According to the versions of the selinux-policy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24     because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode,     pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option     (the default when configured by the authselect tool), and that file cannot be read, the second factor is     disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
    (CVE-2020-24612)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - .config/Yubicoディレクトリが不適切に処理されるため、2020年8月24日までのselinux-policy別名Reference Policyパッケージ 3.14 で問題が発見されました。その結果、SELinux が強制モードの場合、pam-u2f はユーザーの U2F 構成ファイルを読み取ることが許可されません。nouserok オプションで構成され (authselect ツールで構成されている場合はデフォルト)、そのファイルを読み取ることができない場合、2 番目の要素は無効になります。その後、パスワードのみを知っている攻撃者がログインし、2FA をバイパスする可能性があります。
    (CVE-2020-24612)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 由於未正確處理 .config/Yubico 目錄因此在 2020 年 8 月 24 日之前的 selinux-policy (即參照原則) 套件 3.14 中發現一個問題。因此當 SELinux 處於強制模式時不允許 pam-u2f 讀取使用者的 U2F 設定檔。如果以 nouserok 選項 (authselect 工具設定時的預設值) 進行設定且無法讀取該檔案則會停用第二個因素。然後，只知道密碼的攻擊者可以登入並繞過 2FA。
    (CVE-2020-24612)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 至 2020 年 8 月 24 日的 selinux-policy又称为参考策略程序包 3.14 中发现一个问题原因是 .config/Yubico 目录未正确处理。因此当 SELinux 处于强制模式时不允许 pam-u2f 读取用户的 U2F 配置文件。如果使用 nouserok 选项由 authselect 工具配置时的默认选项进行配置并且无法读取该文件则第二个因素将禁用。然后，仅知道密码的攻击者就可以绕过 2FA 进行登录。
    (CVE-2020-24612)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

According to the versions of the selinux-policy packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24     because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode,     pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option     (the default when configured by the authselect tool), and that file cannot be read, the second factor is     disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
    (CVE-2020-24612)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the selinux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the selinux-policy (aka Reference Policy) package 3.14 through 2020-08-24     because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode,     pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok option     (the default when configured by the authselect tool), and that file cannot be read, the second factor is     disabled. An attacker with only the knowledge of the password can then log in, bypassing 2FA.
    (CVE-2020-24612)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162896	EulerOS 2.0 SP9 : selinux-policy (EulerOS-SA-2022-2012)	Nessus	Huawei Local Security Checks	2022/7/8	2022/7/8	medium
163544	EulerOS 2.0 SP10 : selinux-policy (EulerOS-SA-2022-2171)	Nessus	Huawei Local Security Checks	2022/7/29	2022/7/29	medium
249836	Linux Distros のパッチ未適用の脆弱性: CVE-2020-24612	Nessus	Misc.	2025/8/15	2025/8/15	medium
249836	Linux Distros 未修補的弱點：CVE-2020-24612	Nessus	Misc.	2025/8/15	2025/8/15	medium
249836	Linux Distros 未修补的漏洞：CVE-2020-24612	Nessus	Misc.	2025/8/15	2025/8/15	medium
163170	EulerOS Virtualization 2.10.1 : selinux-policy (EulerOS-SA-2022-2122)	Nessus	Huawei Local Security Checks	2022/7/14	2022/7/14	medium
165362	EulerOS Virtualization 2.9.1 : selinux-policy (EulerOS-SA-2022-2366)	Nessus	Huawei Local Security Checks	2022/9/23	2022/9/23	medium
162878	EulerOS 2.0 SP9 : selinux-policy (EulerOS-SA-2022-1982)	Nessus	Huawei Local Security Checks	2022/7/8	2022/7/8	medium
163526	EulerOS 2.0 SP10 : selinux-policy (EulerOS-SA-2022-2146)	Nessus	Huawei Local Security Checks	2022/7/29	2022/7/29	medium
203297	Photon OS 4.0: Selinux PHSA-2021-4.0-0140	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
163203	EulerOS Virtualization 2.10.0 : selinux-policy (EulerOS-SA-2022-2102)	Nessus	Huawei Local Security Checks	2022/7/15	2022/7/15	medium
165374	EulerOS Virtualization 2.9.0 : selinux-policy (EulerOS-SA-2022-2402)	Nessus	Huawei Local Security Checks	2022/9/23	2022/9/23	medium
249836	Linux Distros Unpatched Vulnerability : CVE-2020-24612	Nessus	Misc.	2025/8/15	2025/8/15	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium