The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6393 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * nodejs-underscore: Arbitrary code execution via the template function (CVE-2021-23358)

    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

    * ovirt-log-collector: RHVM admin password is logged unfiltered (CVE-2022-2806)

    * springframework: malicious input leads to insertion of additional log entries (CVE-2021-22096)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, running engine-setup did not always renew OVN certificates close to expiration or expired.
    With this release, OVN certificates are always renewed by engine-setup when needed. (BZ#2097558)

    * Previously, the Manager issued warnings of approaching certificate expiration before engine-setup could     update certificates. In this release expiration warnings and certificate update periods are aligned, and     certificates are updated as soon as expiration warnings occur. (BZ#2097725)

    * With this release, OVA export or import work on hosts with a non-standard SSH port. (BZ#2104939)

    * With this release, the certificate validity test is compatible with RHEL 8 and RHEL 7 based hypervisors.
    (BZ#2107250)

    * RHV 4.4 SP1 and later are only supported on RHEL 8.6, customers cannot use RHEL 8.7 or later, and must     stay with RHEL 8.6 EUS. (BZ#2108985)

    * Previously, importing templates from the Administration Portal did not work. With this release,     importing templates from the Administration Portal is possible. (BZ#2109923)

    * ovirt-provider-ovn certificate expiration is checked along with other RHV certificates. If ovirt-     provider-ovn is about to expire or already expired, a warning or alert is raised in the audit log. To     renew the ovirt-provider-ovn certificate, administators must run engine-setup. If your ovirt-provider-ovn     certificate expires on a previous RHV version, upgrade to RHV 4.4 SP1 batch 2 or later, and ovirt-     provider-ovn certificate will be renewed automatically in the engine-setup. (BZ#2097560)

    * Previously, when importing a virtual machine with manual CPU pinning, the manual pinning string was     cleared, but the CPU pinning policy was not set to NONE. As a result, importing failed. In this release,     the CPU pinning policy is set to NONE if the CPU pinning string is cleared, and importing succeeds.
    (BZ#2104115)

    * Previously, the Manager could start a virtual machine with a Resize and Pin NUMA policy on a host     without an equal number of physical sockets to NUMA nodes. As a result, wrong pinning was assigned to the     policy. With this release, the Manager does not allow the virtual machine to be scheduled on such a     virtual machine, and the pinning is correct based on the algorithm. (BZ#1955388)

    * Rebase package(s) to version: 4.4.7.
    Highlights, important fixes, or notable enhancements: fixed BZ#2081676 (BZ#2104831)

    * In this release, rhv-log-collector-analyzer provides detailed output for each problematic image,     including disk names, associated virtual machine, the host running the virtual machine, snapshots, and     current SPM. The detailed view is now the default. The compact option can be set by using the --compact     switch in the command line. (BZ#2097536)

    * UnboundID LDAP SDK has been rebased on upstream version 6.0.4. See     https://github.com/pingidentity/ldapsdk/releases for changes since version 4.0.14 (BZ#2092478)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5555 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623)

    * apache-commons-compress: infinite loop when reading a specially crafted 7Z archive (CVE-2021-35515)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive     (CVE-2021-35516)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive     (CVE-2021-35517)

    * apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive     (CVE-2021-36090)

    * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes     (CVE-2021-3807)

    * spring-expression: Denial of service via specially crafted SpEL expression (CVE-2022-22950)

    * semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri     encoding (CVE-2022-31051)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    A list of bugs fixed in this update is available in the Technical Notes book:
    https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2022: 6393 公告中提及的多个漏洞影响。

  - jquery：存在跨站脚本，这是 injQuery.htmlPrefilter 方法不当所致 (CVE-2020-11022)

  - jquery：通过传递给 DOM 操纵方法的 HTML 中的 <option> 标签执行不受信任的代码 (CVE-2020-11023)

  - springframework：通过恶意输入导致插入额外的日志条目 (CVE-2021-22096)

  - nodejs-underscore：通过模板函数造成任意代码执行 (CVE-2021-23358)

  - ovirt-log-collector：记录 RHVM 管理员密码时未执行筛选 (CVE-2022-2806)

  - moment：导致 DoS 的低效解析算法 (CVE-2022-31129)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2022: 5555 公告中提及的多个漏洞影响。

  - springframework：通过恶意输入导致插入额外的日志条目 (CVE-2021-22096)

  - nodejs-trim-newlines：.end() 方法中的 ReDoS (CVE-2021-33623)

  - apache-commons-compress：读取特别构建的 7Z 存档文件时出现无限循环 (CVE-2021-35515)

  - apache-commons-compress：读取特别构建 7Z 存档文件时内存分配过多 (CVE-2021-35516)

  - apache-commons-compress：读取特别构建 TAR 存档文件时内存分配过多 (CVE-2021-35517)

  - apache-commons-compress：读取特别构建 ZIP 存档文件时内存分配过多 (CVE-2021-36090)

  - nodejs-ansi-regex：匹配 ANSI 转义代码的正则表达式拒绝服务 (ReDoS) (CVE-2021-3807)

  - spring-expression：通过特别构建的 SpEL 表达式造成拒绝服务 (CVE-2022-22950)

  -semantic-release：如果被屏蔽的密码包含被排除在 uri 编码之外的字符，则该密码可能会泄露 (CVE-2022-31051)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

リモート Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2022: 6393 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - jquery：injQuery.htmlPrefilterメソッドが不適切なことによるクロスサイトスクリプティング（CVE-2020-11022）

  - jquery：DOM 操作メソッドへ渡される HTML の <option>タグを介した信頼されていないコード実行 (CVE-2020-11023)

  - springframework: 悪意のある入力により、追加のログエントリが挿入される (CVE-2021-22096)

  -nodejs-underscore：テンプレート関数による任意のコード実行（CVE-2021-23358）

  - ovirt-log-collector: RHVM 管理者パスワードがフィルタリングされずに記録されます（CVE-2022-2806）

  - moment: 非効率的な解析アルゴリズムにより DoS が発生 (CVE-2022-31129)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモート Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2022: 5555 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - springframework: 悪意のある入力により、追加のログエントリが挿入される (CVE-2021-22096)

  - nodejs-trim-newlines: .end() メソッドの ReDos (CVE-2021-33623)

  - apache-commons-compress: 特別に細工された 7Z アーカイブを読み込む際の無限ループ (CVE-2021-35515)

  - apache-commons-compress: 特別に細工された 7Z アーカイブを読み込む際の過大なメモリ割り当て (CVE-2021-35516)

  - apache-commons-compress: 特別に細工された TAR アーカイブを読み込む際の過大なメモリ割り当て (CVE-2021-35517)

  - apache-commons-compress: 特別に細工された ZIP アーカイブを読み込む際の過大なメモリ割り当て (CVE-2021-36090)

  -nodejs-ansi-regex：ANSI エスケープコードに一致する正規表現のサービス拒否 (ReDoS) (CVE-2021-3807)

  - spring-expression: 特別に細工された SpEL 式によるサービス拒否 (CVE-2022-22950)

  - semantic-release: uri エンコーディングから除外される文字が含まれている場合、マスクされた秘密が漏洩する可能性があります (CVE-2022-31051)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2022: 6393 公告中提及的多個弱點影響。

  - jquery：存在跨網站指令碼，這是 injQuery.htmlPrefilter 方法不當所致 (CVE-2020-11022)

  - jquery：透過傳遞給 DOM 操作方法的 HTML 中的 <option> 標記，進行不受信任的程式碼執行 (CVE-2020-11023)

  - springframework：藉由惡意輸入可插入其他記錄項目 (CVE-2021-22096)

  - nodejs-underscore：透過範本函式執行任意程式碼 (CVE-2021-23358)

  - ovirt-log-collector：記錄 RHVM 管理員密碼時未執行篩選 (CVE-2022-2806)

  - moment：低效剖析演算法可導致 DoS (CVE-2022-31129)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2022: 5555 公告中提及的多個弱點影響。

  - springframework：藉由惡意輸入可插入其他記錄項目 (CVE-2021-22096)

  - nodejs-trim-newlines：.end() 方法中的 ReDoS (CVE-2021-33623)

  - apache-commons-compress：讀取特別建構的 7Z 封存時發生無限迴圈 (CVE-2021-35515)

  - apache-commons-compress：讀取特別建構的 7Z 封存時過度配置記憶體 (CVE-2021-35516)

  - apache-commons-compress：讀取特別建構的 TAR 封存時過度配置記憶體 (CVE-2021-35517)

  - apache-commons-compress：讀取特別建構的 ZIP 封存時過度配置記憶體 (CVE-2021-36090)

  - nodejs-ansi-regex：符合 ANSI 逸出程式碼的規則運算式拒絕服務 (ReDoS) (CVE-2021-3807)

  - spring-expression：透過特別建構的 SpEL 運算式造成拒絕服務 (CVE-2022-22950)

  -semantic-release：如果遮罩的密碼包含從 uri 編碼中排除的字元，則可洩漏密碼 (CVE-2022-31051)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
164843	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.2] (RHSA-2022:6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
163260	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022:5555)	Nessus	Red Hat Local Security Checks	2022/7/15	2024/11/7	high
164843	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.2] 错误修正和 (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
163260	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022: 5555)	Nessus	Red Hat Local Security Checks	2022/7/15	2024/11/7	high
164843	RHEL 8: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
163260	RHEL 8: RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022: 5555)	Nessus	Red Hat Local Security Checks	2022/7/15	2024/11/7	high
164843	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.2] 錯誤修正和 (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
163260	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.1] (RHSA-2022: 5555)	Nessus	Red Hat Local Security Checks	2022/7/15	2024/11/7	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high