The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1454 advisory.

    Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning,     remote management, and monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default     (CVE-2019-10086)

    * jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server     (CVE-2019-12086)

    * mina-core: Retaining an open socket in close_notify SSL-TLS leading to Information disclosure     (CVE-2019-0231)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    * Ansible Runner is now the default way to utilize Ansible for remote execution jobs.

    * Users now have the ability to log into hosts using the Web Console directly from the Satellite UI.

    * Azure has been added to the list of supported compute resources for provisioning along with many bug     fixes for Google Compute, RHEV, VMWare, and Kubevirt.

    * Content views have been improved with many bug fixes, performance improvement, and the addition of     filtering on modules.

    * Content syncing has been improved with many fixes, and the ability to add proxy definitions to each     product in Satellite.

    * The installation process has been improved to include better tuning defaults and several other bug     fixes.

    * Subscription Management has been improved with many bug fixes in Satellite, new reporting, as well as in     the inventory upload plugin which allows customers to view their inventory in Subscription Watch at     cloud.redhat.com

    * Security improvements include the ability to impersonate another user, and the introduction of     integration with Red Hat SSO using openid connect.

    The items above are not a complete list of changes. This update also fixes several bugs and adds various     enhancements. Documentation for these changes is available from the Release Notes document linked to in     the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモートの Redhat Enterprise Linux 7 ホストにインストールされているパッケージは、RHSA-2020: 1454アドバイザリに記載されている脆弱性の影響を受けます。

  - rubygem-net-ldap：SSL証明書検証の欠如（CVE-2017-17718）

  - mina-core: close_notify SSL-TLS内で開いたソケットが保持され、情報漏洩を引き起こします。
    (CVE-2019-0231)

  - apache-commons-beanutils: デフォルトでPropertyUtilsBean内のクラスプロパティを抑制しない（CVE-2019-10086）

  - jackson-databind: 多態的型付けの問題により、攻撃者がサーバー上の任意のローカルファイルを読み取る可能性がある。
    (CVE-2019-12086)

  - rubygem-foreman_ansible：ジョブ起動からユーザー入力エントリが機密データを含むことができます（CVE-2020-10716）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端 Redhat Enterprise Linux 7 主機上安裝的套件受到 RHSA-2020: 1454 公告中提及的多個弱點影響。

  - rubygem-net-ldap：缺少 SSL 憑證驗證 (CVE-2017-17718)

  - mina-core：保留 close_notify SSL-TLS 中的開放通訊端，會導致資訊洩漏。
    (CVE-2019-0231)

  - apache-commons-beanutils：未預設隱藏 PropertyUtilsBean 中的類別屬性 (CVE-2019-10086)

  - jackson-databind：攻擊者可利用多型態輸入問題，讀取伺服器上的任意本機檔案。
    (CVE-2019-12086)

  - rubygem-foreman_ansible: 來自 Job Invocation 的使用者輸入項目可能包含敏感資料 (CVE-2020-10716)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2020: 1454 公告中提及的多个漏洞的影响。

  - rubygem-net-ldap：缺少 SSL 证书验证 (CVE-2017-17718)

  - mina-core：保留 close_notify SSL-TLS 中的开放套接字导致信息泄露。
    (CVE-2019-0231)

  - apache-commons-beanutils：未在默认情况下禁用 PropertyUtilsBean 中的类属性 (CVE-2019-10086)

  - jackson-databind：攻击者可利用多态输入问题在服务器上读取任意本地文件。
    (CVE-2019-12086)

  - rubygem-foreman_ansible：来自 Job Invocation 的用户输入条目可能包含敏感数据 (CVE-2020-10716)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	Name	Product	Family	Published	Updated	Severity
136038	RHEL 7 : Satellite 6.7 . (Important) (RHSA-2020:1454)	Nessus	Red Hat Local Security Checks	4/28/2020	6/3/2024	high
136038	RHEL 7: Satellite 6.7リリース。（重要）（RHSA-2020: 1454)	Nessus	Red Hat Local Security Checks	4/28/2020	6/3/2024	high
136038	RHEL 7：Satellite 6.7 版本。(重要) (RHSA-2020: 1454)	Nessus	Red Hat Local Security Checks	4/28/2020	6/3/2024	high
136038	RHEL 7：Satellite 6.7 版本。（重要）(RHSA-2020: 1454)	Nessus	Red Hat Local Security Checks	4/28/2020	6/3/2024	high

Detections

Analytics

Plugins Search

high

high

high

high