The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4724 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write (CVE-2024-4467)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4719 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474)

    * httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475)

    * httpd: NULL pointer dereference in mod_proxy (CVE-2024-38477)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4727 advisory.

    The Advanced Virtualization module provides the user-space component     for running virtual machines that use KVM in environments managed by Red     Hat products.

    Security Fix(es):

    * A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image     file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the     host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an     existing external file. (CVE-2024-4467)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4718 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in NSS (CVE-2024-6602)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4726 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475)

    * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474)

    * httpd: null pointer dereference in mod_proxy (CVE-2024-38477)

    * httpd: Potential SSRF in mod_rewrite (CVE-2024-39573)

    * httpd: Encoding problem in mod_proxy (CVE-2024-38473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4716 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4717 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in NSS (CVE-2024-6602)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4713 advisory.

    This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify     the code of a running kernel.

    Security Fix(es):

    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4597 advisory.

    Jenkins is a continuous integration server that monitors the execution of recurring jobs, such as software     builds or cron jobs.

    Security Fix(es):

    * jenkins-plugin/script-security: Sandbox bypass via sandbox-defined classes (CVE-2024-34145)

    * jenkins-plugin/script-security: Sandbox bypass via crafted constructor bodies (CVE-2024-34144)

    * jenkins-2-plugins: Improper input sanitization in HTML Publisher Plugin (CVE-2024-28149)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    * jetty: Stop accepting new connections from valid clients (CVE-2024-22201)

    * ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    * jenkins-2-plugins: matrix-project plugin path traversal vulnerability (CVE-2024-23900)

    * runc: File descriptor leak (CVE-2024-21626, Leaky-Vessels)

    * jenkins-2-plugins: git-server plugin arbitrary file read vulnerability (CVE-2024-23899)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4671 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in NSS (CVE-2024-6602)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4672 advisory.

    The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-     ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI     concerns itself only with network connectivity of containers and removing allocated resources when the     container is deleted.

    Security Fix(es):

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4670 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in NSS (CVE-2024-6602)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4673 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4645 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4646 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4642 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4567 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4647 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4634 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4636 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4640 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4635 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4644 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4643 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4641 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4564 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4639 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4638 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4620 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4624 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4623 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4621 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4617 advisory.

    Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string,     xml, and network handling in Qt.

    Security Fix(es):

    * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4633 advisory.

    389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the     Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

    Security Fix(es):

    * 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in     log_entry_attr) (CVE-2024-1062)

    * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199)

    * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657)

    * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4560 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4622 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4625 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in NSS (CVE-2024-6602)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4618 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4610 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4619 advisory.

    Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery     Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

    Security Fix(es):

    * libndp: buffer overflow in route information length field (CVE-2024-5564)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4563 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4568 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4590 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4586 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    Security Fix(es):

    * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13     (CVE-2024-6604)

    * Mozilla: Race condition in permission assignment (CVE-2024-6601)

    * Mozilla: Memory corruption in thread creation (CVE-2024-6603)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4573 advisory.

    The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java     Software Development Kit.

    Security Fix(es):

    * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)

    * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)

    * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)

    * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)

    * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4583 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886)

    * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in     hns_dsaf_ge_srst_by_port() (CVE-2021-47548)

    * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596)

    * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627)

    * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638)

    * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783)

    * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after     populating the metadata_map (CVE-2024-26858)

    * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397)

    * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435)

    * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958)

    * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904)

    * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543)

    * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)

    * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593)

    * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270)

    * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957)

    * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:4486 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.45. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:4484

    Security Fix(es):

    * cri-o: malicious container can create symlink on host (CVE-2024-5154)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4575 advisory.

    The linux-firmware packages contain all of the firmware files that are required by various devices to     operate.

    Security Fix(es):

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635)

    * hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-40964)

    * hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

    * hw: amd: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem     (CVE-2023-20592)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4581 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4579 advisory.

    Git is a distributed revision control system with a decentralized architecture. As opposed to centralized     version control systems with a client-server model, Git ensures that each working copy of a Git repository     is an exact copy with complete revision history. This not only allows the user to work on and contribute     to projects without the need to have permission to push the changes to their official repositories, but     also makes it possible for the user to work with no network connection.

    Security Fix(es):

    * git: Recursive clones RCE (CVE-2024-32002)

    * git: RCE while cloning local repos (CVE-2024-32004)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Severity
203138	RHEL 8 : virt:av and virt-devel:av (RHSA-2024:4724)	high
203137	RHEL 8 : httpd:2.4 (RHSA-2024:4719)	critical
203136	RHEL 8 : Advanced Virtualization 8.2.1z (RHSA-2024:4727)	high
203135	RHEL 8 : thunderbird (RHSA-2024:4718)	critical
203134	RHEL 9 : httpd (RHSA-2024:4726)	critical
203133	RHEL 9 : openssh (RHSA-2024:4716)	high
203019	RHEL 8 : thunderbird (RHSA-2024:4717)	critical
203017	RHEL 9 : kpatch-patch (RHSA-2024:4713)	high
202767	RHEL 8 : Red Hat Product OCP Tools 4.15 OpenShift Jenkins (RHSA-2024:4597)	critical
202752	RHEL 8 : thunderbird (RHSA-2024:4671)	critical
202751	RHEL 9 : containernetworking-plugins (RHSA-2024:4672)	high
202750	RHEL 9 : thunderbird (RHSA-2024:4670)	critical
202749	RHEL 9 : firefox (RHSA-2024:4673)	high
202715	RHEL 9 : qt5-qtbase (RHSA-2024:4645)	medium
202714	RHEL 8 : qt5-qtbase (RHSA-2024:4646)	medium
202713	RHEL 9 : libndp (RHSA-2024:4642)	high
202648	RHEL 8 / 9 : java-11-openjdk (RHSA-2024:4567)	high
202647	RHEL 7 : qt5-qtbase (RHSA-2024:4647)	medium
202646	RHEL 8 : firefox (RHSA-2024:4634)	high
202645	RHEL 9 : libndp (RHSA-2024:4636)	high
202644	RHEL 8 : libndp (RHSA-2024:4640)	high
202643	RHEL 8 : thunderbird (RHSA-2024:4635)	high
202642	RHEL 8 : qt5-qtbase (RHSA-2024:4644)	medium
202641	RHEL 8 : libndp (RHSA-2024:4643)	high
202640	RHEL 8 : libndp (RHSA-2024:4641)	high
202639	RHEL 7 : java-11-openjdk (RHSA-2024:4564)	high
202638	RHEL 8 : qt5-qtbase (RHSA-2024:4639)	medium
202637	RHEL 9 : qt5-qtbase (RHSA-2024:4638)	medium
202613	RHEL 8 : libndp (RHSA-2024:4620)	high
202612	RHEL 9 : thunderbird (RHSA-2024:4624)	high
202611	RHEL 9 : qt5-qtbase (RHSA-2024:4623)	medium
202610	RHEL 8 : qt5-qtbase (RHSA-2024:4621)	medium
202609	RHEL 8 : qt5-qtbase (RHSA-2024:4617)	medium
202608	RHEL 9 : 389-ds-base (RHSA-2024:4633)	high
202607	RHEL 7 : java-1.8.0-openjdk (RHSA-2024:4560)	high
202606	RHEL 7 : libndp (RHSA-2024:4622)	high
202605	RHEL 9 : thunderbird (RHSA-2024:4625)	critical
202604	RHEL 8 : libndp (RHSA-2024:4618)	high
202603	RHEL 8 : firefox (RHSA-2024:4610)	high
202602	RHEL 9 : libndp (RHSA-2024:4619)	high
202582	RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2024:4563)	high
202580	RHEL 8 / 9 : java-17-openjdk (RHSA-2024:4568)	high
202575	RHEL 8 : firefox (RHSA-2024:4590)	high
202574	RHEL 8 : firefox (RHSA-2024:4586)	high
202573	RHEL 8 / 9 : java-21-openjdk (RHSA-2024:4573)	high
202561	RHEL 9 : kernel (RHSA-2024:4583)	high
202560	RHEL 8 / 9 : OpenShift Container Platform 4.13.45 (RHSA-2024:4486)	high
202500	RHEL 8 : linux-firmware (RHSA-2024:4575)	medium
202499	RHEL 9 : podman (RHSA-2024:4581)	high
202498	RHEL 8 : git (RHSA-2024:4579)	critical

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

high

critical

high

critical

critical

high

critical

high

critical

critical

high

critical

high

medium

medium

high

high

medium

high

high

high

high

medium

high

high

high

medium

medium

high

high

medium

medium

medium

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

medium

high

critical