A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments, this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM is a member.(CVE-2019-10153)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2037 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * fence-agents: mis-handling of non-ASCII characters in guest comment fields (CVE-2019-10153)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

This update for fence-agents version 4.4.0 fixes the following issues :

Security issue fixed :

  - CVE-2019-10153: Fixed a denial of service via guest VM     comments (bsc#1137314).

Non-security issue fixed :

  - Included timestamps when logging (bsc#1049852).

This update was imported from the SUSE:SLE-15:Update update project.

* fence-agents: mis-handling of non-ASCII characters in guest comment fields (CVE-2019-10153)

This update for fence-agents version 4.4.0 fixes the following issues :

Security issue fixed :

  - CVE-2019-10153: Fixed a denial of service via guest VM     comments (bsc#1137314).

Non-security issue fixed :

  - Added aliyun fence agent (bsc#1139913).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - python-httplib2: Regular expression denial of service via malicious header (CVE-2021-21240)

  - A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest     VM's comment or other fields would cause fence_rhevm to exit with an exception. In cluster environments,     this could lead to preventing automated recovery or otherwise denying service to clusters of which that VM     is a member. (CVE-2019-10153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

An update for fence-agents is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es) :

* fence-agents: mis-handling of non-ASCII characters in guest comment fields (CVE-2019-10153)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

According to the version of the fence-agents packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was discovered in fence-agents, prior to version     4.3.4, where using non-ASCII characters in a guest VM's     comment or other fields would cause fence_rhevm to exit     with an exception. In cluster environments, this could     lead to preventing automated recovery or otherwise     denying service to clusters of which that VM is a     member.(CVE-2019-10153)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has fence-agents packages installed that are affected by a vulnerability:

  - A flaw was discovered in fence-agents, prior to version     4.3.4, where using non-ASCII characters in a guest VM's     comment or other fields would cause fence_rhevm to exit     with an exception. In cluster environments, this could     lead to preventing automated recovery or otherwise     denying service to clusters of which that VM is a     member. (CVE-2019-10153)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has fence-agents packages installed that are affected by a vulnerability:

  - A flaw was discovered in fence-agents, prior to version     4.3.4, where using non-ASCII characters in a guest VM's     comment or other fields would cause fence_rhevm to exit     with an exception. In cluster environments, this could     lead to preventing automated recovery or otherwise     denying service to clusters of which that VM is a     member. (CVE-2019-10153)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
130601	Amazon Linux 2 : fence-agents (ALAS-2019-1348)	Nessus	Amazon Linux Local Security Checks	11/7/2019	4/15/2024	medium
127654	RHEL 7 : fence-agents (RHSA-2019:2037)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	medium
196674	RHEL 6 : fence-agents (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	medium
126886	openSUSE Security Update : fence-agents (openSUSE-2019-1719)	Nessus	SuSE Local Security Checks	7/22/2019	5/9/2024	medium
128217	Scientific Linux Security Update : fence-agents on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	8/27/2019	5/1/2024	medium
126892	openSUSE Security Update : fence-agents (openSUSE-2019-1751)	Nessus	SuSE Local Security Checks	7/22/2019	5/9/2024	medium
198950	RHEL 8 : fence-agents (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
128336	CentOS 7 : fence-agents (CESA-2019:2037)	Nessus	CentOS Local Security Checks	8/30/2019	12/31/2019	medium
153338	EulerOS 2.0 SP2 : fence-agents (EulerOS-SA-2021-2368)	Nessus	Huawei Local Security Checks	9/14/2021	11/30/2023	medium
132294	EulerOS 2.0 SP3 : fence-agents (EulerOS-SA-2019-2577)	Nessus	Huawei Local Security Checks	12/19/2019	4/3/2024	medium
131417	NewStart CGSL CORE 5.04 / MAIN 5.04 : fence-agents Vulnerability (NS-SA-2019-0214)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	1/14/2021	medium
132457	NewStart CGSL CORE 5.05 / MAIN 5.05 : fence-agents Vulnerability (NS-SA-2019-0226)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	1/14/2021	medium
128820	EulerOS 2.0 SP5 : fence-agents (EulerOS-SA-2019-1897)	Nessus	Huawei Local Security Checks	9/16/2019	4/25/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium