The version of AOS installed on the remote host is prior to 6.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10 advisory.

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys     containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each     would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to     only values) as user input, and renders these in pages that other users see as well, an attacker could use     this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not     other characters. Accepting keys as user input is now explicitly considered an unintended use case of the     `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as     insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This     vulnerability is fixed in 3.1.4. (CVE-2024-34064)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function,     affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can     lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is     triggered by a crafted input that causes the `idna.encode()` function to process the input with     considerable computational load, significantly increasing the processing time in a quadratic manner     relative to the input size. (CVE-2024-3651)

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

  - A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local     network, allowing remote command execution with the privileges of the Redis user. This issue can only be     exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually.
    The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This     flaw affects PCP versions 4.3.4 and newer. (CVE-2024-3019)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753)

  - The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

  - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker     to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some     circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code     execution and secure boot protection bypass may be achieved. (CVE-2023-4692)

  - An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically     present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations.
    A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting     a high Confidentiality risk. (CVE-2023-4693)

  - A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
    (CVE-2024-1048)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10)

critical Nessus Plugin ID 208234

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Nov 6, 2024, 2:58 AM CVE (set "CVE" coverage to "CVE-2021-40153,CVE-2021-41072,CVE-2022-2880,CVE-2022-40897,CVE-2022-41715,CVE-2023-4408,CVE-2023-4692,CVE-2023-4693,CVE-2023-6597,CVE-2023-23931,CVE-2023-27043,CVE-2023-43804,CVE-2023-50387,CVE-2023-50868,CVE-2024-0450,CVE-2024-1048,CVE-2024-1753,CVE-2024-3019,CVE-2024-3651,CVE-2024-5564,CVE-2024-22195,CVE-2024-22365,CVE-2024-24786,CVE-2024-25062,CVE-2024-28176,CVE-2024-28180,CVE-2024-33599,CVE-2024-33600,CVE-2024-33601,CVE-2024-33602,CVE-2024-34064,CVE-2024-34750") CVSS metrics ("Cvssv4 score" set to 9.3) Plugin metadata Plugin Feed: 202411060258
Version 1.3 Nov 5, 2024, 12:50 PM CVE (set "CVE" coverage to "CVE-2021-40153,CVE-2021-41072,CVE-2022-2880,CVE-2022-40897,CVE-2022-41715,CVE-2023-4408,CVE-2023-4692,CVE-2023-4693,CVE-2023-6597,CVE-2023-23931,CVE-2023-27043,CVE-2023-43804,CVE-2023-50387,CVE-2023-50868,CVE-2024-0450,CVE-2024-1048,CVE-2024-1753,CVE-2024-3019,CVE-2024-3651,CVE-2024-39689,CVE-2024-5564,CVE-2024-22195,CVE-2024-22365,CVE-2024-24786,CVE-2024-25062,CVE-2024-28176,CVE-2024-28180,CVE-2024-33599,CVE-2024-33600,CVE-2024-33601,CVE-2024-33602,CVE-2024-34064,CVE-2024-34750") CVSS metrics ("Cvssv4 score" set to 9.3) Plugin metadata Plugin Feed: 202411051250
Version 1.2 Oct 25, 2024, 2:35 AM CVSS metrics ("Cvssv4 score" set to 9.3) Plugin metadata Plugin Feed: 202410250235
Version 1.1 Oct 7, 2024, 7:48 PM New Plugin Feed: 202410071948