リモート Redhat Enterprise Linux 9 ホストに、RHSA-2024:6827 アドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

    Red Hat OpenShift Container Platform は、オンプレミスまたはプライベートクラウド展開用に設計された、Red Hat のクラウドコンピューティング Kubernetes アプリケーションプラットフォームソリューションです。

    このアドバイザリには、Red Hat OpenShift Container Platform 4.16.14 の RPM パッケージが含まれています。このリリースのコンテナイメージについては、次のアドバイザリを参照してください。

    https://access.redhat.com/errata/RHSA-2024:6824

    セキュリティ修正プログラム:

    * webob: リダイレクト中の WebOb のロケーションヘッダーの正規化により、オープンリダイレクトを引き起こす可能性 (CVE-2024-42353)

    影響、CVSS スコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

    すべての OpenShift Container Platform 4.16 ユーザーは、適切なリリースチャネルで利用可能な場合に、これらの更新済みパッケージとイメージにアップグレードすることが推奨されます。利用可能な更新をチェックするには、OpenShift CLI (oc) または Web コンソールを使用します。クラスターのアップグレード手順については、https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html を参照してください

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Redhat Enterprise Linux 8 / 9 主機上安裝的多個套件受到 RHSA-2024:7187 公告中提及的多個弱點影響。

    Red Hat OpenShift Container Platform 是 Red Hat 的雲端運算 Kubernetes 應用程式平台解決方案，專門針對內部部署或私有雲端部署而設計。

    此公告含有適用於 Red Hat OpenShift Container Platform 4.14.38 版的 RPM 套件。請參閱此版本之容器映像的下列公告：

    https://access.redhat.com/errata/RHSA-2024:7184

    安全性修正：

    * containers/image：摘要類型無法保證類型有效 (CVE-2024-3727)
    * webob：重新導向期間 WebOb 的位置標頭標準化會導致開放重新導向 (CVE-2024-42353)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

    如果相應的發佈通道中提供更新版套件和影像，建議所有 OpenShift Container Platform 4.14 使用者皆进行升級。要檢查可用的更新，請使用 OpenShift CLI (oc) 或 Web 主控台。有關升級叢集的說明，請造訪 https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8/9 主機上安裝的套件受到 RHSA-2024:7941 公告中提及的多個弱點影響。

    Red Hat OpenShift Container Platform 是 Red Hat 的雲端運算 Kubernetes 應用程式平台解決方案，專門針對內部部署或私有雲端部署而設計。

    此公告含有適用於 Red Hat OpenShift Container Platform 4.13.52 版的 RPM 套件。請參閱此版本之容器映像的下列公告：

    https://access.redhat.com/errata/RHSA-2024:7939Security 修正：

    * openstack-ironic：特製的影像可允許經驗證的使用者取得潛在敏感資料的存取權 (CVE-2024-44082)
    * containers/image：摘要類型無法保證類型有效 (CVE-2024-3727)
    * webob：重新導向期間 WebOb 的位置標頭標準化會導致開放重新導向 (CVE-2024-42353)

    如需安全性問題的詳細資料，包括影響、CVSS 評分、致謝及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

    如果相應的發佈通道中提供更新版套件和影像，建議所有 OpenShift Container Platform 4.13 使用者皆进行升級。要檢查可用的更新，請使用 OpenShift CLI (oc) 或 Web 主控台。有關升級叢集的說明，請造訪 https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 python-webob 版本早於 1.2.3-7。因此，它會受到 ALAS2-2025-2726 公告中提及的一個弱點影響。

    WebOb 提供適用於 HTTP 要求和回應的物件。當 WebOb 將 HTTP Location 標頭標準化為包含要求的主機名稱時，它會使用 Python 的 urlparse 剖析使用者將重新導向的目標 URL，並將其加入基礎 URL。但是 `urlparse` 會將字串開頭的 `//` 視為沒有配置的 URI，並將接下來的部分視為主機名稱。接著，`urljoin` 會使用第二部分的主機名稱，取代原要求中的主機名稱。此弱點已在 WebOb 1.8.8 版中修補。(CVE-2024-42353)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的多個套件受到 RHSA-2025:9775 公告中提及的多個弱點影響。

    Red Hat Ceph Storage 是一個可擴充、開放式、軟體定義的儲存平台，結合了最穩定的 Ceph 儲存系統版本，並搭配 Ceph 管理平台、部署公用程式以及支援服務。

    這些新套件包含數個增強功能、安全性和錯誤修正以及已知問題。因空間所限，無法在此公告中記錄所有這些變更。如需這些重要變更的相關資訊，系統會將使用者導向到 Red Hat Ceph Storage 版本資訊：

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7187 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.38. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7184

    Security Fix(es):

    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-webob installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42353 advisory.

  - WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to     include the request hostname, it does so by parsing the URL that the user is to be redirected to with     Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a     string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use     that hostname from the second part as the hostname replacing the original one from the request. This     vulnerability is patched in WebOb version 1.8.8. (CVE-2024-42353)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7941 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.52. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7939     Security Fix(es):

    * openstack-ironic: Specially crafted image may allow authenticated users     to gain access to potentially sensitive data (CVE-2024-44082)
    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b4c4fd0879 advisory.

    Automatic update for python-webob-1.8.8-1.fc41.

    ##### **Changelog**

    ```
    * Thu Aug 15 2024 Jn ONDREJ (SAL) <ondrejj(at)salstar.sk> - 1.8.8-1
    - Update to upstream. Fix open redirect issue in 1.8-branch rhbz#2305065
    - pypi_source constructed manually according to project/name case inconsistency
    - only require legacy-cgi on on systems where it's present
    - remove python3.9 patch (applied upstream)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-webob installed on the remote host is prior to 1.2.3-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2726 advisory.

    WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to     include the request hostname, it does so by parsing the URL that the user is to be redirected to with     Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a     string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use     that hostname from the second part as the hostname replacing the original one from the request. This     vulnerability is patched in WebOb version 1.8.8. (CVE-2024-42353)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:9775 advisory.

    Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable     version of the Ceph storage system with a Ceph management platform, deployment utilities, and support     services.

    These new packages include numerous enhancements, security and bug fixes, and known issues. Space     precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph     Storage Release Notes for information on the most significant of these changes:

    https://docs.redhat.com/en/documentation/red_hat_ceph_storage/8/html/8.1_release_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
207705	RHEL 9 : OpenShift Container Platform 4.16.14 (RHSA-2024:6827)	Nessus	Red Hat Local Security Checks	2024/9/24	2024/11/7	medium
208072	RHEL 8 / 9：OpenShift Container Platform 4.14.38 (RHSA-2024:7187)	Nessus	Red Hat Local Security Checks	2024/10/3	2024/10/3	medium
209187	RHEL 8/9：OpenShift Container Platform 4.13.z (RHSA-2024:7941)	Nessus	Red Hat Local Security Checks	2024/10/17	2024/10/17	medium
213669	Amazon Linux 2 : python-webob (ALAS-2025-2726)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/16	medium
240647	RHEL 9：Red Hat Ceph Storage 8.1 (RHSA-2025:9775)	Nessus	Red Hat Local Security Checks	2025/6/26	2025/6/26	medium
208072	RHEL 8 / 9 : OpenShift Container Platform 4.14.38 (RHSA-2024:7187)	Nessus	Red Hat Local Security Checks	2024/10/3	2024/10/3	medium
208806	CBL Mariner 2.0 Security Update: python-webob (CVE-2024-42353)	Nessus	MarinerOS Local Security Checks	2024/10/13	2025/2/10	medium
209187	RHEL 8 / 9 : OpenShift Container Platform 4.13.z (RHSA-2024:7941)	Nessus	Red Hat Local Security Checks	2024/10/17	2024/10/17	medium
211229	Fedora 41 : python-webob (2024-b4c4fd0879)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	medium
213669	Amazon Linux 2 : python-webob (ALAS-2025-2726)	Nessus	Amazon Linux Local Security Checks	2025/1/9	2025/1/16	medium
240647	RHEL 9 : Red Hat Ceph Storage 8.1 (RHSA-2025:9775)	Nessus	Red Hat Local Security Checks	2025/6/26	2025/6/26	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium