The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3842 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving     API.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4249 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and     provides name resolving API.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1135-1 advisory.

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2780 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2778 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2779 advisory.

    nodejs     [1:18.20.2-2]
    - Removes .ps1 files
    - Rebase to 18.20.2
    - Fixes: CVE-2024-27983, CVE-2024-28182, CVE-2024-27982, CVE-2024-25629

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2853 advisory.

    - Backport nghttp2 patch for CVE-2024-28182

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
200417	RHEL 9 : c-ares (RHSA-2024:3842)	Nessus	Red Hat Local Security Checks	6/12/2024	11/7/2024	medium
201288	RHEL 8 : c-ares (RHSA-2024:4249)	Nessus	Red Hat Local Security Checks	7/2/2024	11/7/2024	medium
193050	SUSE SLED12 / SLES12 Security Update : libcares2 (SUSE-SU-2024:1135-1)	Nessus	SuSE Local Security Checks	4/9/2024	4/9/2024	medium
195193	RHEL 8 : nodejs:18 (RHSA-2024:2780)	Nessus	Red Hat Local Security Checks	5/9/2024	11/7/2024	high
195194	RHEL 8 : nodejs:20 (RHSA-2024:2778)	Nessus	Red Hat Local Security Checks	5/9/2024	11/7/2024	high
197044	Oracle Linux 9 : nodejs:18 (ELSA-2024-2779)	Nessus	Oracle Linux Local Security Checks	5/15/2024	11/2/2024	high
197290	Oracle Linux 9 : nodejs:20 (ELSA-2024-2853)	Nessus	Oracle Linux Local Security Checks	5/17/2024	11/2/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

high

high

high

high