The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6659 advisory.

  - python: tarfile module directory traversal (CVE-2007-4559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6685 advisory.

  - tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6745 advisory.

  - curl: heap based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)

  - curl: cookie injection with none file (CVE-2023-38546)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6667 advisory.

  - samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127)

  - samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966)

  - samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967)

  - samba: spotlight server-side share path disclosure (CVE-2023-34968)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6596 advisory.

  - cups: heap buffer overflow may lead to DoS (CVE-2023-32324)

  - cups: use-after-free in cupsdAcceptClient() in scheduler/client.c (CVE-2023-34241)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6661 advisory.

  - gmp: Integer overflow and resultant buffer overflow via crafted input (CVE-2021-43618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6369 advisory.

  - qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573)

  - qt: buffer over-read via a crafted reply from a DNS server (CVE-2023-33285)

  - qt: allows remote attacker to bypass security restrictions caused by flaw in certificate validation     (CVE-2023-34410)

  - qtbase: buffer overflow in QXmlStreamReader (CVE-2023-37369)

  - qtbase: infinite loops in QXmlStreamReader (CVE-2023-38197)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6631 advisory.

  - glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499)

  - glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611)

  - glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6694 advisory.

  - python: tarfile module directory traversal (CVE-2007-4559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6363 advisory.

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6699 advisory.

  - krb5: Denial of service through freeing uninitialized pointer (CVE-2023-36054)

  - krb5: double-free in KDC TGS processing (CVE-2023-39975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6469 advisory.

  - wireshark: RTPS dissector crash (CVE-2023-0666)

  - wireshark: IEEE C37.118 Synchrophasor dissector crash (CVE-2023-0668)

  - wireshark: Candump log file parser crash (CVE-2023-2855)

  - wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856)

  - wireshark: NetScaler file parser crash (CVE-2023-2858)

  - wireshark: XRA dissector infinite loop (CVE-2023-2952)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6575 advisory.

  - libtiff: null pointer deference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731)

  - libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316)

  - libtiff: memory leak in tiffcrop.c (CVE-2023-3576)

  - libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c (CVE-2023-26965)

  - libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6473 advisory.

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - containerd: Supplementary groups are not set up properly (CVE-2023-25173)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6615 advisory.

  - python-cryptography: memory corruption via immutable objects (CVE-2023-23931)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6368 advisory.

  - QEMU: hcd-ehci: DMA reentrancy issue (incomplete fix for CVE-2021-3750) (CVE-2023-2680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6431 advisory.

  - json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6570 advisory.

  - Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)

  - tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)

  - tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6420 advisory.

  - grafana: persistent xss in grafana core plugins (CVE-2022-23552)

  - grafana: plugin signature bypass (CVE-2022-31123)

  - grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins     (CVE-2022-31130)

  - grafana: Data source and plugin proxy endpoints could leak the authentication cookie to some destination     plugins (CVE-2022-39201)

  - grafana: email addresses and usernames cannot be trusted (CVE-2022-39306)

  - grafana: User enumeration via forget password (CVE-2022-39307)

  - grafana: Spoofing of the originalUrl parameter of snapshots (CVE-2022-39324)

  - golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6492 advisory.

  - tang: Race condition exists in the key generation and rotation functionality (CVE-2023-1672)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6497 advisory.

  - libX11: InitExt.c can overwrite unintended portions of the Display structure if the extension request     leads to a buffer overflow (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6343 advisory.

  - LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp     (CVE-2021-32142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6551 advisory.

  - yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6595 advisory.

  - hw: intel: Improper access control for some Intel(R) PROSet/Wireless WiFi (CVE-2022-27635, CVE-2022-40964)

  - hw: intel: Improper input validation in some Intel(R) PROSet/Wireless WiFi (CVE-2022-36351,     CVE-2022-38076)

  - hw: intel: Protection mechanism failure for some Intel(R) PROSet/Wireless WiFi (CVE-2022-46329)

  - hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6340 advisory.

  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6341 advisory.

  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability     (CVE-2023-1393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6566 advisory.

  - libmicrohttpd: remote DoS (CVE-2023-27371)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6698 advisory.

  - ncurses: Local users can trigger security-relevant memory corruption via malformed data (CVE-2023-29491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6523 advisory.

  - python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations     (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6748 advisory.

  - squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846)

  - squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847)

  - squid: denial of Service in FTP (CVE-2023-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6474 advisory.

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - containerd: Supplementary groups are not set up properly (CVE-2023-25173)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6732 advisory.

  - Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6434 advisory.

  - frr: Reachable assertion in peek_for_as4_capability function (CVE-2022-36440)

  - frr: denial of service by crafting a BGP OPEN message with an option of type 0xff (CVE-2022-40302)

  - frr: denial of service by crafting a BGP OPEN message with an option of type in bgp_open_option_parse in     the bgp_open.c 0xff (CVE-2022-40318)

  - frr: out-of-bounds read exists in the BGP daemon of FRRouting (CVE-2022-43681)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6365 advisory.

  - mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

  - mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6643 advisory.

  - libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)

  - libssh: authorization bypass in pki_verify_data_signature (CVE-2023-2283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6494 advisory.

  - python: tarfile module directory traversal (CVE-2007-4559)

  - python: file path truncation at \0 characters (CVE-2023-41105)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6380 advisory.

  - runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container     configuration (CVE-2021-43784)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

  - runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

  - runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6549 advisory.

  - libreswan: Invalid IKEv2 REKEY proposal causes restart (CVE-2023-38710)

  - libreswan: Invalid IKEv1 Quick Mode ID causes restart (CVE-2023-38711)

  - libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart (CVE-2023-38712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6542 advisory.

  - http-tiny: insecure TLS cert default (CVE-2023-31486)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6385 advisory.

  - liblouis: buffer overflow in lou_logFile function at logginc.c (CVE-2023-26767)

  - liblouis: buffer overflow in lou_setDataPath (CVE-2023-26768)

  - liblouis: buffer overflow in Lou_Trace (CVE-2023-26769)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6544 advisory.

  - ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879)

  - ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS     (CVE-2023-38559)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a denial of service vulnerability as referenced in the RHSA-2023:6330 advisory.

  - Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be     very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL     subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to     very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT     IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit.
    OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the     OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT     IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER     is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the     translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n'     being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic     algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs     in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be     received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to     specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest     passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any     version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In     OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts     anything that processes X.509 certificates, including simple things like verifying its signature. The     impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's     certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client     authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509     certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so     these versions are considered not affected by this issue in such a way that it would be cause for concern,     and the severity is therefore considered low. (CVE-2023-2650)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6518 advisory.

  - flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)

  - flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6524 advisory.

  - dnsmasq: default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 (CVE-2023-28450)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6707 advisory.

  - avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468)

  - avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted     hostnames (CVE-2021-3502)

  - avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6346 advisory.

  - go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6402 advisory.

  - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

  - golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

  - golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

  - golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

  - golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

  - golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

  - golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

  - golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

  - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

  - golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6539 advisory.

  - perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS (CVE-2023-31484)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6429 advisory.

  - postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6372 advisory.

  - libiberty: Heap/stack buffer overflow in the dlang_lname function in d-demangle.c (CVE-2021-3826)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Severity
185145	RHEL 9 : python3.9 (RHSA-2023:6659)	medium
185144	RHEL 9 : tpm2-tss (RHSA-2023:6685)	medium
185143	RHEL 9 : curl (RHSA-2023:6745)	critical
185142	RHEL 9 : samba (RHSA-2023:6667)	medium
185141	RHEL 9 : cups (RHSA-2023:6596)	high
185140	RHEL 9 : gmp (RHSA-2023:6661)	high
185139	RHEL 9 : qt5 (RHSA-2023:6369)	medium
185138	RHEL 9 : glib2 (RHSA-2023:6631)	high
185137	RHEL 9 : python-pip (RHSA-2023:6694)	medium
185136	RHEL 9 : skopeo (RHSA-2023:6363)	critical
185135	RHEL 9 : krb5 (RHSA-2023:6699)	high
185134	RHEL 9 : wireshark (RHSA-2023:6469)	medium
185133	RHEL 9 : libtiff (RHSA-2023:6575)	medium
185132	RHEL 9 : buildah (RHSA-2023:6473)	critical
185131	RHEL 9 : python-cryptography (RHSA-2023:6615)	medium
185130	RHEL 9 : qemu-kvm (RHSA-2023:6368)	high
185129	RHEL 9 : libfastjson (RHSA-2023:6431)	high
185128	RHEL 9 : tomcat (RHSA-2023:6570)	medium
185127	RHEL 9 : grafana (RHSA-2023:6420)	high
185126	RHEL 9 : tang (RHSA-2023:6492)	medium
185125	RHEL 9 : libX11 (RHSA-2023:6497)	high
185124	RHEL 9 : LibRaw (RHSA-2023:6343)	high
185123	RHEL 9 : yajl (RHSA-2023:6551)	medium
185122	RHEL 9 : linux-firmware (RHSA-2023:6595)	high
185121	RHEL 9 : xorg-x11-server (RHSA-2023:6340)	high
185120	RHEL 9 : xorg-x11-server-Xwayland (RHSA-2023:6341)	high
185119	RHEL 9 : libmicrohttpd (RHSA-2023:6566)	medium
185118	RHEL 9 : ncurses (RHSA-2023:6698)	high
185117	RHEL 9 : python-tornado (RHSA-2023:6523)	medium
185116	RHEL 9 : squid (RHSA-2023:6748)	medium
185115	RHEL 9 : podman (RHSA-2023:6474)	critical
185114	RHEL 9 : ghostscript (RHSA-2023:6732)	high
185113	RHEL 9 : frr (RHSA-2023:6434)	high
185112	RHEL 9 : mod_auth_openidc (RHSA-2023:6365)	medium
185111	RHEL 9 : libssh (RHSA-2023:6643)	medium
185110	RHEL 9 : python3.11 (RHSA-2023:6494)	high
185109	RHEL 9 : runc (RHSA-2023:6380)	high
185108	RHEL 9 : libreswan (RHSA-2023:6549)	medium
185107	RHEL 9 : perl-HTTP-Tiny (RHSA-2023:6542)	high
185106	RHEL 9 : liblouis (RHSA-2023:6385)	high
185105	RHEL 9 : ghostscript (RHSA-2023:6544)	critical
185104	RHEL 9 : edk2 (RHSA-2023:6330)	medium
185103	RHEL 9 : flatpak (RHSA-2023:6518)	medium
185102	RHEL 9 : dnsmasq (RHSA-2023:6524)	high
185101	RHEL 9 : avahi (RHSA-2023:6707)	medium
185100	RHEL 9 : toolbox (RHSA-2023:6346)	critical
185099	RHEL 9 : containernetworking-plugins (RHSA-2023:6402)	critical
185098	RHEL 9 : perl-CPAN (RHSA-2023:6539)	high
185097	RHEL 9 : libpq (RHSA-2023:6429)	low
185096	RHEL 9 : gdb (RHSA-2023:6372)	medium

Detections

Analytics

Red Hat Local Security Checks Family for Nessus

medium

medium

critical

medium

high

high

medium

high

medium

critical

high

medium

medium

critical

medium

high

high

medium

high

medium

high

high

medium

high

high

high

medium

high

medium

medium

critical

high

high

medium

medium

high

high

medium

high

high

critical

medium

medium

high

medium

critical

critical

high

low

medium