The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3366 advisory.

  - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

  - golang: path/filepath: path-filepath filepath.Clean path traversal (CVE-2022-41722)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 / 9 : OpenShift Container Platform 4.13.2 (RHSA-2023:3366)

critical Nessus Plugin ID 194248

Version 1.0