The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3749 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for librepo fixes the following issues :

  - Fixed path validation to prevent directory traversal     attacks (bsc#1175475, CVE-2020-14352)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3658 advisory.

    [1.11.0-3]
    - Validate paths read from repomd.xml (RhBug:1866498)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the librepo package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has librepo packages installed that are affected by a vulnerability:

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020:3658 公告中提及的弱點影響。

  - librepo：repomd.xml 中缺少路徑驗證，可能導致目錄遊走 (CVE-2020-14352)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 7 主機上安裝的套件受到 RHSA-2020:5012 公告中提及的弱點影響。

  - 在 1.12.1 之前的 librepo 中發現一個瑕疵。發現一個目錄遊走弱點，無法清理遠端存放庫詮釋資料中的路徑。控制存放庫的攻擊者可以透過路徑周遊複製目標系統上目的地目錄以外的檔案。此缺陷可能會透過覆寫重要的系統檔案導致系統遭到入侵。此瑕疵最主要的威脅對象是使用未受信任第三方存放庫的使用者。
    (CVE-2020-14352)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 3756 公告。

  - librepo：repomd.xml 中缺少路徑驗證，可能導致目錄遊走 (CVE-2020-14352)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5012 advisory.

  - A flaw was found in librepo in versions before 1.12.1. A directory traversal vulnerability was found where     it failed to sanitize paths in remote repository metadata. An attacker controlling a remote repository may     be able to copy files outside of the destination directory on the targeted system via path traversal. This     flaw could potentially result in system compromise via the overwriting of critical system files. The     highest threat from this flaw is to users that make use of untrusted third-party repositories.
    (CVE-2020-14352)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3658 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the librepo package has been released.

createrepo_c 0.16.1

  - Update to 0.16.1

  - Add the section number to the manual pages

  - Parse xml snippet in smaller parts (RhBug:1859689)

  - Add module metadata support to createrepo_c     (RhBug:1795936)

librepo 1.12.1

  - Update to 1.12.1

  - Validate path read from repomd.xml (RhBug:1868639)

libdnf 0.54.2

  - Update to 0.54.2

  - history: Fix dnf history rollback when a package was     removed (RhBug:1683134)

  - Add support for HY_GT, HY_LT in query nevra_strict

  - Fix parsing empty lines in config files

  - Accept '==' as an operator in reldeps (RhBug:1847946)

  - Add log file level main config option (RhBug:1802074)

  - Add protect_running_kernel configuration option     (RhBug:1698145)

  - Context part of libdnf cannot assume zchunk is on     (RhBug:1851841,1779104)

  - Fix memory leak of resultingModuleIndex and handle     g_object refs

  - Redirect librepo logs to libdnf logs with different     source

  - Introduce changelog metadata in commit messages

  - Add hy_goal_lock

  - Update Copr targets for packit and use alias

  - Enum/String conversions for Transaction Store/Replay

  - utils: Add a method to decode URLs

  - Unify hawkey.log line format with the rest of the logs

dnf 4.4.0

  - Update to 4.4.0

  - Handle empty comps group name (RhBug:1826198)

  - Remove dead history info code (RhBug:1845800)

  - Improve command emmitter in dnf-automatic

  - Enhance --querytags and --qf help output

  - [history] add option --reverse to history list     (RhBug:1846692)

  - Add logfilelevel configuration (RhBug:1802074)

  - Don't turn off stdout/stderr logging longer than     necessary (RhBug:1843280)

  - Mention the date/time that updates were applied

  - [dnf-automatic] Wait for internet connection     (RhBug:1816308)

  - [doc] Enhance repo variables documentation     (RhBug:1848161,1848615)

  - Add librepo logger for handling messages from librepo     (RhBug:1816573)

  - [doc] Add package-name-spec to the list of possible     specs

  - [doc] Do not use <package-nevr-spec>

  - [doc] Add section to explain -n, -na and -nevra suffixes

  - Add alias 'ls' for list command

  - README: Reference Fedora Weblate instead of Zanata

  - remove log_lock.pid after reboot(Rhbug:1863006)

  - comps: Raise CompsError when removing a non-existent     group

  - Add methods for working with comps to     RPMTransactionItemWrapper

  - Implement storing and replaying a transaction

  - Log failure to access last makecache time as warning

  - [doc] Document Substitutions class

  - Dont document removed attribute ``reports`` for     get_best_selector

  - Change the debug log timestamps from UTC to local time

dnf-plugins-core 4.0.18

  - [needs-restarting] Fix plugin fail if needs-restarting.d     does not exist

  - [needs-restarting] add kernel-rt to reboot list

  - Fix debug-restore command

  - [config-manager] enable/disable comma separated pkgs     (RhBug:1830530)

  - [debug] Use standard demands.resolving for transaction     handling

  - [debug] Do not remove install-only packages     (RhBug:1844533)

  - return error when dnf download failed

  - README: Reference Fedora Weblate instead of Zanata

  - [reposync] Add latest NEVRAs per stream to download     (RhBug: 1833074)

  - copr: don't try to list runtime dependencies

dnf-plugins-extras 4.0.12

  - Update Cmake to pull translations from weblate

  - Drop Python 2 support

  - README: Add Installation, Contribution, etc

  - Add the DNF_SYSTEM_UPGRADE_NO_REBOOT env variable to     control system-upgrade reboot.

  - [system-upgrade] Upgrade groups and environments     (RhBug:1845562,1860408)

livecd-tools-27.1-8

  - Fix compatibility with dnf 4.4.0 / libdnf 0.54.2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the librepo packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in librepo in versions before 1.12.1.
    A directory traversal vulnerability was found where it     failed to sanitize paths in remote repository metadata.
    An attacker controlling a remote repository may be able     to copy files outside of the destination directory on     the targeted system via path traversal. This flaw could     potentially result in system compromise via the     overwriting of critical system files. The highest     threat from this flaw is to users that make use of     untrusted third-party repositories.(CVE-2020-14352)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3756 advisory.

    The librepo library provides a C and Python API to download repository metadata.

    Security Fix(es):

    * librepo: missing path validation in repomd.xml may lead to directory traversal (CVE-2020-14352)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
140594	RHEL 8 : librepo (RHSA-2020:3749)	Nessus	Red Hat Local Security Checks	2020/9/15	2024/11/7	high
140077	openSUSE Security Update : librepo (openSUSE-2020-1289)	Nessus	SuSE Local Security Checks	2020/8/31	2024/2/22	high
140437	Oracle Linux 8 : librepo (ELSA-2020-3658)	Nessus	Oracle Linux Local Security Checks	2020/9/9	2024/11/1	high
147096	EulerOS Virtualization for ARM 64 3.0.6.0 : librepo (EulerOS-SA-2021-1569)	Nessus	Huawei Local Security Checks	2021/3/4	2024/1/16	high
147264	NewStart CGSL MAIN 6.02 : librepo Vulnerability (NS-SA-2021-0057)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/10	high
140460	RHEL 8：librepo (RHSA-2020:3658)	Nessus	Red Hat Local Security Checks	2020/9/9	2024/11/7	high
143047	CentOS 7：librepo (RHSA-2020:5012)	Nessus	CentOS Local Security Checks	2020/11/18	2024/10/9	high
140597	RHEL 8：librepo (RHSA-2020: 3756)	Nessus	Red Hat Local Security Checks	2020/9/15	2024/11/7	high
143047	CentOS 7 : librepo (RHSA-2020:5012)	Nessus	CentOS Local Security Checks	2020/11/18	2024/10/9	high
140460	RHEL 8 : librepo (RHSA-2020:3658)	Nessus	Red Hat Local Security Checks	2020/9/9	2024/11/7	high
143251	Photon OS 3.0: Librepo PHSA-2020-3.0-0164	Nessus	PhotonOS Local Security Checks	2020/11/24	2025/8/22	high
141518	Fedora 32 : 1:livecd-tools / createrepo_c / dnf / dnf-plugins-core / etc (2020-5d9f0ce2b3)	Nessus	Fedora Local Security Checks	2020/10/19	2024/2/15	high
143257	EulerOS 2.0 SP8 : librepo (EulerOS-SA-2020-2480)	Nessus	Huawei Local Security Checks	2020/11/25	2024/2/8	high
140597	RHEL 8 : librepo (RHSA-2020:3756)	Nessus	Red Hat Local Security Checks	2020/9/15	2024/11/7	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high