=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN383
_____________________________________________________________________

DATE                : 23/07/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Tenable.sc versions prior to
                                       5.19.0.

=====================================================================
https://www.tenable.com/security/tns-2021-14
_____________________________________________________________________


[R1] Tenable.sc 5.19.0 Fixes Multiple Third-party Vulnerabilities

Critical

Synopsis

Tenable.sc leverages third-party software to help provide underlying
functionality. Multiple third-party components were found to contain
vulnerabilities, and updated versions have been made available by the
providers.

Out of caution, and in line with best practice, Tenable has upgraded the
bundled components to address the potential impact of these issues.

Tenable.sc 5.19.0 updates the following components:

1. Handlebars
CVE-2019-19919
Severity: Critical


2. Underscore
CVE-2021-23358
Severity: High


3. Apache FOP
CVE-2017-5661
Severity: High


4. Bootstrap
CVE-2019-8331, CVE-2018-20676, CVE-2018-20677, CVE-2018-14040,
CVE-2018-14042, CVE-2016-10735
Highest Severity: Medium


5. PHP
CVE-2019-11041, CVE-2019-11042, CVE-2019-11043, CVE-2019-11044,
CVE-2019-11045, CVE-2019-11046, CVE-2019-11047, CVE-2019-11048,
CVE-2019-11049, CVE-2019-11050, CVE-2020-7059, CVE-2020-7060,
CVE-2020-7061, CVE-2020-7062, CVE-2020-7063, CVE-2020-7064,
CVE-2020-7065, CVE-2020-7066, CVE-2020-7067, CVE-2020-7068,
CVE-2020-7069, CVE-2020-7070, CVE-2020-7071, CVE-2021-21702,
CVE-2021-21704, CVE-2021-21705
Highest Severity: Critical


6. sqlite
CVE-2019-16168, CVE-2019-19645, CVE-2019-19646, CVE-2020-11655,
CVE-2020-11656, CVE-2020-13434, CVE-2020-13435, CVE-2020-13630,
CVE-2020-13631, CVE-2020-13632, CVE-2020-15358
Highest Severity: Critical


7. SimpleSAMLPHP
CVE-2020-11022
Severity: Medium



Solution

Tenable has released Tenable.sc 5.19.0 to address these issues. The
installation files can be obtained from the Tenable Downloads Portal (
https://
www.tenable.com/downloads/tenable-sc ).


Additional References

https://docs.tenable.com/tenablesc/5_19/Content/Welcome.htm
https://docs.tenable.com/releasenotes/Content/tenablesc/tenablesc5190.htm

This page contains information regarding security vulnerabilities
that may impact Tenable's products. This may include issues specific
to our software, or due to the use of third-party libraries within our
software. Tenable strongly encourages users to ensure that they upgrade
or apply relevant patches in a timely manner.

Tenable takes product security very seriously. If you believe you have
found a vulnerability in one of our products, we ask that you please
work with us to quickly resolve it in order to protect customers.
Tenable believes in responding quickly to such reports, maintaining
communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our
Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email


Risk Information

CVE ID: CVE-2019-19919
CVE-2021-23358
CVE-2017-5661
CVE-2019-8331
CVE-2018-20676
CVE-2018-20677
CVE-2018-14040
CVE-2018-14042
CVE-2016-10735
CVE-2019-11041
CVE-2019-11042
CVE-2019-11043
CVE-2019-11044
CVE-2019-11045
CVE-2019-11046
CVE-2019-11047
CVE-2019-11048
CVE-2019-11049
CVE-2019-11050
CVE-2020-7059
CVE-2020-7060
CVE-2020-7061
CVE-2020-7062
CVE-2020-7063
CVE-2020-7064
CVE-2020-7065
CVE-2020-7066
CVE-2020-7067
CVE-2020-7068
CVE-2020-7069
CVE-2020-7070
CVE-2020-7071
CVE-2021-21702
CVE-2021-21704
CVE-2021-21705
CVE-2019-16168
CVE-2019-19645
CVE-2019-19646
CVE-2020-11655
CVE-2020-11656


Tenable Advisory ID:
TNS-2021-14

Risk Factor:
Critical

CVSSv3 Base / Temporal Score:
9.8 / 8.5
CVSSv3 Vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C


Affected Products

Tenable.sc versions 5.18.0 and earlier


Advisory Timeline

2021-07-22 - [R1] Initial Release


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================