The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9240 advisory.

    libtpms     [0.8.8-1.el7]
    - spec: Update spec file to version 0.8.8

    * Fri Sep 17 2021 Stefan Berger - 0.8.7-1
    - tpm2: Fixes for building and running with OpenSSL 3.0

    * Fri Sep 10 2021 Stefan Berger - 0.8.6-1
    - tpm2: Marshal event sequence objects' hash state

    * Wed Sep 01 2021 Stefan Berger - 0.8.5-1
    - tpm2: NVMarshal: Handle index orderly RAM without 0-sized terminating node
    - tpm2: Initialize a whole OBJECT before using it

    * Wed Jun 23 2021 Stefan Berger - 0.8.4-1
    - tpm2: Reset too large size indicators in TPM2B to avoid access beyond buffer

    * Tue Jun 01 2021 Stefan Berger - 0.8.3-1
    - tpm2: Work-around for Windows 2016 & 2019 bug related to ContextLoad

    swtpm     [0.3.4-5.el7]
    - swtpm: Check header size indicator against expected size (CID 375869) (Stefan       Berger)  [Orabug: 33876933]  {CVE-2022-23645}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has swtpm packages installed that are affected by a vulnerability:

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4729:01 advisory.

    * swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:1297-1 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7472 advisory.

  - QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)

  - libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897)

  - libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)

  - swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-8100 advisory.

    [0.7.0-3.20211109gitb79fd91]
    - Disable OpenSSL FIPS mode to avoid libtpms failures       Resolves: rhbz#2090219

    [0.7.0-2.20211109gitb79fd91]
    - Add fix for CVE-2022-23645.
      Resolves: rhbz#2056518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0267 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-23645:
      swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4435:01 advisory.

    * QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507)
      * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial     of service (CVE-2022-0897)
      * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211)
      * swtpm: Unchecked header size indicator against expected size     (CVE-2022-23645)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8100 advisory.

    SWTPM is a TPM emulator built on libtpms providing TPM functionality for QEMU VMs.

    Security Fix(es):

    * swtpm: Unchecked header size indicator against expected size (CVE-2022-23645)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:8100 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7472 advisory.

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.100173 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may     allow an authenticated client to cause a denial of service. (CVE-2023-1667)

  - A vulnerability was found in libssh, where the authentication check of the connecting client can be     bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen     if there is insufficient memory or the memory usage is limited. The problem is caused by the return value     `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call     `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the     cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
    (CVE-2023-2283)

  - A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange     differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. (CVE-2023-5981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
159123	Oracle Linux 7 : libtpms (ELSA-2022-9240)	Nessus	Oracle Linux Local Security Checks	2022/3/22	2024/10/22	medium
167468	NewStart CGSL MAIN 6.02 : swtpm Vulnerability (NS-SA-2022-0101)	Nessus	NewStart CGSL Local Security Checks	2022/11/15	2022/11/15	medium
230071	Linux Distros Unpatched Vulnerability : CVE-2022-23645	Nessus	Misc.	2025/3/5	2025/9/14	medium
292119	MiracleLinux 9 : swtpm-0.7.0-3.20211109gitb79fd91.el9 (AXSA:2023-4729:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/4/30	medium
160069	SUSE SLES15 Security Update : swtpm (SUSE-SU-2022:1297-1)	Nessus	SuSE Local Security Checks	2022/4/22	2023/7/13	medium
167183	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:7472)	Nessus	CentOS Local Security Checks	2022/11/9	2023/10/5	medium
168120	Oracle Linux 9 : swtpm (ELSA-2022-8100)	Nessus	Oracle Linux Local Security Checks	2022/11/22	2024/10/22	medium
276049	TencentOS Server 3: swtpm (TSSA-2022:0267)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/5	medium
292805	MiracleLinux 8 : virt:rhel and virt-devel:rhel (AXSA:2022-4435:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
167568	RHEL 9 : swtpm (RHSA-2022:8100)	Nessus	Red Hat Local Security Checks	2022/11/15	2025/3/15	medium
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
167955	AlmaLinux 9 : swtpm (ALSA-2022:8100)	Nessus	Alma Linux Local Security Checks	2022/11/19	2022/11/19	medium
184779	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2022:7472)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
206823	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.100173)	Nessus	Misc.	2024/9/9	2025/2/17	low

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

low