The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8906 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * mosquitto: sending specific sequences of packets may trigger memory leak     (CVE-2024-8376)
    * micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)     urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
    * python-django: Username enumeration through timing difference for users with unusable passwords     (CVE-2024-39329)
    * python-django: Potential directory-traversal in django.core.files.storage.Storage.save()     (CVE-2024-39330)
    * python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()     (CVE-2024-39614)
    * github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp     (CVE-2024-5569)
    * puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
    * python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
    * grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the     backend (CVE-2024-7246)
    * puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
    * foreman: Read-only access to entire DB from templates (CVE-2024-8553)

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 / 9 : Satellite 6.16.0 (Critical) (RHSA-2024:8906)

high Nessus Plugin ID 210402

Version 1.2

Version 1.1

Version 1.2 Nov 6, 2024, 8:48 PM CVSS metrics ("Cvssv4 score" set to 7.2) Detection (updated detection logic) Plugin metadata Plugin Feed: 202411062048
Version 1.1 Nov 6, 2024, 2:41 PM New Plugin Feed: 202411061441