allows command injection
    - CVE-2022-0778 fix
    - Fixes CVE-2021-4044 Invalid handling of X509_verify_cert() internal errors in libssl

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 9 : openssl (ELSA-2022-9968)

high Nessus Plugin ID 166774

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.10 Nov 2, 2024, 2:28 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411020228
Version 1.9 Oct 22, 2024, 6:42 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202410221842
Version 1.8 Dec 15, 2022, 4:16 PM IAVM reference Plugin Feed: 202212151616
Version 1.7 Dec 5, 2022, 10:02 PM Reference Plugin Feed: 202212052202
Version 1.6 Nov 28, 2022, 4:23 PM CVSS metrics ("CVSSv2 score" changed from "7.5" to "7.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C") CVSSv2 score source (changed from "CVE-2022-3602" to "CVE-2022-3786") Plugin Feed: 202211281623
Version 1.5 Nov 7, 2022, 3:54 PM CVSS metrics CVSSv3 score source (Changed from None to CVE-2022-3786) Plugin Feed: 202211071554
Version 1.4 Nov 4, 2022, 11:48 AM IAVM reference STIG Severity Plugin Feed: 202211041148
Version 1.3 Nov 3, 2022, 4:28 PM CVSS metrics CVSSv3 score source (Changed from None to CVE-2022-3602) Plugin Feed: 202211031628
Version 1.2 Nov 1, 2022, 11:47 PM New Plugin Feed: 202211012347