The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1045 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On     7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)
    * keycloak: missing email notification template allowlist (CVE-2022-1274)
    * keycloak: minimist: prototype pollution (CVE-2021-44906)
    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
    * undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)
    * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
    * loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
    * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
    * keycloak: path traversal via double URL encoding (CVE-2022-3782)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode     (CVE-2022-38749)
    * snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)
    * keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
    * keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
    * keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
    * snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
    * rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip     (CVE-2018-14042)
    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)
    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
    * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
    * jettison: parser crash by stackoverflow (CVE-2022-40149)
    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)
    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
    * jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)
    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
    * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)
    * CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
    * keycloak: reflected XSS attack (CVE-2022-4137)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-86d75130fe advisory.

    Apply fix for CVE-2022-37603.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2e38c3756f advisory.

    Apply fix for CVE-2022-37603.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a4f0b29f6c advisory.

    Apply fix for CVE-2022-37603.




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - angular: XSS vulnerability (CVE-2021-4231)

  - Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with     partial cryptographic verification of the request and response, covering the HTTP method, request URI,     host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header     (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added     character in the attacker's input increases the computation time exponentially. `parseHost()` was patched     in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options`     argument. If that contains `host` and `port`, those would be used instead of a call to     `utils.parseHost()`. (CVE-2022-29167)

  - A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in     interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
    (CVE-2022-37603)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1043 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On     7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):

    * keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)
    * keycloak: missing email notification template allowlist (CVE-2022-1274)
    * keycloak: minimist: prototype pollution (CVE-2021-44906)
    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
    * undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)
    * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
    * loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
    * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
    * keycloak: path traversal via double URL encoding (CVE-2022-3782)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode     (CVE-2022-38749)
    * snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)
    * keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
    * keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
    * keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
    * snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
    * rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip     (CVE-2018-14042)
    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)
    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
    * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
    * jettison: parser crash by stackoverflow (CVE-2022-40149)
    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)
    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
    * jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)
    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
    * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)
    * CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
    * keycloak: reflected XSS attack (CVE-2022-4137)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1044 advisory.

    Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides     authentication and standards-based single sign-on capabilities for web and mobile applications.

    This release of Red Hat Single Sign-On 7.6.2 on RHEL 8 serves as a replacement for Red Hat Single Sign-On     7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked     to in the References.

    Security Fix(es):
    * keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
    * Moment.js: Path traversal in moment.locale (CVE-2022-24785)
    * keycloak: missing email notification template allowlist (CVE-2022-1274)
    * keycloak: minimist: prototype pollution (CVE-2021-44906)
    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
    * undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations     (CVE-2022-2764)
    * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
    * loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
    * keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
    * keycloak: path traversal via double URL encoding (CVE-2022-3782)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode     (CVE-2022-38749)
    * snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
    * snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject     (CVE-2022-38750)
    * keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
    * keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
    * json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
    * keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
    * snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
    * CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
    * rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip     (CVE-2018-14042)
    * jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError     which may lead to dos (CVE-2022-45693)
    * sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
    * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
    * jettison: parser crash by stackoverflow (CVE-2022-40149)
    * jackson-databind: use of deeply nested arrays (CVE-2022-42004)
    * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
    * jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code     execution (CVE-2020-11023)
    * bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
    * jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution,     or property injection (CVE-2019-11358)
    * CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
    * keycloak: reflected XSS attack (CVE-2022-4137)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - angular: XSS vulnerability (CVE-2021-4231)

  - Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with     partial cryptographic verification of the request and response, covering the HTTP method, request URI,     host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header     (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added     character in the attacker's input increases the computation time exponentially. `parseHost()` was patched     in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options`     argument. If that contains `host` and `port`, those would be used instead of a call to     `utils.parseHost()`. (CVE-2022-29167)

  - A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in     interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
    (CVE-2022-37603)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
172039	RHEL 9 : Red Hat Single Sign-On 7.6.2 security update on RHEL 9 (Important) (RHSA-2023:1045)	Nessus	Red Hat Local Security Checks	3/1/2023	11/7/2024	critical
173656	Fedora 37 : yarnpkg (2023-86d75130fe)	Nessus	Fedora Local Security Checks	3/29/2023	11/14/2024	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	5/2/2024	7/29/2024	critical
173670	Fedora 38 : yarnpkg (2023-2e38c3756f)	Nessus	Fedora Local Security Checks	3/30/2023	11/14/2024	high
195769	RHEL 6 : loader-utils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	5/2/2024	7/26/2024	critical
173669	Fedora 36 : yarnpkg (2023-a4f0b29f6c)	Nessus	Fedora Local Security Checks	3/30/2023	11/14/2024	high
202215	RHEL 8 : gjs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	7/11/2024	7/11/2024	medium
172041	RHEL 7 : Red Hat Single Sign-On 7.6.2 security update on RHEL 7 (Important) (RHSA-2023:1043)	Nessus	Red Hat Local Security Checks	3/2/2023	11/7/2024	critical
172042	RHEL 8 : Red Hat Single Sign-On 7.6.2 security update on RHEL 8 (Important) (RHSA-2023:1044)	Nessus	Red Hat Local Security Checks	3/2/2023	11/7/2024	critical
202216	RHEL 9 : gjs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	7/11/2024	7/11/2024	medium
195762	RHEL 7 : loader-utils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	critical

Detections

Analytics

Plugins Search

critical

high

critical

high

critical

critical

high

medium

critical

critical

medium

critical