The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.13. Easily exploitable vulnerability allows low privileged attacker having     Authenticated User privilege with network access via Oracle Net to compromise RDBMS (Python). Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of RDBMS (Python). (CVE-2023-36632) 

  - Vulnerability in the Grid Infrastructure (Apache Mina SSHD) component of Oracle Database Server.   Supported versions that are affected are 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Grid Infrastructure (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Grid Infrastructure (Apache Mina SSHD) accessible data. (CVE-2023-48795)

  - Vulnerability in the Oracle SQLcl (Apache Mina SSHD) component of Oracle Database Server. Supported   versions that are affected are 19.3-19.22 and 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Oracle SQLcl (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Oracle SQLcl (Apache Mina SSHD) accessible data. (CVE-2023-48795)	

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1422 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.6. It addresses 80 CVEs:
    CVE-2009-0845, CVE-2008-0947, CVE-2016-3120, CVE-2024-3596, CVE-2012-1014, and 75 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-321 advisory.

    lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an     uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because
    _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array     count. (CVE-2023-36054)

    kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an     authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one     ticket to another. (CVE-2023-39975)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6633:07 advisory.

    * krb5: Denial of service through freeing uninitialized pointer (CVE-2023-36054)
      * krb5: double-free in KDC TGS processing (CVE-2023-39975)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202405-11 (MIT krb5: Multiple Vulnerabilities)

  - ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before     1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon     crash. This occurs because a return value is not properly managed in a certain situation. (CVE-2021-36222)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an     uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because
    _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array     count. (CVE-2023-36054)

  - kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an     authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one     ticket to another. (CVE-2023-39975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory.

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging (Kerberos)).
    Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.
    Successful attacks of this vulnerability can result in takeover of MySQL Server. (CVE-2023-39975)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. (CVE-2023-22059)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported     version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged attacker with     network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL     Server. (CVE-2023-22095)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions     that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged     attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this     vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete     DOS) of MySQL Server. (CVE-2023-22032)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a6986f0f-3ac0-11ee-9a88-206a8a720317 advisory.

  - This is a backport of the upstream fix for CVE-2023-39975: https://github.com/krb5/krb5/pull/1312     (CVE-2023-39975)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718787475 advisory.

  - kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an     authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one     ticket to another. (CVE-2023-39975)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of MySQL Cluster installed on the remote host are affected by a vulnerability as referenced in the October 2023 CPU advisory.

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (libxml2)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks require human interaction from a person other than the attacker. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of MySQL Cluster. (CVE-2023-28484)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (curl)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks of this vulnerability can result in takeover of MySQL Cluster. (CVE-2023-38545)

  - Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General (Kerberos)).     Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Cluster.     Successful attacks of this vulnerability can result in takeover of MySQL Cluster.(CVE-2022-42898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
193497	Oracle Database Server (Apr 2024 CPU)	Nessus	Databases	2024/4/18	2024/5/2	critical
354310	Rocky Linux 9.6 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_1422)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical
181152	Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2023-321)	Nessus	Amazon Linux Local Security Checks	2023/9/8	2024/12/11	critical
293059	MiracleLinux 9 : krb5-1.21.1-1.el9 (AXSA:2023-6633:07)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
194990	GLSA-202405-11 : MIT krb5: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/5/5	2024/5/5	high
183395	Oracle MySQL Server 8.x < 8.2.0 (October 2023 CPU)	Nessus	Databases	2023/10/19	2025/4/18	high
179873	FreeBSD : krb5 -- Double-free in KDC TGS processing (a6986f0f-3ac0-11ee-9a88-206a8a720317)	Nessus	FreeBSD Local Security Checks	2023/8/15	2024/7/12	high
352497	AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ALMALINUX9.2:CLSA-2024:1718787475)	Nessus	Alma Linux Local Security Checks	2026/9/30	2026/9/30	high
183437	Oracle MySQL Cluster 8.x < 8.2.0 (Oct 2023 CPU)	Nessus	Databases	2023/10/19	2025/11/5	critical

偵測

搜尋 Plugin

critical

critical

critical

high

high

high

high

high

critical