The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the open-vm- tools-12.2.0-3.el9 build changelog.

  - authentication bypass vulnerability in the vgauth module [rhel-br-9]) (CVE-2023-20867)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the linux- firmware-20230814-139.el9 build changelog.

  - Return Address Predictor velunerability leading to information disclosure (rhbz 2230418) (CVE-2023-20569)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libX11-1.7.0-9.el9 build changelog.

  - out-of-bounds memory access in _XkbReadKeySyms() (CVE-2023-43785)

  - stack exhaustion from infinite recursion in PutSubImage() (CVE-2023-43786)

  - integer overflow in XCreateImage() leading to a heap overflow (CVE-2023-43787)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the xorg-x11-server-Xwayland-21.1.3-7.el9 build changelog.

  - A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses     that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed     memory. This can lead to local privilege elevation on systems where the X server runs privileged and     remote code execution for ssh X forwarding sessions. (CVE-2023-0494)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the rust-1.71.1-1.el9 build changelog.

  - Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2,     bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on     UNIX-like systems. If the user downloaded a crate containing files writeable by any local user, another     local user could exploit this to change the source code compiled and executed by the current user. To     prevent existing cached extractions from being exploitable, the Cargo binary version 0.72.2 included in     Rust 1.71.1 or later will purge caches generated by older Cargo versions automatically. As a workaround,     configure one's system to prevent other local users from accessing the Cargo directory, usually located in     `~/.cargo`. (CVE-2023-38497)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the zlib-1.2.11-34.el9 build changelog.

  - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many     distant matches. (CVE-2018-25032)

  - zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a     large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some     common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g.,     see the nodejs/node reference). (CVE-2022-37434)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin was deprecated due to incorrect CVE matches for the build.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ruby-3.0.2-155.el9 build changelog.

  - Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.16 sometimes chooses a dependency source based on the     highest gem version number, which means that a rogue gem found at a public source may be chosen, even if     the intended choice was a private gem that is a dependency of another private gem that is explicitly     depended on by the application. NOTE: it is not correct to use CVE-2021-24105 for every Dependency     Confusion issue in every product. (CVE-2020-36327)

  - In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute     arbitrary code via | and tags in a filename. (CVE-2021-31799)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP     server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port.
    This potentially makes curl extract information about services that are otherwise private and not     disclosed (e.g., the attacker can conduct port scans and service banner extractions). (CVE-2021-31810)

  - An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does     not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-     middle attackers to bypass the TLS protections by leveraging a network position between the client and the     registry to block the StartTLS command, aka a StartTLS stripping attack. (CVE-2021-32066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glib2-2.68.4-8.el9 build changelog.

  - Rejected reason: Rejected by upstream. (CVE-2023-24593, CVE-2023-25180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the aide-0.16-100.el9 build changelog.

  - AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS     extended attributes or tmpfs ACLs), because of a heap-based buffer overflow. (CVE-2021-45417)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the qemu-kvm-6.1.0-3.el9 build changelog.

  - use-after-free during packet reassembly [rhel-av-8]) (CVE-2019-15890)

  - A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation     process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could     obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all     programs running on QEMU. (CVE-2020-10702)

  - A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of     the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via     virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a     denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the     host. (CVE-2020-10717)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before     QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary     of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server     resulting in a denial of service. (CVE-2020-10761)

  - out-of-bounds r/w access issue while processing usb packets [rhel-av-8.3.0]) (CVE-2020-14364)

  - OOB heap access via an unexpected response of iSCSI Server [rhel-av-8.2.0]) (CVE-2020-1711)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-av-8.2.0]) (CVE-2020-7039)

  - potential OOB access due to unsafe snprintf() usages [rhel-av-8.2.0]) (CVE-2020-8608)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the fence- agents-4.10.0-57.el9 build changelog.

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libxml2-2.9.13-4.el9 build changelog.

  - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference     and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. (CVE-2023-28484)

  - An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML     document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic     and memory errors, such as a double free. This behavior occurs because there is an attempt to use the     first byte of an empty string, and any value is possible (not solely the '\0' value). (CVE-2023-29469)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- requests-2.25.1-7.el9 build changelog.

  - Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to     destination servers when redirected to an HTTPS endpoint. This is a product of how we use     `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent     through the tunnel, the proxy will identify the header in the request itself and remove it prior to     forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must     be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in     Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious     actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
    (CVE-2023-32681)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the krb5-1.19.1-22.el9 build changelog.

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the xorg-x11-server-Xwayland-21.1.3-6.el9 build changelog.

  - A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the     XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger     than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges     elevation on systems where the X server is running privileged and remote code execution for ssh X     forwarding sessions. This issue does not affect systems where client and server use the same byte order.
    (CVE-2022-46340)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-20.el9 build changelog.

  - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow     reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated     with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S),     IMAP(S), POP3(S) and LDAP(S) (openldap only). (CVE-2022-22576)

  - An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are     affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with     authentication could leak credentials to other services that exist on different protocols or port numbers.
    (CVE-2022-27774)

  - An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an     IPv6 address that was in the connection pool but with a different zone id it could reuse a connection     instead. (CVE-2022-27775)

  - A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or     cookie header data on HTTP redirects to the same host but another port number. (CVE-2022-27776)

  - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed     that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for     subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were     left out from the configuration match checks, making themmatch too easily. (CVE-2022-27782)

  - curl < 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be     compressed multiple times and potentially with different algorithms. The number of acceptable links in     this decompression chain was unbounded, allowing a malicious server to insert a virtually unlimited     number of compression steps.The use of such a decompression chain could result in a malloc bomb,     makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of     memory errors. (CVE-2022-32206)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly.
    This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject     data to the client. (CVE-2022-32208)

  - When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control     codes that when later are sent back to a HTTPserver might make the server return 400 responses.
    Effectively allowing asister site to deny service to all siblings. (CVE-2022-35252)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libarchive-3.5.3-4.el9 build changelog.

  - In libarchive before 3.6.2, the software does not check for an error after calling calloc function that     can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
    NOTE: the discoverer cites this CWE-476 remark but third parties dispute the code-execution impact: In     rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it,     then writing or reading memory is possible, which may lead to code execution. (CVE-2022-36227)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- mako-1.1.4-6.el9 build changelog.

  - Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer     class to parse. This also affects babelplugin and linguaplugin. (CVE-2022-40023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the expat-2.2.10-9.el9 build changelog.

  - Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  - Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - integer overflow in function XML_GetBuffer (CVE-2022-23852)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the qt5-qtsvg-5.15.9-2.el9 build changelog.

  - In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg     QSvgFont m_unitsPerEm initialization is mishandled. (CVE-2023-32573)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtpms-0.9.1-3.20211126git1ff6fe1f43.el9 build changelog.

  - An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data     past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully     exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it     unusable) and/or arbitrary code execution in the TPM context. (CVE-2023-1017)

  - An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end     of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this     vulnerability can read or access sensitive data stored in the TPM. (CVE-2023-1018)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the wavpack-5.4.0-5.el9 build changelog.

  - heap Out-of-bounds Read (CVE-2021-44269)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the libguestfs-winsupport-9.2-1.el9 build changelog.

  - ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the     upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
    (CVE-2021-46790)

  - An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between     NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30783)

  - A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
    (CVE-2022-30784)

  - A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory     read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite. (CVE-2022-30785)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through     2021.8.22. (CVE-2022-30786)

  - An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through     2021.8.22 when using libfuse-lite. (CVE-2022-30787)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through     2021.8.22. (CVE-2022-30788)

  - A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G     through 2021.8.22. (CVE-2022-30789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the flac-1.3.3-10.el9 build changelog.

  - In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to     a missing bounds check. This could lead to local information disclosure with no additional execution     privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:
    Android-11Android ID: A-174302683 (CVE-2021-0561)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cups-2.3.3op2-16.el9 build changelog.

  - authorization bypass when using local authorization (CVE-2022-26691)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the guestfs- tools-1.48.2-5.el9 build changelog.

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- lxml-4.6.5-1.el9 build changelog.

  - lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML     Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG     files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should     upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available. (CVE-2021-43818)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pki- core-11.3.0-0.2.beta1.el9 build changelog.

  - Improper authentication/authorization with caServerKeygen_DirUserCert profile (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the grafana-9.0.9-1.el9 build changelog.

  - XSS (CVE-2021-23648)

  - Grafana is an open source data visualization platform. In affected versions unauthenticated and     authenticated users are able to view the snapshot with the lowest database key by accessing the literal     paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot public_mode configuration     setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with     the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the     snapshot public_mode setting, authenticated users are able to delete the snapshot with the lowest     database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The     combination of deletion and viewing enables a complete walk through all snapshot data while resulting in     complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason     you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths:
    /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key.
    They have no normal function and can be disabled without side effects. (CVE-2021-39226)

  - directory traversal vulnerability for *.md files (CVE-2021-43813)

  - net/http: limit growth of header canonicalization cache (CVE-2021-44716)

  - net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

  - client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods. (CVE-2022-21698)

  - XSS vulnerability in data source handling (CVE-2022-21702)

  - CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

  - IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

  - encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

  - OAuth account takeover (CVE-2022-31107)

  - net/http/httputil: NewSingleHostReverseProxy (CVE-2022-32148)

  - Escalation from admin to server admin when auth proxy is used (rhbz#2125530) (CVE-2022-35957)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the lynx-2.8.9-18.el9 build changelog.

  - Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to     discover cleartext credentials because they may appear in SNI data. (CVE-2021-38165)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the nodejs-16.19.1-1.el9 build changelog.

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - A cryptographic vulnerability exists in Node.js <19.2.0, <18.14.1, <16.19.1, <14.21.3 that in some cases     did does not clear the OpenSSL error stack after operations that may set it. This may lead to false     positive errors during subsequent cryptographic operations that happen to be on the same thread. This in     turn could be used to cause a denial of service. (CVE-2023-23919)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ncurses-6.2-8.20210508.el9 build changelog.

  - There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- lxml-4.6.5-3.el9 build changelog.

  - NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only     applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not     affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the     application. The vulnerability is caused by the iterwalk function (also used by the canonicalize     function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be     replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N     would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If     untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
    (CVE-2022-2309)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the xterm-366-8.el9 build changelog.

  - xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in     set_sixel in graphics_sixel.c via crafted text. (CVE-2022-24130)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the qemu- kvm-7.1.0-2.el9 build changelog.

  - heap buffer overflow in DMA read data transfers [rhel-9.0]) (CVE-2021-3507)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the mutt-2.2.6-1.el9 build changelog.

  - Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read     past end of input line (CVE-2022-1328)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the expat-2.4.9-1.el9 build changelog.

  - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. (CVE-2022-40674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the wireshark-3.4.10-4.el9 build changelog.

  - f5ethtrailer Infinite loop in legacy style dissector (CVE-2022-3190)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the samba-4.18.5-100.el9 build changelog.

  - An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in     winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic     challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan     manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can     trigger an out-of-bounds read in Winbind, possibly resulting in a crash. (CVE-2022-2127)

  - A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not     enforced if an admin configured server signing = required or for SMB2 connections to Domain Controllers     where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-     the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and     server, affecting the integrity of the data. (CVE-2023-3347)

  - An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not     validate a field in the network packet that contains the count of elements in an array-like structure. By     passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This     flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a     denial of service condition. (CVE-2023-34966)

  - A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing     Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys     are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a     lack of type checking in callers of the dalloc_value_for_key() function, which returns the object     associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the     passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client     connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker     process, affecting all other clients this worker serves. (CVE-2023-34967)

  - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the     server-side absolute path of shares, files, and directories in the results for search queries. This flaw     allows a malicious client or an attacker with a targeted RPC request to view the information that is part     of the disclosed path. (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-5.el9.1 build changelog.

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libvirt-9.5.0-5.el9 build changelog.

  - A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as     expected, resulting in a race condition and denial of service when attempting to lock the same object from     another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt     daemon. (CVE-2023-3750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the nodejs- nodemon-2.0.20-2.el9 build changelog.

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libcap-2.48-9.el9 build changelog.

  - A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious     actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.
    (CVE-2023-2602)

  - A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an     integer overflow if the input string is close to 4GiB. (CVE-2023-2603)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the polkit-0.117-8.el9 build changelog.

  - A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is     a setuid tool designed to allow unprivileged users to run commands as privileged users according     predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly     and ends trying to execute environment variables as commands. An attacker can leverage this by crafting     environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully     executed the attack can cause a local privilege escalation given unprivileged users administrative rights     on the target machine. (CVE-2021-4034)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ansible- core-2.14.2-4.el9 build changelog.

  - A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the     Ansible user credentials is disclosed by default in the traceback error message. The highest threat from     this vulnerability is to confidentiality. (CVE-2021-3620)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the grafana-9.0.9-2.el9 build changelog.

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Using email as a username can prevent other users from signing in (CVE-2022-39229)

  - various flaws (CVE-2022-41715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ghostscript-9.54.0-7.el9 build changelog.

  - Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called     from sampled_data_continue and interp). (CVE-2021-45949)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the perl- Encode-3.08-462.el9 build changelog.

  - Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse     Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading.
    Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through     3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has     only an integer value. (CVE-2021-36770)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libX11-1.7.0-8.el9 build changelog.

  - rhbz#2213763 (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
191265	CentOS 9 : open-vm-tools-12.2.0-3.el9	low
191264	CentOS 9 : linux-firmware-20230814-139.el9	medium
191263	CentOS 9 : libX11-1.7.0-9.el9	high
191262	CentOS 9 : xorg-x11-server-Xwayland-21.1.3-7.el9	high
191261	CentOS 9 : rust-1.71.1-1.el9	high
191260	CentOS 9 : zlib-1.2.11-34.el9	critical
191259	CentOS 9 : swtpm-0.8.0-1.el9 (deprecated)	medium
191258	CentOS 9 : ruby-3.0.2-155.el9	high
191257	CentOS 9 : glib2-2.68.4-8.el9	medium
191256	CentOS 9 : aide-0.16-100.el9	high
191255	CentOS 9 : qemu-kvm-6.1.0-3.el9	high
191254	CentOS 9 : fence-agents-4.10.0-57.el9	high
191253	CentOS 9 : libxml2-2.9.13-4.el9	medium
191252	CentOS 9 : python-requests-2.25.1-7.el9	medium
191251	CentOS 9 : krb5-1.19.1-22.el9	medium
191250	CentOS 9 : xorg-x11-server-Xwayland-21.1.3-6.el9	high
191249	CentOS 9 : curl-7.76.1-20.el9	critical
191248	CentOS 9 : libarchive-3.5.3-4.el9	critical
191247	CentOS 9 : python-mako-1.1.4-6.el9	high
191246	CentOS 9 : expat-2.2.10-9.el9	critical
191245	CentOS 9 : qt5-qtsvg-5.15.9-2.el9	medium
191244	CentOS 9 : libtpms-0.9.1-3.20211126git1ff6fe1f43.el9	high
191243	CentOS 9 : wavpack-5.4.0-5.el9	medium
191242	CentOS 9 : libguestfs-winsupport-9.2-1.el9	high
191241	CentOS 9 : flac-1.3.3-10.el9	medium
191240	CentOS 9 : cups-2.3.3op2-16.el9	medium
191239	CentOS 9 : guestfs-tools-1.48.2-5.el9	medium
191238	CentOS 9 : python-lxml-4.6.5-1.el9	high
191237	CentOS 9 : pki-core-11.3.0-0.2.beta1.el9	medium
191236	CentOS 9 : grafana-9.0.9-1.el9	high
191235	CentOS 9 : lynx-2.8.9-18.el9	medium
191234	CentOS 9 : nodejs-16.19.1-1.el9	high
191233	CentOS 9 : ncurses-6.2-8.20210508.el9	medium
191232	CentOS 9 : python-lxml-4.6.5-3.el9	high
191231	CentOS 9 : xterm-366-8.el9	medium
191230	CentOS 9 : qemu-kvm-7.1.0-2.el9	medium
191229	CentOS 9 : mutt-2.2.6-1.el9	medium
191228	CentOS 9 : expat-2.4.9-1.el9	high
191227	CentOS 9 : wireshark-3.4.10-4.el9	medium
191226	CentOS 9 : samba-4.18.5-100.el9	medium
191225	CentOS 9 : nghttp2-1.43.0-5.el9.1	high
191224	CentOS 9 : libvirt-9.5.0-5.el9	medium
191223	CentOS 9 : nodejs-nodemon-2.0.20-2.el9	critical
191222	CentOS 9 : libcap-2.48-9.el9	high
191221	CentOS 9 : polkit-0.117-8.el9	high
191220	CentOS 9 : ansible-core-2.14.2-4.el9	medium
191219	CentOS 9 : grafana-9.0.9-2.el9	high
191218	CentOS 9 : ghostscript-9.54.0-7.el9	medium
191217	CentOS 9 : perl-Encode-3.08-462.el9	high
191216	CentOS 9 : libX11-1.7.0-8.el9	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

low

medium

high

high

high

critical

medium

high

medium

high

high

high

medium

medium

medium

high

critical

critical

high

critical

medium

high

medium

high

medium

medium

medium

high

medium

high

medium

high

medium

high

medium

medium

medium

high

medium

medium

high

medium

critical

high

high

medium

high

medium

high

high