The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3203 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3203-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     November 23, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nginx     Version        : 1.14.2-2+deb10u5     CVE ID         : CVE-2021-3618 CVE-2022-41741 CVE-2022-41742     Debian Bug     : 991328

    It was discovered that parsing errors in the mp4 module of Nginx, a     high-performance web and reverse proxy server, could result in denial     of service, memory disclosure or potentially the execution of arbitrary     code when processing a malformed mp4 file.

    This module is only enabled in the nginx-extras binary package.

    In addition the following vulnerability has been fixed.

    CVE-2021-3618

        ALPACA is an application layer protocol content confusion attack,         exploiting TLS servers implementing different protocols but using         compatible certificates, such as multi-domain or wildcard certificates.
        A MiTM attacker having access to victim's traffic at the TCP/IP layer can         redirect traffic from one subdomain to another, resulting in a valid TLS         session. This breaks the authentication of TLS and cross-protocol attacks         may be possible where the behavior of one protocol service may compromise

    For Debian 10 buster, these problems have been fixed in version     1.14.2-2+deb10u5.

    We recommend that you upgrade your nginx packages.

    For the detailed security status of nginx please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nginx

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3203 : libnginx-mod-http-auth-pam - security update

critical Nessus Plugin ID 168171

Version 1.4

Version 1.3

Version 1.2

Version 1.4 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H") Plugin metadata Plugin Feed: 202501222038
Version 1.3 Nov 2, 2023, 2:21 PM IAVM reference Plugin Feed: 202311021421
Version 1.2 Nov 24, 2022, 7:45 PM New Plugin Feed: 202211241945