RHEL 8：Red Hat Virtualization (RHSA-2020: 5179)
high Nessus 插件 ID 143235
语言：
简介
远程 Red Hat 主机缺少一个或多个安全更新。描述
远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 5179 公告中提及的多个漏洞的影响。- nodejs-handlebars：查找帮助程序未能正确验证模板，允许执行任意 JavaScript (CVE-2019-20920)
- nodejs-handlebars：处理特别构建的模板时存在死循环，导致 DoS (CVE-2019-20922)
- nodejs-lodash：zipObjectDeep 函数中的原型污染 (CVE-2020-8203)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
更新受影响的程序包。另见
http://www.nessus.org/u?7aa62d53
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/errata/RHSA-2020:5179
https://bugzilla.redhat.com/show_bug.cgi?id=1613514
https://bugzilla.redhat.com/show_bug.cgi?id=1657294
https://bugzilla.redhat.com/show_bug.cgi?id=1691253
https://bugzilla.redhat.com/show_bug.cgi?id=1702016
https://bugzilla.redhat.com/show_bug.cgi?id=1752751
https://bugzilla.redhat.com/show_bug.cgi?id=1760170
https://bugzilla.redhat.com/show_bug.cgi?id=1797717
https://bugzilla.redhat.com/show_bug.cgi?id=1808320
https://bugzilla.redhat.com/show_bug.cgi?id=1811466
https://bugzilla.redhat.com/show_bug.cgi?id=1812316
https://bugzilla.redhat.com/show_bug.cgi?id=1822372
https://bugzilla.redhat.com/show_bug.cgi?id=1825020
https://bugzilla.redhat.com/show_bug.cgi?id=1828241
https://bugzilla.redhat.com/show_bug.cgi?id=1829691
https://bugzilla.redhat.com/show_bug.cgi?id=1842344
https://bugzilla.redhat.com/show_bug.cgi?id=1845432
https://bugzilla.redhat.com/show_bug.cgi?id=1851865
https://bugzilla.redhat.com/show_bug.cgi?id=1854888
https://bugzilla.redhat.com/show_bug.cgi?id=1855305
https://bugzilla.redhat.com/show_bug.cgi?id=1856671
https://bugzilla.redhat.com/show_bug.cgi?id=1857412
https://bugzilla.redhat.com/show_bug.cgi?id=1859314
https://bugzilla.redhat.com/show_bug.cgi?id=1862101
https://bugzilla.redhat.com/show_bug.cgi?id=1866981
https://bugzilla.redhat.com/show_bug.cgi?id=1870133
https://bugzilla.redhat.com/show_bug.cgi?id=1871694
https://bugzilla.redhat.com/show_bug.cgi?id=1872911
https://bugzilla.redhat.com/show_bug.cgi?id=1873136
https://bugzilla.redhat.com/show_bug.cgi?id=1876923
https://bugzilla.redhat.com/show_bug.cgi?id=1877632
https://bugzilla.redhat.com/show_bug.cgi?id=1877679
https://bugzilla.redhat.com/show_bug.cgi?id=1879199
https://bugzilla.redhat.com/show_bug.cgi?id=1879280
https://bugzilla.redhat.com/show_bug.cgi?id=1879377
https://bugzilla.redhat.com/show_bug.cgi?id=1881634
https://bugzilla.redhat.com/show_bug.cgi?id=1882256
https://bugzilla.redhat.com/show_bug.cgi?id=1882260
https://bugzilla.redhat.com/show_bug.cgi?id=1883844
https://bugzilla.redhat.com/show_bug.cgi?id=1884146
https://bugzilla.redhat.com/show_bug.cgi?id=1884634
https://bugzilla.redhat.com/show_bug.cgi?id=1885976
https://bugzilla.redhat.com/show_bug.cgi?id=1887268
插件详情
严重性: High
ID: 143235
文件名: redhat-RHSA-2020-5179.nasl
版本: 1.11
类型: local
代理: unix
发布时间: 2020/11/24
最近更新时间: 2024/11/7
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 6.6
Vendor
Vendor Severity: Low
CVSS v2
风险因素: Medium
基本分数: 6.8
时间分数: 5.3
矢量: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS 分数来源: CVE-2019-20920
CVSS v3
风险因素: High
基本分数: 8.1
时间分数: 7.3
矢量: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:redhat:enterprise_linux:python3-ovirt-engine-lib, p-cpe:/a:redhat:enterprise_linux:rhvm, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-webadmin-portal, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-health-check-bundler, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-cinderlib, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-ovirt-engine-common, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-websocket-proxy, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-vmconsole-proxy-helper, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-tools-backup, cpe:/o:redhat:enterprise_linux:8, p-cpe:/a:redhat:enterprise_linux:ovirt-engine, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-vmconsole-proxy-helper, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-ovirt-engine, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-plugin-imageio, p-cpe:/a:redhat:enterprise_linux:ovirt-web-ui, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-dbscripts, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-tools, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-backend, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-websocket-proxy, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-restapi, p-cpe:/a:redhat:enterprise_linux:ovirt-engine-setup-base
必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
可利用: true
易利用性: Exploits are available
补丁发布日期: 2020/11/24
漏洞发布日期: 2020/7/15