There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS,
    Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd
    allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd
    setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to
    `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier
    versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a
    workaround do not use `FLUENT_OJ_OPTION_MODE=object`. (CVE-2022-39379)

リモートの Fedora 37 ホストには、FEDORA-2023-69e2a6534 のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

  - Fluentd はさまざまなデータソースからイベントを収集し、ファイル、RDBMS、NoSQL、IaaS、SaaS、Hadoop などに書き込みます。Fluentd のデフォルト以外の設定にあるリモートコード実行 (RCE) の脆弱性により、認証されていない攻撃者が特別に細工された JSON ペイロードを介して任意のコードを実行する可能性があります。Fluentd のセットアップは、環境変数「FLUENT_OJ_OPTION_MODE」が明示的に「object」に設定されている場合にのみ影響を受けます。注意: Fluentd バージョン 1.13.2 に FLUENT_OJ_OPTION_MODE オプションが導入されました。以前のバージョンの Fluentd はこの脆弱性の影響を受けません。この問題には、バージョン 1.15.3 でパッチが適用されていました。回避策として、「FLUENT_OJ_OPTION_MODE=object」を使用しないでください。(CVE-2022-39379)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of rubygem-fluentd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-39379 advisory.

  - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS,     Hadoop and so on. A remote code execution (RCE) vulnerability in non-default configurations of Fluentd     allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Fluentd     setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to     `object`. Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier     versions of Fluentd are not affected by this vulnerability. This issue was patched in version 1.15.3. As a     workaround do not use `FLUENT_OJ_OPTION_MODE=object`. (CVE-2022-39379)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-6b9e2a6534 advisory.

    golang-github-graylog2-gelf-2.0.0-5.20201111git1550ee6.fc37 was not in F37 because was override with     golang-github-graylog2-gelf-2.0.0-4.20190627git7ebf4f5.fc37


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
414621	SCA: security update for fluentd (GHSA-fppq-mj76-fpj2)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	critical
414621	SCA: security update for fluentd (GHSA-fppq-mj76-fpj2)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	critical
194651	Fedora 37 : golang-github-docker / golang-github-graylog2-gelf (2023-6b9e2a6534)	Nessus	Fedora Local Security Checks	2024/4/29	2024/11/14	critical
172897	CBL Mariner 2.0 Security Update: rubygem-fluentd (CVE-2022-39379)	Nessus	MarinerOS Local Security Checks	2023/3/20	2025/2/10	critical
194651	Fedora 37 : golang-github-docker / golang-github-graylog2-gelf (2023-6b9e2a6534)	Nessus	Fedora Local Security Checks	2024/4/29	2024/11/14	critical
332500	Photon OS 5.0: Rubygem PHSA-2025-5.0-91-0497	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	critical
233995	Photon OS 5.0: Rubygem PHSA-2025-5.0-0497	Nessus	PhotonOS Local Security Checks	2025/4/8	2025/4/8	critical
234753	Photon OS 4.0: Rubygem PHSA-2025-4.0-0783	Nessus	PhotonOS Local Security Checks	2025/4/23	2025/4/23	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical