The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0797 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security fix(es):
    * CVE-2023-26049 (puppetserver): Cookie parsing of quoted values can exfiltrate values from other cookies
    * CVE-2023-26141 (rubygem-sidekiq): Denial of Service (DoS) in dashboard-charts
    * CVE-2023-36479 (puppetserver): Improper addition of quotation marks to user inputs in CgiServlet
    * CVE-2023-38545 (puppet-agent): Heap-based buffer overflow in the SOCKS5 proxy handshake
    * CVE-2023-40167 (puppetserver): Improper validation of HTTP/1 content-length
    * CVE-2023-40175 (rubygem-puma): HTTP request smuggling when parsing chunked transfer encoding bodies and     zero-length content-length headers
    * CVE-2023-4785 (rubygem-grpc): File descriptor exhaustion leads to denial of service
    * CVE-2023-0809, CVE-2023-28366, CVE-2023-3592 (mosquitto): Memory leak leads to unresponsive broker

    This update fixes the following bugs:
    2250347 - 'Sun, 11 Jun 2023 17:51:29 GMT' could not be parsed at index 0 at     java.time.format.DateTimeFormatter.parseResolved     2254974 - satellite-convert2rhel-toolkit install fails on latest rpm with `/usr/bin/bash:
    /usr/libexec/satellite-convert2rhel-appliance/action-install.sh: No such file or directory`     2255260 - 6.14 - satellite-convert2rhel-toolkit is part of the satellite module     2257321 - Request for UEFI Kickstart Provisioning to handle naming convention for VLAN tagged interfaces     of the format <parent_device>.<vlan_id> in addition to vlan<vlan_id>     2257324 - Generate applicability tasks fails with error ERROR: insert or update on table     katello_content_facet_errata violates foreign key constraint katello_content_facet_errata_ca_id     2257326 - Show failed resources in failed installation report     2257327 - Puppet reports without any messages don't get an origin     2257329 - Host registration fails with error Attached to can't be blank when the VLAN name includes     UPPERCASE letters     2257330 - default tuning profile leaves httpd MaxClients 150 which httpd raises a warning     2257331 - Registering host through load balancer causes REX not to know what capsule to choose for     'registered_through'     2257332 - Registration can't find any Capsules when their locations are not assigned to admin user     2257415 - Provisioning vm host fails with error Failed to attach ISO image to CDROM drive of instance     client.example.com: InvalidPowerState: The attempted operation cannot be performed in the current state     (Powered on).
    2260525 - [Improvement] RefreshRepos step in Capsule Sync to refresh just repos to sync     2262131 - Unable to sync library/busybox from gcr.io

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

リモート Redhat Enterprise Linux 8 ホストに、RHSA-2024:0797 アドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

  - mosquitto: メモリリークによりブローカーが応答しなくなります (CVE-2023-0809、CVE-2023-28366、CVE-2023-3592)

  - gRPC: ファイル記述子の枯渇によりサービス拒否が引き起こされます (CVE-2023-4785)

  - jetty-server: 引用された値のクッキー解析により、他のクッキーから値が抽出される可能性があります (CVE-2023-26049)

  - sidekiq: ダッシュボードチャートの DoS (CVE-2023-26141)

  - jetty: CgiServlet のユーザー入力への引用符の不適切な追加 (CVE-2023-36479)

  - curl: SOCKS5 プロキシハンドシェイクのヒープベースのバッファオーバーフロー (CVE-2023-38545)

  - jetty: HTTP/1 content-length の不適切な検証 (CVE-2023-40167)

  - rubygem-puma: チャンク転送エンコーディング本体および長さゼロの content-length ヘッダーを解析する際の HTTP リクエストスマグリング (CVE-2023-40175)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2024:0797 公告中提及的多个漏洞影响。

  - mosquitto：内存泄漏导致代理不响应（CVE-2023-0809、 CVE-2023-28366、 CVE-2023-3592）

  - gRPC：文件描述符耗尽导致拒绝服务 (CVE-2023-4785)

  - jetty-server：解析引用值的 Cookie 可泄露其他 Cookie 中的值 (CVE-2023-26049)

  - sidekiq：dashboard-charts 中的 DoS (CVE-2023-26141)

  - jetty：向 CgiServlet 中的用户输入添加不正确的引号 (CVE-2023-36479)

  - curl：SOCKS5 代理握手中存在基于堆的缓冲区溢出漏洞 (CVE-2023-38545)

  - jetty：不当验证 HTTP/1 content-length (CVE-2023-40167)

  - rubygem-puma：解析分块传输编码正文和零长度内容长度标头时，HTTP 请求走私 (CVE-2023-40175)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2024:0797 公告中提及的多個弱點影響。

  - mosquitto：記憶體洩漏導致代理人無回應 (CVE-2023-0809、 CVE-2023-28366、 CVE-2023-3592)

  - gRPC：檔案描述符號耗盡導致拒絕服務 (CVE-2023-4785)

  - jetty-server：引用值的 Cookie 剖析可從洩漏其他 Cookie 中的值 (CVE-2023-26049)

  -sidekiq：儀表板圖表中的 DoS (CVE-2023-26141)

  - jetty：不當將引號新增至 CgiServlet 中的使用者輸入 (CVE-2023-36479)

  - curl：SOCKS5 proxy 交握中的堆積型緩衝區溢位 (CVE-2023-38545)

  - jetty：不當驗證 HTTP/1 content-length (CVE-2023-40167)

  - rubygem-puma：剖析區塊傳輸編碼內文和零長度 content-length 標頭時發生 HTTP 要求走私問題 (CVE-2023-40175)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
194396	RHEL 8 : Satellite 6.14.2 Async Security Update (Important) (RHSA-2024:0797)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/6/4	critical
194396	RHEL 8 : Satellite 6.14.2 Async のセキュリティ更新 (重要度高) (RHSA-2024:0797)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/6/4	critical
194396	RHEL 8：Satellite 6.14.2 异步安全更新（重要） (RHSA-2024:0797)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/6/4	critical
194396	RHEL 8：Satellite 6.14.2 Async Security Update (重要) (RHSA-2024:0797)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/6/4	critical

偵測

搜尋 Plugin

critical

critical

critical

critical