The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1700-1 advisory.

  - libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are     passed to osinfo-install-script via the command line. (CVE-2019-13313)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3387 advisory.

    - Resolves: rhbz#1727843 - CVE-2019-13313 libosinfo: osinfo-install-script                                option leaks password via command line argument

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1051 advisory.

  - libosinfo 1.5.0 allows local users to discover credentials by listing a process, because credentials are     passed to osinfo-install-script via the command line. (CVE-2019-13313)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2019-13313

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libosinfo package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in libosinfo, version 1.5.0, where the     script for automated guest installations,     'osinfo-install-script', accepts user and admin     passwords via command line arguments. This could allow     guest passwords to leak to other system users via a     process listing.(CVE-2019-13313)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
197545	SUSE SLES12 Security Update : libosinfo (SUSE-SU-2024:1700-1)	Nessus	SuSE Local Security Checks	2024/5/21	2024/5/21	high
180817	Oracle Linux 8 : osinfo-db / and / libosinfo (ELSA-2019-3387)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
135326	CentOS 7 : libosinfo (RHSA-2020:1051)	Nessus	CentOS Local Security Checks	2020/4/10	2024/10/9	high
126798	Fedora 29 : mingw-libosinfo (2019-4b8990e4d6)	Nessus	Fedora Local Security Checks	2019/7/19	2024/5/9	high
127083	Fedora 29 : libosinfo (2019-d2cde4761e)	Nessus	Fedora Local Security Checks	2019/7/26	2024/5/8	high
128811	EulerOS 2.0 SP5 : libosinfo (EulerOS-SA-2019-1888)	Nessus	Huawei Local Security Checks	2019/9/16	2024/4/25	high
129196	EulerOS 2.0 SP3 : libosinfo (EulerOS-SA-2019-2003)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	high

检测

插件搜索

high

high

high

high

high

high

high