The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the bash-5.1.8-6.el9 build changelog.

  - A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform.
    This issue may lead to memory problems. (CVE-2022-3715)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the expat-2.4.7-1.el9 build changelog.

  - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters     into namespace URIs. (CVE-2022-25236)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.4-3.el9 build changelog.

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the texlive-20200406-26.el9 build changelog.

  - LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from     an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also     affects TeX Live before 2023 r66984 and MiKTeX before 23.5. (CVE-2023-32700)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.16-2.el9 build changelog.

  - Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the jss-5.0.3-1.el9 build changelog.

  - memory leak in TLS connection leads to OOM [rhel-9.0] (CVE-2021-4213)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the gstreamer1-plugins-good-1.18.4-6.el9 build changelog.

  - Integer overflow in matroskademux element in gst_matroska_demux_add_wvpk_header function which allows a     heap overwrite while parsing matroska files. Potential for arbitrary code execution through heap     overwrite. (CVE-2022-1920)

  - Integer overflow in avidemux element in gst_avi_demux_invert function which allows a heap overwrite while     parsing avi files. Potential for arbitrary code execution through heap overwrite. (CVE-2022-1921)

  - DOS / potential heap overwrite in mkv demuxing using zlib decompression. Integer overflow in matroskademux     element in gst_matroska_decompress_data function which causes a segfault, or could cause a heap overwrite,     depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just     a segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it     is just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of     the chunk, and it will start to write to unmapped memory). However, if using a libc implementation that     does not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1922)

  - DOS / potential heap overwrite in mkv demuxing using bzip decompression. Integer overflow in matroskademux     element in bzip decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1923)

  - DOS / potential heap overwrite in mkv demuxing using lzo decompression. Integer overflow in matroskademux     element in lzo decompression function which causes a segfault, or could cause a heap overwrite, depending     on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a     segfault or a heap overwrite. If the libc uses mmap for large chunks, and the OS supports mmap, then it is     just a segfault (because the realloc before the integer overflow will use mremap to reduce the size of the     chunk, and it will start to write to unmapped memory). However, if using a libc implementation that does     not use mmap, or if the OS does not support mmap while using libc, then this could result in a heap     overwrite. (CVE-2022-1924)

  - DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression. Integer overflow in     matroskaparse element in gst_matroska_decompress_data function which causes a heap overflow. Due to     restrictions on chunk sizes in the matroskademux element, the overflow can't be triggered, however the     matroskaparse element has no size checks. (CVE-2022-1925)

  - DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in     qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and     OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap     overwrite. (CVE-2022-2122)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the nodejs- nodemon-2.0.20-3.el9 build changelog.

  - The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service)     attacks against the enclosure regular expression. (CVE-2021-35065)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the opensc-0.23.0-2.el9 build changelog.

  - buffer overrun in pkcs15init for cardos (CVE-2023-2977)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the glibc-2.34-83.el9.7 build changelog.

  - potential use-after-free in getaddrinfo (RHEL-2426) (CVE-2023-4806)

  - buffer overflow in ld.so leading to privilege escalation (RHEL-3000) (CVE-2023-4911)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the LibRaw-0.20.2-6.el9 build changelog.

  - Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the     LibRaw_buffer_datastream::gets(char*, int) in /src/libraw/src/libraw_datastream.cpp. (CVE-2021-32142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the cpio-2.13-16.el9 build changelog.

  - GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a     dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear     whether there are common cases where the pattern file, associated with the -E option, is untrusted data.
    (CVE-2021-38185)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-8.el9 build changelog.

  - processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g.,     WRITE of size 307203) via a crafted TIFF image. (CVE-2022-48281)

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit afaabc3e. (CVE-2023-0795)

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit afaabc3e. (CVE-2023-0796)

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by     tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e.
    (CVE-2023-0797)

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit afaabc3e. (CVE-2023-0798)

  - LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit afaabc3e. (CVE-2023-0799)

  - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit 33aee127. (CVE-2023-0800)

  - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by     tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a     crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127.
    (CVE-2023-0801)

  - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit 33aee127. (CVE-2023-0802)

  - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit 33aee127. (CVE-2023-0803)

  - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause     a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is     available with commit 33aee127. (CVE-2023-0804)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-22.el9 build changelog.

  - A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all     protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations.
    When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct     after it had been freed, in its transfer shutdown code path. (CVE-2022-43552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-13.el9 build changelog.

  - heap overflow in ex_retab() may lead to crash (CVE-2022-0572)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the flatpak-1.12.8-1.el9 build changelog.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-2.el9 build changelog.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-15.el9 build changelog.

  - buffer overflow [rhel-9] (CVE-2022-0714)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libwebp-1.2.0-8.el9 build changelog.

  - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a     remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2023-4863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the qt5-qtbase-5.15.9-6.el9 build changelog.

  - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2.
    Certificate validation for TLS does not always consider whether the root of a chain is a configured CA     certificate. (CVE-2023-34410)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the sqlite-3.34.1-6.el9 build changelog.

  - SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes     are used in a string argument to a C API. (CVE-2022-35737)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libldb-2.5.2-1.el9 build changelog.

  - A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP     message values freed by a preceding database module, resulting in a use-after-free issue. This issue is     only possible when modifying certain privileged attributes, such as userAccountControl. (CVE-2022-32746)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the toolbox-0.0.99.3-9.el9 build changelog.

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the podman-4.1.1-3.el9 build changelog.

  - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the     header canonicalization cache via HTTP/2 requests. (CVE-2021-44716)

  - Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion. (CVE-2021-44717)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the dbus-1.12.20-8.el9 build changelog.

  - D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with     control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus     traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-     daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus,     this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
    (CVE-2023-34969)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the nodejs-16.16.0-1.el9 build changelog.

  - Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through     log files. The CLI supports URLs like     <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. The password value is not redacted     and is printed to stdout and also to any generated log files. (CVE-2020-15095)

  - Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application     crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns     library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection     vulnerabilities in applications using the library. (CVE-2021-22931)

  - If the Node.js https API was used incorrectly and undefined was in passed for the rejectUnauthorized     parameter, no error was returned and connections to servers with an expired certificate would have been     accepted. (CVE-2021-22939)

  - Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker     might be able to exploit the memory corruption, to change process behavior. (CVE-2021-22940)

  - The parser in accepts requests with a space (SP) right after the header name before the colon. This can     lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6. (CVE-2021-22959)

  - The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of     chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. (CVE-2021-22960)

  - ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a     denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of     service. This issue only affects consumers using the strict option. (CVE-2021-27290)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency     information in package-lock.json differs from package.json. This behavior is inconsistent with the     documentation, and makes it easier for attackers to install malware that was supposed to have been blocked     by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a     vulnerability. It would require someone to socially engineer package.json which has different dependencies     than package-lock.json. That user would have to have file system or write access to change dependencies.
    The npm team states preventing malicious actors from socially engineering or gaining file system access is     outside the scope of the npm CLI. (CVE-2021-43616)

  - Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a     particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3,     < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use.
    Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js     with the fix for this disable the URI SAN type when checking a certificate against a hostname. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44531)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a     string format. It uses this string to check peer certificates against hostnames when validating     connections. The string format was subject to an injection vulnerability when name constraints were used     within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix     for this escape SANs containing the problematic characters in order to prevent the injection. This     behavior can be reverted through the --security-revert command-line option. (CVE-2021-44532)

  - Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished     Names correctly. Attackers could craft certificate subjects containing a single-value Relative     Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in     order to inject a Common Name that would allow bypassing the certificate subject verification.Affected     versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not     vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation     of certificate subjects may be vulnerable. (CVE-2021-44533)

  - Due to the formatting logic of the console.table() function it was not safe to allow user controlled     input to be passed to the properties parameter while simultaneously passing a plain object with at least     one property as the first parameter, which could be __proto__. The prototype pollution has very limited     control, in that it only allows an empty string to be assigned to numerical keys of the object     prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object     these properties are being assigned to. (CVE-2022-21824)

  - A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an     insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check     if an IP address is invalid before making DBS requests allowing rebinding attacks. (CVE-2022-32212)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse     and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). (CVE-2022-32213)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use     the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32214)

  - The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly     handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
    (CVE-2022-32215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the dbus- broker-28-7.el9 build changelog.

  - An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when     supplying a malformed XML config file. (CVE-2022-31213)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the postgresql-13.7-1.el9 build changelog.

  - A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a     privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH     MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all     during the process. This flaw allows an attacker with permission to create non-temporary objects in at     least one schema to execute arbitrary SQL functions under a superuser identity. (CVE-2022-1552)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the librsvg2-2.50.7-2.el9 build changelog.

  - A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote     attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by     href=.?../../../../../../../../../../etc/passwd in an xi:include element. (CVE-2023-38633)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.3-7.el9 build changelog.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the tang-11-1.el9 build changelog.

  - A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private     keys. (CVE-2021-4076)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nss-3.79.0-14.el9 build changelog.

  - NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow     when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures     encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for     certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how     they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and     PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and     Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.
    (CVE-2021-43527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the yajl-2.1.0-22.el9 build changelog.

  - There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory     in server and cause crash. (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the podman-4.6.0-0.3.el9 build changelog.

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and     1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct     access to a container and manipulates their supplementary group access, they may be able to use     supplementary group access to bypass primary group restrictions in some cases, potentially gaining access     to sensitive information or gaining the ability to execute code in that container. Downstream applications     that use the containerd client library may be affected as well. This bug has been fixed in containerd     v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue.
    Users who rely on a downstream application that uses containerd's client library should check that     application for a separate advisory and instructions. As a workaround, ensure that the `USER $USERNAME`     Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to     `ENTRYPOINT [su, -, user]` to allow `su` to properly set up supplementary groups. (CVE-2023-25173)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the python3.9-3.9.14-1.el9 build changelog.

  - In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands     discovered in the system mailcap file. This may allow attackers to inject shell commands into applications     that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or     arguments). The fix is also back-ported to 3.7, 3.8, 3.9 (CVE-2015-20107)

  - A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when     using int(text), a system could take 50ms to parse an int string with 100,000 digits and 5s for     1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not     affected). The highest threat from this vulnerability is to system availability. (CVE-2020-10735)

  - Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection     against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is     disputed by a third party because the http.server.html documentation page states Warning: http.server is     not recommended for production. It only implements basic security checks. (CVE-2021-28861)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- pip-21.2.3-7.el9 build changelog.

  - Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in     Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in     filenames in a TAR archive, a related issue to CVE-2001-1267. (CVE-2007-4559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libnbd-1.12.4-3.el9 build changelog.

  - A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using     asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as     successful, rather than checking the *error parameter. This could result in the silent creation of a     corrupted destination image. (CVE-2022-0485)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the dnsmasq-2.85-6.el9 build changelog.

  - A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker     who sends a crafted packet processed by dnsmasq, potentially causing a denial of service. (CVE-2022-0934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the skopeo-1.12.0-3.el9 build changelog.

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution. (CVE-2023-24540)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the bcel-6.4.1-9.el9 build changelog.

  - Apache Commons BCEL has a number of APIs that would normally only allow changing specific class     characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce     arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those     APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to     Apache Commons BCEL 6.6.0. (CVE-2022-42920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the python3.11-3.11.5-1.el9 build changelog.

  - An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x     before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If     a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly,     there is a brief window where the SSLSocket instance will detect the socket as not connected and won't     initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not     be authenticated if the server-side TLS peer is expecting client certificate authentication, and is     indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the     buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path     requires that the connection be closed on initialization of the SSLSocket.) (CVE-2023-40217)

  - An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to     os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible     cases in which an application would have rejected a filename for security reasons in Python 3.10.x or     earlier, but that filename is no longer rejected in Python 3.11.x. (CVE-2023-41105)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the podman-4.3.0-2.el9 build changelog.

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the keepalived-2.2.4-2.el9 build changelog.

  - In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination,     allowing any user to inspect and manipulate any property. This leads to access-control bypass in some     situations in which an unrelated D-Bus system service has a settable (writable) property (CVE-2021-44225)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-28.el9 build changelog.

  - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to     pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting     done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected     to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due     to this bug, the local variable that means let the host resolve the name could get the wrong value     during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target     buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,     and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cmake-3.20.2-8.el9 build changelog.

  - Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5,     2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a     malicious actor. When performing a local clone (where the source and target of the clone are on the same     volume), Git copies the contents of the source's `$GIT_DIR/objects` directory into the destination by     either creating hardlinks to the source contents, or copying them (if hardlinks are disabled via `--no-     hardlinks`). A malicious actor could convince a victim to clone a repository with a symbolic link pointing     at sensitive information on the victim's machine. This can be done either by having the victim clone a     malicious repository on the same machine, or having them clone a malicious repository embedded as a bare     repository via a submodule from any source, provided they clone with the `--recurse-submodules` option.
    Git does not create symbolic links in the `$GIT_DIR/objects` directory. The problem has been patched in     the versions published on 2022-10-18, and backported to v2.30.x. Potential workarounds: Avoid cloning     untrusted repositories using the `--local` optimization when on a shared machine, either by passing the     `--no-local` option to `git clone` or cloning from a URL that uses the `file://` scheme. Alternatively,     avoid cloning repositories from untrusted sources with `--recurse-submodules` or run `git config --global     protocol.file.allow user`. (CVE-2022-39253)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the speex-1.2.0-11.el9 build changelog.

  - divide by zero in read_samples() via crafted WAV file (CVE-2020-23903)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the python- oauthlib-3.1.1-5.el9 build changelog.

  - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions     3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker     can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications     using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1     contains a patch. There are no known workarounds. (CVE-2022-36087)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the cjose-0.6.1-16.el9 build changelog.

  - AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE     (CVE-2023-37464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the iperf3-3.9-11.el9 build changelog.

  - iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length     field. (CVE-2023-38403)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the util-linux-2.37.4-3.el9 build changelog.

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE     filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker     in its string form. An attacker may use this flaw to cause a denial of service to applications that use     the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged     user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other     users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable     directory. An attacker may use this flaw to cause a denial of service to applications that use the     affected filesystems. (CVE-2021-3996)

  - A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The     Readline library uses an INPUTRC environment variable to get a path to the library config file. When the     library cannot parse the specified file, it prints an error message containing data from the file. This     flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation.
    This flaw affects util-linux versions prior to 2.37.4. (CVE-2022-0563)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
191405	CentOS 9 : bash-5.1.8-6.el9	high
191404	CentOS 9 : expat-2.4.7-1.el9	critical
191403	CentOS 9 : toolbox-0.0.99.4-3.el9	critical
191402	CentOS 9 : texlive-20200406-26.el9	high
191401	CentOS 9 : python3.9-3.9.16-2.el9	medium
191400	CentOS 9 : jss-5.0.3-1.el9	high
191399	CentOS 9 : gstreamer1-plugins-good-1.18.4-6.el9	high
191398	CentOS 9 : nodejs-nodemon-2.0.20-3.el9	high
191397	CentOS 9 : opensc-0.23.0-2.el9	high
191396	CentOS 9 : glibc-2.34-83.el9.7	high
191395	CentOS 9 : LibRaw-0.20.2-6.el9	high
191394	CentOS 9 : cpio-2.13-16.el9	high
191393	CentOS 9 : libtiff-4.4.0-8.el9	medium
191392	CentOS 9 : curl-7.76.1-22.el9	medium
191391	CentOS 9 : vim-8.2.2637-13.el9	high
191390	CentOS 9 : flatpak-1.12.8-1.el9	medium
191389	CentOS 9 : runc-1.1.7-2.el9	high
191388	CentOS 9 : vim-8.2.2637-15.el9	medium
191387	CentOS 9 : libwebp-1.2.0-8.el9	high
191386	CentOS 9 : qt5-qtbase-5.15.9-6.el9	medium
191385	CentOS 9 : sqlite-3.34.1-6.el9	high
191384	CentOS 9 : libldb-2.5.2-1.el9	medium
191383	CentOS 9 : toolbox-0.0.99.3-9.el9	medium
191382	CentOS 9 : podman-4.1.1-3.el9	medium
191381	CentOS 9 : dbus-1.12.20-8.el9	medium
191380	CentOS 9 : nodejs-16.16.0-1.el9	critical
191379	CentOS 9 : dbus-broker-28-7.el9	high
191378	CentOS 9 : postgresql-13.7-1.el9	high
191377	CentOS 9 : librsvg2-2.50.7-2.el9	medium
191376	CentOS 9 : toolbox-0.0.99.3-7.el9	medium
191375	CentOS 9 : tang-11-1.el9	high
191374	CentOS 9 : nss-3.79.0-14.el9	critical
191373	CentOS 9 : yajl-2.1.0-22.el9	medium
191372	CentOS 9 : podman-4.6.0-0.3.el9	critical
191371	CentOS 9 : python3.9-3.9.14-1.el9	high
191370	CentOS 9 : python-pip-21.2.3-7.el9	medium
191369	CentOS 9 : libnbd-1.12.4-3.el9	medium
191368	CentOS 9 : dnsmasq-2.85-6.el9	high
191367	CentOS 9 : skopeo-1.12.0-3.el9	critical
191366	CentOS 9 : bcel-6.4.1-9.el9	critical
191365	CentOS 9 : python3.11-3.11.5-1.el9	high
191364	CentOS 9 : podman-4.3.0-2.el9	low
191363	CentOS 9 : keepalived-2.2.4-2.el9	medium
191362	CentOS 9 : curl-7.76.1-28.el9	critical
191361	CentOS 9 : cmake-3.20.2-8.el9	medium
191360	CentOS 9 : speex-1.2.0-11.el9	medium
191359	CentOS 9 : python-oauthlib-3.1.1-5.el9	medium
191358	CentOS 9 : cjose-0.6.1-16.el9	high
191357	CentOS 9 : iperf3-3.9-11.el9	high
191356	CentOS 9 : util-linux-2.37.4-3.el9	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

critical

critical

high

medium

high

high

high

high

high

high

high

medium

medium

high

medium

high

medium

high

medium

high

medium

medium

medium

medium

critical

high

high

medium

medium

high

critical

medium

critical

high

medium

medium

high

critical

critical

high

low

medium

critical

medium

medium

medium

high

high

medium