6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
41.2%
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2132 advisory.
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr
filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
(CVE-2024-22195)
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn’t remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like POST
) to GET
as is required by HTTP RFCs.
Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren’t putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn’t exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren’t expecting to respond with redirects with redirects=False
and disable automatic redirects with redirects=False
and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)
PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. (CVE-2023-52323)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2024-2132.
##
include('compat.inc');
if (description)
{
script_id(195077);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/06");
script_cve_id("CVE-2023-45803", "CVE-2023-52323", "CVE-2024-22195");
script_name(english:"Oracle Linux 9 : fence-agents (ELSA-2024-2132)");
script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ELSA-2024-2132 advisory.
- Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar
to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,
potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject
arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to
XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
(CVE-2024-22195)
- urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP
request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method
changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
Although this behavior is not specified in the section for redirects, it can be inferred by piecing
together information from different sections and we have observed the behavior in other major HTTP client
implementations like curl and web browsers. Because the vulnerability requires a previously trusted
service to become compromised in order to have an impact on confidentiality we believe the exploitability
of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request
bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions
must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information
in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts
redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve
this issue. Users unable to update should disable redirects for services that aren't expecting to respond
with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle
301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)
- PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable
for a Manger attack. (CVE-2023-52323)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2024-2132.html");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-22195");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/17");
script_set_attribute(attribute:"patch_publication_date", value:"2024/05/02");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/06");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:9:4:appstream_base");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:9::addons");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:9::appstream");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:9");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-common");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-compute");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-ibm-powervs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-ibm-vpc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-kubevirt");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-agents-virsh");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virt");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd-cpg");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd-libvirt");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd-multicast");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd-serial");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fence-virtd-tcp");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Oracle Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_release = get_kb_item("Host/RedHat/release");
if (isnull(os_release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^9([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 9', 'Oracle Linux ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);
var pkgs = [
{'reference':'fence-agents-common-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-compute-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-ibm-powervs-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-ibm-vpc-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-kubevirt-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-virsh-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virt-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-cpg-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-libvirt-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-multicast-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-serial-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-tcp-4.10.0-62.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-common-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-compute-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-ibm-powervs-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-ibm-vpc-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-kubevirt-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-agents-virsh-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virt-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-cpg-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-libvirt-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-multicast-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-serial-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fence-virtd-tcp-4.10.0-62.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference && _release) {
if (exists_check) {
if (rpm_exists(release:_release, rpm:exists_check) && rpm_check(release:_release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
} else {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'fence-agents-common / fence-agents-compute / fence-agents-ibm-powervs / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
oracle | linux | 9 | cpe:/a:oracle:linux:9:4:appstream_base |
oracle | linux | 9 | cpe:/a:oracle:linux:9::addons |
oracle | linux | 9 | cpe:/a:oracle:linux:9::appstream |
oracle | linux | 9 | cpe:/o:oracle:linux:9 |
oracle | linux | fence-agents-common | p-cpe:/a:oracle:linux:fence-agents-common |
oracle | linux | fence-agents-compute | p-cpe:/a:oracle:linux:fence-agents-compute |
oracle | linux | fence-agents-ibm-powervs | p-cpe:/a:oracle:linux:fence-agents-ibm-powervs |
oracle | linux | fence-agents-ibm-vpc | p-cpe:/a:oracle:linux:fence-agents-ibm-vpc |
oracle | linux | fence-agents-kubevirt | p-cpe:/a:oracle:linux:fence-agents-kubevirt |
oracle | linux | fence-agents-virsh | p-cpe:/a:oracle:linux:fence-agents-virsh |
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
41.2%