The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7548 advisory.

    cockpit-composer     [41-1.0.1]
    - Make per page documentation links point to Oracle Linux [Orabug: 32013095]

    [41-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7950 advisory.

    cockpit-composer     [41-1.0.1]
    - Make per page documentation links point to Oracle Linux [Orabug: 32013095], [Orabug:34398922]

    [41-1]
    - New upstream release

    [40-1]
    - New upstream release

    [39-1]
    - New upstream release

    [38-1]
    - New upstream release

    [37-1]
    - New upstream release

    [35-1]
    - New upstream release

    [34-1]
    - New upstream release

    [33-1]
    - Add support for OCI upload target
    - Update translations
    - Update dependencies

    [32-1]
    - Add Edge Raw, RHEL Installer, Edge Simplified Installer image types
    - Improve user account modal responsiveness
    - Update tests
    - Update minor NPM dependencies
    - Update translation files

    [31-1]
    - Add new ostree image types
    - Improve loading state when waiting for api responses
    - Improve notification system
    - Improve test stability
    - Update NPM dependencies
    - Update translations

    [30-3]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [30-2]
    - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

    [30-1]
    - Add and update translations
    - Update NPM dependencies
    - Improve test reliability

    [28-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [28-1]
    - Use sentence case rather than title case
    - Add and update tests
    - Update translations from weblate
    - Update minor NPM dependencies

    [27-1]
    - Improve test reliability
    - Update translations from weblate
    - Update minor NPM dependencies

    [26-1]
    - Add additional form validation for the Create Image Wizard
    - Improve page size dropdown styling
    - Update minor NPM dependencies
    - Improve code styling
    - Improve test reliability

    osbuild     [65-1]
    - New upstream release

    [64-1]
    - New upstream release

    [63-1]
    - New upstream release

    [62-1]
    - New upstream release

    [61-1]
    - New upstream release

    [60-1]
    - New upstream release

    [59-1]
    - New upstream release

    [58-1]
    - New upstream release

    [57-1]
    - New upstream release

    [56-1]
    - New upstream release

    [55-1]
    - New upstream release

    [54-1]
    - New upstream release

    [53-1]
    - New upstream release

    [52-1]
    - New upstream release

    [50-1]
    - New upstream release

    [49-1]
    - New upstream release

    [48-1]
    - New upstream release

    [47-1]
    - New upstream release

    [46-1]
    - New upstream release

    [45-1]
    - New upstream release

    [44-1]
    - New upstream release

    [43-1]
    - New upstream release

    [42-1]
    - New upstream release

    [39-1]
    - New upstream release

    [35-1]
    - Upstream release 35

    [34-1]
    - Upstream release 34

    [33-1]
    - Upstream release 33

    [32-1]
    - Upstream release 32

    [31-1]
    - Upstream release 31

    [30-1]
    - Upstream release 30
    - Many new stages for building ostree-based raw images
    - Bootiso.mono stage was deprecated and split into smaller stages
    - Mounts are now represented as an array in a manifest
    - Various bug fixes and improvements to various stages

    [29-2]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [29-1]
    - Upstream release 29
    - Adds host services
    - Adds modprobe and logind stage

    [27-3]
    - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

    [27-2]
    - Include Fedora 35 runner (upstream commit 337e0f0)

    [27-1]
    - Upstream release 27
    - Various bug fixes related to the new container and installer       stages introdcued in version 25 and 26.

    [26-1]
    - Upstream release 26
    - Support for building boot isos
    - Grub stage gained support for saved_entry to fix grub tooling

    [25-1]
    - Upstream release 25
    - First tech preview of the new manifest format. Includes       various new stages and inputs to be able to build ostree       commits contained in a oci archive.

    [24-1]
    - Upstream release 24
    - Turn on dependency generator for everything but runners
    - Include new input binaries

    [23-2]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [23-1]
    - Upstream release 23
    - Do not mangle shebangs for assemblers, runners & stages.

    [22-1]
    - Upstream release 22

    [21-1]
    - Upstream reelase 21

    osbuild-composer     [62.1-1]
    - New upstream release

    [62-1]
    - New upstream release

    [60-1]
    - New upstream release

    [59-1]
    - New upstream release

    [58-1]
    - New upstream release

    [57-1]
    - New upstream release

    [55-1]
    - New upstream release

    [54-1]
    - New upstream release

    [53-1]
    - New upstream release

    [51-1]
    - New upstream release

    [46-1]
    - New upstream release

    [45-1]
    - New upstream release

    [44-1]
    - New upstream release

    [43-1]
    - New upstream release

    [42-1]
    - New upstream release

    [41-1]
    - New upstream release

    [40-1]
    - New upstream release

    [39-1]
    - New upstream release

    [38-1]
    - New upstream release

    * Tue Nov 02 2021 lavocatt - 37-1
    - New upstream release

    [36-1]
    - New upstream release

    [33-1]
    - New upstream release

    [32-1]
    - New upstream release

    [31-1]
    - New upstream release

    [30-2]
    - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags       Related: rhbz#1991688

    [30-1]
    - New upstream release

    [29-3]
    - Rebuilt for RHEL 9 BETA for openssl 3.0       Related: rhbz#1971065

    [29-2]
    - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937

    [29-1]
    - New upstream release

    [28-1]
    - New upstream release

    [27-1]
    - New upstream release

    [26-3]
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

    [26-2]
    - Fix the compatibility with a new golang-github-azure-storage-blob 0.12

    [26-1]
    - New upstream release

    [25-1]
    - New upstream release

    [24-1]
    - New upstream release

    [23-1]
    - New upstream release

    [22-1]
    - New upstream release

    weldr-client     [35.5-4]
    - tests: Add osbuild-composer repo file for RHEL 9.1       Related: rhbz#2118831

    [35.5-3]
    - tests: Update tests for osbuild composer changes       Resolves: rhbz#2118831

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2193 advisory.

    Butane translates human-readable Butane Configs into machine-readable Ignition configs for provisioning     operating systems that use Ignition.

    The following packages have been upgraded to a later upstream version: butane (0.16.0). (BZ#2135475)

    Security Fix(es):

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2357 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests     (CVE-2022-41717)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:2193 advisory.

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2802 advisory.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2758 advisory.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an     attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. (CVE-2022-1962)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via a deeply nested XML document. (CVE-2022-28131)

  - Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the 'any' field tag. (CVE-2022-30633)

  - Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an     attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
    (CVE-2022-30635)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2758 advisory.

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)
    * golang: crypto/tls: session tickets lack random ticket_age_add (CVE-2022-30629)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the toolbox-0.0.99.3-7.el9 build changelog.

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a     panic due to stack exhaustion via a path which contains a large number of path separators.
    (CVE-2022-30630)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via a path containing a large number of path separators.
    (CVE-2022-30632)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2022:7399

    Security Fix(es):

    * go-yaml: Denial of Service in go-yaml (CVE-2021-4235)
    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
    * kubernetes: Unauthorized read of Custom Resources (CVE-2022-3162)
    * kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
    * cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)
    * OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)
    * cri-o: Security regression of CVE-2022-27652 (CVE-2022-3466)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3920:02 advisory.

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)
      * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: net/[http:](http:) handle server errors after sending GOAWAY (CVE-2022-27664)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working     (CVE-2022-32148)
      * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2023_2802 advisory.

    * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

    * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

    * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

    * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

    * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
167594	Oracle Linux 8 : Image / Builder (ELSA-2022-7548)	Nessus	Oracle Linux Local Security Checks	2022/11/16	2024/11/1	high
168114	Oracle Linux 9 : Image / Builder (ELSA-2022-7950)	Nessus	Oracle Linux Local Security Checks	2022/11/22	2024/11/2	high
175419	RHEL 9 : butane (RHSA-2023:2193)	Nessus	Red Hat Local Security Checks	2023/5/12	2025/3/11	high
175475	RHEL 9 : git-lfs (RHSA-2023:2357)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/3/10	high
175651	AlmaLinux 9 : butane (ALSA-2023:2193)	Nessus	Alma Linux Local Security Checks	2023/5/14	2023/5/14	high
175893	CentOS 8 : container-tools:4.0 (CESA-2023:2802)	Nessus	CentOS Local Security Checks	2023/5/16	2024/2/8	high
176149	CentOS 8 : container-tools:rhel8 (CESA-2023:2758)	Nessus	CentOS Local Security Checks	2023/5/20	2024/2/8	medium
176167	AlmaLinux 8 : container-tools:rhel8 (ALSA-2023:2758)	Nessus	Alma Linux Local Security Checks	2023/5/20	2025/1/13	medium
191376	CentOS 9 : toolbox-0.0.99.3-7.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
194196	RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	2024/4/28	2026/3/16	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
203301	Photon OS 4.0: Go PHSA-2022-4.0-0242	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/29	high
224721	Linux Distros Unpatched Vulnerability : CVE-2022-32189	Nessus	Misc.	2025/3/5	2026/9/2	high
293342	MiracleLinux 8 : git-lfs-2.13.3-3.el8 (AXSA:2022-3920:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	medium
356381	Rocky Linux 8 [CIQ] Security Update: cockpit-podman / crit / criu / criu-debuginfo / criu-debugsource / etc Multiple Vulnerabilities (crlsa-2023_2802)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

high

high

high

high

high

high

medium

medium

medium

high

critical

high

high

medium

high