The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4451 advisory.

  - gnutls: Use after free in client key_share extension (CVE-2021-20231)

  - gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

  - nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4451 advisory.

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements     cryptographic algorithms and protocols such as SSL, TLS, and DTLS.

    Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits     for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in     kernel space.

    The following packages have been upgraded to a later upstream version: gnutls (3.6.16). (BZ#1956783)

    Security Fix(es):

    * nettle: Remote crash in RSA decryption via manipulated ciphertext (CVE-2021-3580)

    * gnutls: Use after free in client key_share extension (CVE-2021-20231)

    * gnutls: Use after free in client_send_params in lib/ext/pre_shared_key.c (CVE-2021-20232)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has gnutls packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS     1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second     handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit     function is called after detecting a handshake failure. (CVE-2020-24659)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

  - A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4451 advisory.

    - Backport CVE-2021-3580 from upstream 3.7.3 release (#1967990)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4451 advisory.

  - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An     attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial     of service. (CVE-2021-3580)

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for gnutls fixes the following issues :

CVE-2021-20232: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183456).

CVE-2021-20231: Fixed a use after free issue which could have led to memory corruption and other potential consequences (bsc#1183457).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in     client sending key_share extension may lead to memory     corruption and other consequences.(CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in     client_send_params in lib/ext/pre_shared_key.c may lead     to memory corruption and other potential     consequences.(CVE-2021-20232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in     client_send_params in lib/ext/pre_shared_key.c may lead     to memory corruption and other potential     consequences.(CVE-2021-20232)

  - A flaw was found in gnutls. A use after free issue in     client sending key_share extension may lead to memory     corruption and other consequences.(CVE-2021-20231)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0181 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2021-20231:
    A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences.

    CVE-2021-20232:
    A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences.

    CVE-2022-2509:
    A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to     memory corruption and other consequences. (CVE-2021-20231)

  - A flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may     lead to memory corruption and other potential consequences. (CVE-2021-20232)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9221 advisory.

    [3.6.16-4.0.1_fips]
    - Allow RSA keygen with modulus sizes bigger than 3072 bits and validate the seed length       as defined in FIPS 186-4 section B.3.2 [Orabug: 33200526]
    - Allow bigger known RSA modulus sizes when calling       rsa_generate_fips186_4_keypair directly [Orabug: 33200526]
    - Change Epoch from 1 to 10

    [3.6.16-4]
    - p11tool: Document ID reuse behavior when importing certs (#1776250)

    [3.6.16-3]
    - Treat SHA-1 signed CA in the trusted set differently (#1965445)

    [3.6.16-2]
    - Filter certificate_types in TLS 1.2 CR based on signature algorithms (#1942216)

    [3.6.16-1]
    - Update to upstream 3.6.16 release (#1956783)
    - Fix potential use-after-free in key_share handling (#1927597)
    - Fix potential use-after-free in pre_shared_key handling (#1927593)
    - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
    - Fix cert expiration issue in tests (#1908110)

    [3.6.14-10]
    - Port fixes for potential miscalculation in ecdsa_verify (#1942931)

    [3.6.14-9]
    - Revert the previous change

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155052	CentOS 8 : gnutls and nettle (CESA-2021:4451)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	critical
155114	RHEL 8 : gnutls and nettle (RHSA-2021:4451)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	critical
187367	NewStart CGSL MAIN 6.06 : gnutls Multiple Vulnerabilities (NS-SA-2023-0100)	Nessus	NewStart CGSL Local Security Checks	2023/12/27	2023/12/27	critical
155423	Oracle Linux 8 : gnutls / and / nettle (ELSA-2021-4451)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/11/1	critical
157640	AlmaLinux 8 : gnutls and nettle (ALSA-2021:4451)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	critical
148171	SUSE SLED15 / SLES15 Security Update : gnutls (SUSE-SU-2021:0935-1)	Nessus	SuSE Local Security Checks	2021/3/26	2024/1/8	critical
152302	EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2021-2245)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	critical
151548	EulerOS Virtualization 2.9.1 : gnutls (EulerOS-SA-2021-2184)	Nessus	Huawei Local Security Checks	2021/7/13	2023/12/8	critical
236730	Alibaba Cloud Linux 3 : 0181: gnutls (ALINUX3-SA-2022:0181)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
152339	EulerOS 2.0 SP9 : gnutls (EulerOS-SA-2021-2271)	Nessus	Huawei Local Security Checks	2021/8/9	2023/12/6	critical
157978	EulerOS Virtualization 3.0.6.0 : gnutls (EulerOS-SA-2022-1067)	Nessus	Huawei Local Security Checks	2022/2/12	2023/11/9	critical
159015	Oracle Linux 8 : gnutls (ELSA-2022-9221)	Nessus	Oracle Linux Local Security Checks	2022/3/17	2025/9/17	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical