There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the
    container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port
    as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the
    destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted
    on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port.
    This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is
    fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does
    not have this vulnerability. (CVE-2025-67499)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - CNI 連接埠對應外掛程式允許容器模擬開啟主機連接埠進而將該流量轉送至容器。使用 nftables 後端設定 portmap 外掛程式時 1.6.0 至 1.8.0 版會不慎轉送目的地連接埠與主機連接埠相同的所有流量因而忽略目的地 IP。這包括非預定用於節點本身的流量例如節點上主控之容器的流量。要求 HostPort 轉送的容器可攔截目的地為該連接埠的所有流量。
    這需要將連接埠對應外掛程式明確設定為使用 nftables 後端。1.9.0 版已修正此問題。若要因應措施請將 portmap 外掛程式設定為使用 iptables 後端。它沒有此弱點。 (CVE-2025-67499)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - CNI portmap 插件允许容器模拟打开主机端口从而将该流量转发到容器。当使用 nftables 后端配置 portmap 插件时 1.6.0 到 1.8.0 版本无意间转发具有与主机端口相同的目标端口的所有流量从而忽略目标 IP。包括不应发送至该节点本身的流量，即发送至该节点上托管的容器的流量。请求 HostPort 转发的容器可以拦截流向该端口的所有流量。
    这需要将 portmap 插件显式配置为使用 nftables 后端。此问题已在 1.9.0 版本中修复。若要变通方案将 portmap 插件配置为使用 iptables 后端。则不存在此漏洞。 (CVE-2025-67499)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

リモートの Fedora 44 ホストには、 FEDORA-2025-c67591d0a2 アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    containernetworking-plugins-1.9.0-1.fc44 の自動 更新。

    ##### **変更ログ**

    ```
    * 2025 年 12 月 9 日火曜日 Bradley G Smith 氏 <bradley.g.smith@gmail.com> - 1.9.0-1
    - リリース v1.9.0 への更新
    - 解決 : rhbz#2420515
    - 解決 CVE-2025-58188rhbz#2411454、、、 rhbz#2411189rhbz#2410923
    - 解決 CVE-2025-58185rhbz#2410556、、、 rhbz#2410277rhbz#2409991
    - 解決 CVE-2025-61723rhbz#2409605、、、 rhbz#2409325rhbz#2409043
    - 解決 CVE-2025-58189rhbz#2408135、、、 rhbz#2407858rhbz#2407588
    - ポートマッププラグインの nftables バックエンドのバグである を修正します CVE-2025-67499
    - 追加の変更

    ```

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the     container. Versions 1.6.0 through 1.8.0 inadvertently forward all traffic with the same destination port     as the host port when the portmap plugin is configured with the nftables backend, thus ignoring the     destination IP. This includes traffic not intended for the node itself, i.e. traffic to containers hosted     on the node. Containers that request HostPort forwarding can intercept all traffic destined for that port.
    This requires that the portmap plugin be explicitly configured to use the nftables backend. This issue is     fixed in version 1.9.0. To workaround, configure the portmap plugin to use the iptables backend. It does     not have this vulnerability. (CVE-2025-67499)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c67591d0a2 advisory.

    Automatic update for containernetworking-plugins-1.9.0-1.fc44.

    ##### **Changelog**

    ```
    * Tue Dec  9 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 1.9.0-1
    - Update to release v1.9.0
    - Resolves: rhbz#2420515
    - Resolves CVE-2025-58188: rhbz#2411454, rhbz#2411189, rhbz#2410923
    - Resolves CVE-2025-58185: rhbz#2410556, rhbz#2410277, rhbz#2409991
    - Resolves CVE-2025-61723: rhbz#2409605, rhbz#2409325, rhbz#2409043
    - Resolves CVE-2025-58189: rhbz#2408135, rhbz#2407858, rhbz#2407588
    - Fixes CVE-2025-67499, a bug in the nftables backend for the portmap       plugin
    - Additional changes

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
436320	SCA: security update for github.com/containernetworking/plugins (GHSA-jv3w-x3r3-g6rm)	Tenable Cloud Security	SCA Checks	2025/12/9	2026/7/2	low
436320	SCA: security update for github.com/containernetworking/plugins (GHSA-jv3w-x3r3-g6rm)	Tenable Self-Hosted Container Security	SCA Checks	2025/12/9	2026/7/2	low
278373	Linux Distros 未修補的弱點：CVE-2025-67499	Nessus	Misc.	2025/12/11	2026/6/28	low
278373	Linux Distros 未修补的漏洞：CVE-2025-67499	Nessus	Misc.	2025/12/11	2026/6/28	low
278132	Fedora 44containernetworking-plugins2025-c67591d0a2	Nessus	Fedora Local Security Checks	2025/12/10	2025/12/10	medium
278373	Linux Distros Unpatched Vulnerability : CVE-2025-67499	Nessus	Misc.	2025/12/11	2026/6/28	low
278132	Fedora 44 : containernetworking-plugins (2025-c67591d0a2)	Nessus	Fedora Local Security Checks	2025/12/10	2025/12/10	medium

检测

插件搜索

low

low

low

low

medium

low

medium