The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2167 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957)

    * grafana: using email as a username can block other users from signing in (CVE-2022-39229)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0097 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-39229:
      A flaw was found in the Grafana web application. When a user logs into the system, either the username     or email address can be used. However, the login system allows both a username and connected email to be     registered, which could allow an attacker to prevent a user which has an associated email address access.
      CVE-2022-27664:
      A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service     because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown.
      CVE-2022-41715:
      A flaw was found in the golang package, where programs that compile regular expressions from untrusted     sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is     linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a     relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is     limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than     that are rejected. Routine use of regular expressions is unaffected.
      CVE-2022-2880:
      A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query     parameters from the inbound request, including unparseable parameters rejected by net/http. This issue     could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value.
    After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound     request's form field is set after the reverse proxy. The director function returns, indicating that the     proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the     original query parameters unchanged.
      CVE-2022-1962:
      A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability.
      CVE-2022-1705:
      A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid.
      CVE-2022-32148:
      A flaw was found in net/http/httputil golang package. When httputil.ReverseProxy.ServeHTTP is called     with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy could set     the client IP incorrectly. This issue may affect confidentiality.
      CVE-2022-30631:
      A flaw was found in golang. Calling the Reader, Read method on an archive that contains a large number     of concatenated 0-length compressed files can cause a panic issue due to stack exhaustion.
      CVE-2022-30630:
      A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability.
      CVE-2022-30632:
      A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
      CVE-2022-30635:
      A flaw was found in golang. When calling Decoder, Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability.
      CVE-2022-28131:
      A flaw was found in golang encoding/xml. When calling Decoder, Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
      CVE-2022-30633:
      A flaw was found in golang. Calling Unmarshal on an XML document into a Go struct, which has a nested     field that uses the any field tag, can cause a panic due to stack exhaustion.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5548:03 advisory.

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
      * golang: net/[http:](http:) handle server errors after sending GOAWAY (CVE-2022-27664)
      * grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957)
      * grafana: using email as a username can block other users from signing in (CVE-2022-39229)
      * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2784 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * grafana: using email as a username can block other users from signing in (CVE-2022-39229)

    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6073:05 advisory.

    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
      * golang: net/[http:](http:) handle server errors after sending GOAWAY (CVE-2022-27664)
      * grafana: using email as a username can block other users from signing in (CVE-2022-39229)
      * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
175483	RHEL 9 : grafana (RHSA-2023:2167)	Nessus	Red Hat Local Security Checks	2023/5/13	2025/3/11	high
239019	TencentOS Server 3: grafana (TSSA-2023:0097)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
293148	MiracleLinux 9 : grafana-9.0.9-2.el9.ML.1 (AXSA:2023-5548:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
175872	RHEL 8 : grafana (RHSA-2023:2784)	Nessus	Red Hat Local Security Checks	2023/5/16	2025/3/11	high
291843	MiracleLinux 8 : grafana-7.5.15-4.el8.ML.1 (AXSA:2023-6073:05)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

high

medium

high

high

medium