The remote host is affected by the vulnerability described in GLSA-202208-10 (Spice Server: Multiple Vulnerabilities)

  - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers     to cause a denial of service (CPU consumption) by performing many renegotiations within a single     connection. (CVE-2021-20201)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-14355)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:0874-1 advisory.

  - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers     to cause a denial of service (CPU consumption) by performing many renegotiations within a single     connection. (CVE-2021-20201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in spice in versions before 0.14.92. A     DoS tool might make it easier for remote attackers to     cause a denial of service (CPU consumption) by     performing many renegotiations within a single     connection.(CVE-2021-20201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spice package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers     to cause a denial of service (CPU consumption) by performing many renegotiations within a single     connection. (CVE-2021-20201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:1924 advisory.

  - spice: Client initiated renegotiation denial of service (CVE-2021-20201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1924 advisory.

    [0.14.3-4]
    - Disable client-side renegotiation to prevent potential DoS       Resolves: rhbz#1904459

    [0.14.3-3]
    - Fix some static analyzer issues
    - Removed Obsoletes line for spice-client       Related: rhbz#1840240

    [0.14.3-2]
    - Fix multiple buffer overflows in QUIC decoding code       Resolves: rhbz#1829946

    [0.14.3-1]
    - Update to 0.14.3       Revolves: rhbz#1840240

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1901-1 advisory.

    - CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
    - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 / SLES_SAP11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14744-1 advisory.

    - CVE-2021-20201: client initiated renegotiation causing denial of service (bsc#1181686)
    - CVE-2020-14355: Fixed multiple buffer overflow vulnerabilities in QUIC decoding code (bsc#1177158)
    - CVE-2016-2150: Fixed a guest escape using crafted primary surface parameters (bsc#982386)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
163982	GLSA-202208-10 : Spice Server: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/10	2023/10/16	medium
151079	openSUSE 15 Security Update : spice (openSUSE-SU-2021:0874-1)	Nessus	SuSE Local Security Checks	2021/6/28	2023/12/12	medium
153056	EulerOS 2.0 SP5 : spice (EulerOS-SA-2021-2349)	Nessus	Huawei Local Security Checks	2021/9/7	2023/12/1	medium
154376	EulerOS 2.0 SP3 : spice (EulerOS-SA-2021-2616)	Nessus	Huawei Local Security Checks	2021/10/25	2023/11/28	medium
149736	CentOS 8 : spice (CESA-2021:1924)	Nessus	CentOS Local Security Checks	2021/5/19	2024/1/1	medium
149910	Oracle Linux 8 : spice (ELSA-2021-1924)	Nessus	Oracle Linux Local Security Checks	2021/5/26	2024/10/22	medium
150411	SUSE SLES15 Security Update : spice (SUSE-SU-2021:1901-1)	Nessus	SuSE Local Security Checks	2021/6/9	2026/6/25	medium
150653	SUSE SLES11 Security Update : spice (SUSE-SU-2021:14744-1)	Nessus	SuSE Local Security Checks	2021/6/10	2026/6/25	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

high