Security Bulletin: IBM B2B Advanced Communications is vulnerable to man-in-the-middle attack due to log4j-core (CVE-2025-68161)

Summary IBM B2B Advanced Communications has addressed vulnerabilities in log4j-core shipped with product Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer...

RockyLinux 9 : postfix (RLSA-2026:26205)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26205 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the RockyLinux...

RockyLinux 9 : tomcat (RLSA-2026:26323)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26323 advisory. tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 Tenable has extracted the preceding description bloc...

AlmaLinux 8 : postfix (ALSA-2026:25932)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:25932 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the AlmaLinux...

Photon OS 5.0: Httpd PHSA-2026-5.0-0881

An update of the httpd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0881. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

AlmaLinux 10 : postfix (ALSA-2026:25930)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:25930 advisory. postfix: buffer over-read via malformed enhanced status code CVE-2026-43964 Tenable has extracted the preceding description block directly from the AlmaLinux...

Fedora 44 : gh (2026-f07b3548d4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f07b3548d4 advisory. Update to 2.94.0 ---- Update to 2.93.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 44 : chezmoi (2026-905e9afc79)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-905e9afc79 advisory. Update to 2.70.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : vaultwarden-web (2026-064873552d)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-064873552d advisory. update to 2026.4.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2424)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 Tenable has extracted the preceding description block directly from the EulerO...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2423)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 Tenable has extracted the preceding description block directly from the EulerO...

AlmaLinux 9 : mod_http2 (ALSA-2026:25057)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:25057 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

Fedora 43 : putty (2026-61f53cc218)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61f53cc218 advisory. This is an update fixing several security related problems in putty. Tenable has extracted the preceding description block directly from the Fedora...

Important: ruby4.0

Issue Overview: Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAPstarttls to return "successfully", without starting TLS. This issue has been patched in...

Medium: perl-libwww-perl

Issue Overview: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorizatio...

Fedora 43 : perl-CryptX (2026-2ef4c0c642)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2ef4c0c642 advisory. Fixes CVE-2026-41565 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Fedora 44 : perl-CryptX (2026-2158c96917)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2158c96917 advisory. Fixes CVE-2026-41565 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Slackware Linux 15.0 / current dnsmasq Vulnerability (SSA:2026-155-01)

The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-155-01 advisory. New dnsmasq packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

Fedora 43 : thunderbird (2026-8463c31b61)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8463c31b61 advisory. Update to latest upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...