The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory.

    Security issues fixed:

    - CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1       (bsc#1270192).
    - CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-     openssl       crate (bsc#1270616).
    - CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
    - CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl     crate       (bsc#1270742).
    - CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak     adjacent       memory in rust-openssl crate (bsc#1270863).
    - CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate       (bsc#1270471).
    - CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl     crate       (bsc#1270922).
    - CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in     rust-       openssl crate (bsc#1270995).

    Non security issues fixed:

    - sdbootutil-update-predictions.service fails with  Failed to start Update TPM predictions (bsc#1273384).
    - systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
    - Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

    Changes for sdbootutil:

    - Update to version 1+git20260908.c641fc2:
     * Update the shim when required
     * Warn when recovery PIN is different from recovery key
     * Improves extra boot entries support
     * Better report when the default snapshot diverges
     * Explain how to do re-enrolling if recovery PIN fails
     * Explain why update-prediction fails and how to solve it
     * Hide comparison output
     * Add bootctl default entry in the prediction
    - Update to version 1+git20260903.f91f636:
     * Include FIDO2 unlocked devices for ordering (bsc#1234010)
     * Test in parallel for speed up
     * Add --repair parameter to cleanup
     * Fix shellcheck complain
     * Report entries with missing files
     * Avoid duplicate entries in non-snapper systems
     * Add initial tests for sdbootutil
     * Report the error if bootctl clean fails
    - Update to version 1+git20260901.41540d5:
     * No warn if a component is not in the event log
     * Add status command
     * Select the new sdbootutil if available
     * Skip blank lines in measure-pcr-generator.sh
     * Do not change crypttab for unrelated entries
     * Report the bad PCR when update-prediction fail
     * Do not write the recovery PIN in the journal
     * Improves non snapshot system support
     * Update help message for --measure-pcr
     * Report when PCR 7 is dropped because shim update
     * Add --strict parameter for --pcr policy
     * Report dropped PCRs via a warn
     * Adjust the limits for PolicyOR issues
     * Avoid update predictions if the service is up
     * Keep the exit status of sdbootutil call
    - Update to version 1+git20260827.786f9a8:
     * Do not accept empty passwords
     * jeos-firstboot-enroll: report errors also in the journal
     * Restore old crypttab via the exit trap
     * Update CLAUDE data
     * Detect half created openssl keys
     * check_enrolled report when something was written in the LUKS2 header
     * Improve a bit the disk-encryption-tool keyslot detection
     * Avoid leak of env var secrets
     * Wipe the d-e-t key in the enroll service and jeos module
     * Remove the correct keyslot left by d-e-t
     * Differentiate tpm2 and tpm2+pin for unattended unlock
     * Use is_same_device in detect_tracked_device and drop greps
     * Refactor check to avoid shellcheck complain
     * Parse the entry file in a sigle place
     * Validate the entry with the new kernel name
     * Refactor enrollment interface and deprecate the old one
     * New kernels will have different hash
     * Warn If no crypttab entry found
     * Extend is_same_device
     * jeos-firstboot-enroll: validate the passwords
     * sdbootutil-enroll: report when no encryption method is provided
     * Write recovery pin after enrollment in jeos module
     * Write recovery pin after enrollment
     * Improve error detection in sdbootutil-enroll
     * Increase keyctl timeout
     * Merge require_unlock and set_unlock_method
     * Be sure that the terminal check works with snapper
     * Renerate initrd when new measure-pcr keys are created
     * Separate ask-* parameters
     * Fix reading credential and keyctl password
     * Get the device password for each enrolling mechanism
     * Drop elements from crypttab if the enrollment fails
     * Validate the enrollment for each method
     * Add warning when enrolling FIDO2 token
    - Update to version 1+git20260825.c7a5a97:
     * Refactor free space calculation
     * Do not use /proc/cmdline in half configured systems
     * Warning when the recovery PIN is not validated
     * Show default and booted snapshots with marks
     * Improve detection of snapshot systems
     * Fix when searching for a boot entry
     * Fix boot order and boot order entry
     * Create the entries directory in the ESP
     * Fix get_final_pcr parser
     * Keep btrfs error and show it when fails
     * Fix set -e early exit instances
     * Fix measure-pcr-validator when there is no terminal
     * Don't include measure-pcr-validator in initrd if TPM2 is not used
     * Update predictions even if crypttab did not change
     * Improve PCR 15 signing
     * Detect NAME=VALUE passed as parameters and complain
     * When asking a password, require a terminal
     * Filter some warnings from pcrlock
     * Detect directories that are not part of the snapshot
     * Write bash completion errors to /dev/null
     * Detect when t-u apply is done and avoid data corruption
     * Detect pcr-oracle leftovers
     * Show in title that it's the initial version for transactional systems
     * Manually generate PCR7 measurements
     * Regenerate pcrlock.json when it is missing
    - Update to version 1+git20260813.357956d:
     * Do not update the predictions without a TPM2 enrollment (bsc#1273384)
    - Update to version 1+git20260812.305d9f2:
     * Do not supplement if GRUB2-EFI is installed (bsc#1272525)
    - Update to version 1+git20260714.d9bb736:
     * tukit: do not fail if service is not found
    - Update to version 1+git20260713.d869cf8:
     * Ignore errors in the snapper plugin
    - Update to version 1+git20260709.7dfd021:
     * Remove the background process in the plugin
     * Fix missing initrd condition (bsc#1270420)
     * After reboot the shutdown service is not active
     * Disable the shutdown service after main service
     * Update uhmac dependencies (rust-openssl)      bsc#1270192, CVE-2026-41676      bsc#1270995, CVE-2026-45784      bsc#1270922, CVE-2026-44662      bsc#1270863, CVE-2026-41898      bsc#1270742, CVE-2026-41681      bsc#1270670, CVE-2026-41678      bsc#1270616, CVE-2026-41677      bsc#1270471, CVE-2026-42327
     * Add systemd transient service to update predictions
     * Install extra EFI binaries
    - Update to version 1+git20260625.7fa275e:
     * Remove duplicate code and parametrize timers
     * Check boot entry before kernel installation
     * Re-install an old kernel if initrd cannot be reused
     * Skip installation for already installed kernel
     * Add configurable devicetree entry support
     * Set explicit kernel and initrd paths
     * Remove the full tmpdir in the service
     * Fix /run/sdbootutil permissions
     * Execute predictions in the background
     * Add --disable-predictions parameter
     * Fix comparison operator
     * Add print-loader-path command

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1870 advisory.

    rust-openssl provides OpenSSL bindings for the Rust programming language.  From 0.9.27 to before 0.10.78,     Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out length to     EVP_PKEY_derive, relying on OpenSSL to honor it. On OpenSSL 1.1.x, X25519, X448, DH and HKDF-extract     ignore the incoming *keylen, unconditionally writing the full shared secret (32/56/prime-size bytes). A     caller passing a short slice gets a heap/stack overflow from safe code. OpenSSL 3.x providers do check, so     this only impacts older OpenSSL. This vulnerability is fixed in 0.10.78. (CVE-2026-41676)

    rust-openssl provides OpenSSL bindings for the Rust programming language.  From  to before 0.10.78,     aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but this     condition is reversed. The intended invariant is out.len() >= in_.len() - 8, ensuring the output buffer is     large enough. Because of the inverted check, the function only accepts buffers at or below the minimum     required size and rejects larger ones. If a smaller buffer is provided the function will write past the     end of out by in_.len() - 8 - out.len() bytes, causing an out-of-bounds write from a safe public function.
    This vulnerability is fixed in 0.10.78. (CVE-2026-41678)

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79,     X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as OpensslString,     whose Deref<Target = str> wraps the raw bytes with str::from_utf8_unchecked. OpenSSL does not enforce that     the underlying IA5String is ASCII, so a certificate with non-UTF-8 bytes in its OCSP accessLocation causes     safe Rust code to construct a &str that violates the UTF-8 invariant -- resulting in undefined behavior.
    This vulnerability is fixed in 0.10.79. (CVE-2026-42327)

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79,     CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorrectly sized     output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a     non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec,     producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This     only impacts users using AES key-wrap-with-padding ciphers. This vulnerability is fixed in 0.10.79.
    (CVE-2026-44662)

    rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80,     CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when     used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input,     OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable     heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
    (CVE-2026-45784)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21274-1 advisory.

    Update to version 0.2.9+49.

    Security issues fixed:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270174).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270614).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270699).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270792).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270842).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270523).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270903).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270999).

    Other updates and bugfixes:

    - Update openssl to 0.10.81.
    - Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
    - Build with Clang <= 21 (bsc#1260596).
    - Version 0.2.9+49:
      * build(deps): bump uuid from 1.23.3 to 1.23.4
      * build(deps): bump syn from 2.0.117 to 2.0.118
      * build(deps): bump openssl from 0.10.80 to 0.10.81
      * build(deps): bump rand from 0.9.4 to 0.10.1
      * Added new regression test into packit-ci.yaml
      * build(deps): bump actions/checkout from 6 to 7
      * build(deps): bump uuid from 1.23.1 to 1.23.3
      * build(deps): bump log from 0.4.29 to 0.4.32
      * build(deps): bump http from 1.4.0 to 1.4.2
      * build(deps): bump codecov/codecov-action from 6 to 7
      * build(deps): bump retry-policies from 0.5.1 to 0.5.2
      * fix: Remove unused base64::Engine import in context_info tests
      * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
      * build(deps): bump serde_json from 1.0.149 to 1.0.150
      * build(deps): bump openssl from 0.10.79 to 0.10.80
      * agent: Hash agent ID before TPM2_Certify qualifying data
      * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
      * build(deps): bump openssl from 0.10.78 to 0.10.79
      * build(deps): bump once_cell from 1.21.3 to 1.21.4
      * build(deps): bump tempfile from 3.23.0 to 3.27.0
      * push-model: cache UEFI event log bytes at startup
      * build(deps): bump quote from 1.0.40 to 1.0.45
      * build(deps): bump chrono from 0.4.42 to 0.4.44
      * build(deps): bump openssl from 0.10.73 to 0.10.78
      * build(deps): bump serde_json from 1.0.143 to 1.0.149
      * build(deps): bump syn from 2.0.106 to 2.0.117
      * build(deps): bump libc from 0.2.175 to 0.2.184
      * build(deps): bump rand from 0.9.2 to 0.9.4
    - Version 0.2.9+21:
      * tests: use Express-style named params in Mockoon endpoints
      * build(deps): bump pest_derive from 2.8.1 to 2.8.6
      * build(deps): bump trybuild from 1.0.110 to 1.0.115
      * build(deps): bump log from 0.4.28 to 0.4.29
      * build(deps): bump uuid from 1.19.0 to 1.20.0
      * build(deps): bump codecov/codecov-action from 5 to 6
      * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
      * build(deps): bump cfg-if from 1.0.3 to 1.0.4
      * build(deps): bump tokio from 1.49.0 to 1.50.0
      * build(deps): bump actix-web from 4.12.1 to 4.13.0
      * build(deps): bump anyhow from 1.0.99 to 1.0.102
      * build(deps): bump clap from 4.5.57 to 4.5.60
      * build(deps): bump tracing from 0.1.36 to 0.1.44

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21294-1 advisory.

    This update for python-cryptography fixes the following issues

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3576-1 advisory.

    Security fixes:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270182).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270613).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270707).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270794).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270830).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270520).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270939).
    - CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in     rust-openssl       crate (bsc#1270985).
    - GHSA-4f5j-9xgm-8pvr: arbitrary HTTP or HTTPS URL classified as an Office document based on an attacker-     controlled file       query parameters and forwarded to an Electron application (bsc#1273910).
    - GHSA-6cq7-jcwm-cpmr: directory-provided RFC2307 user identifiers accepted without exclusion of systemd's     dynamic-user       range allows for daemon impersonation and command execution through the task helper (bsc#1273911).
    - GHSA-6gp8-pp9v-gx45: daemon acts on Hello PIN enrollment requests whose identity claims it never     cryptographically       verifies (bsc#1273912).

    Other fixes:

    - Version 2.3.14+git0.e23b4c54:

      * fix(nss): avoid locked shadow entries

    - Version 2.3.14:

      * fix(deps): update libhimmelblau lockfile
      * fix(pam): make account denials terminal
      * debian: make the pam_allow_groups denial terminal in the account phase

    - Version 2.3.13:

      * Update cargo vet audits for backport

    - Version 2.3.12+git0.9d56c6f1:

      * Fix cargo-fuzz install in fuzz CI
      * cargo vet
      * Update ldap3_proto to 0.7.1

    - Version 2.3.12:

      * Update cargo vet audits for backport
      * Remove invalid himmelblau.conf example info
      * Fix SSHd configuration load order on Fedora/RHEL systems
      * himmelblau-init-hsm-pin: don't bind the hsm-pin to PCR7
      * qr-greeter: support GNOME Shell 50
      * Update libhimmelblau to latest version
      * deps(rust): bump tonic in the all-cargo-updates group across 1 directory
      * cargo audit

    - Version 2.3.11+git0.c802b25f:

      * Update cargo vet audits for backport
      * Reject auth when token spn local part differs from requested account_id
      * Update libhimmelblau to latest version
      * deps(rust): bump the all-cargo-updates group with 19 updates
      * cargo vet

    - Version 2.3.10:

      * nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau
      * selinux: allow unconfined_service_t to search himmelblaud_t dirs
      * idprovider: release providers lock before async alias lookup

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3791-1 advisory.

    This update for snpguest fixes the following issues

    - Update openssl to v0.10.81
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270541).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270642).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl       crate (bsc#1270720).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270799).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270527).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270873).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in       rust-openssl crate (bsc#1270947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21573-1 advisory.

    Update to version 2.3.14+git0.e23b4c54.

    Security issues fixed:

    - CVE-2026-45784: incorrect sizing of output buffers in `CipherCtxRef::cipher_update_inplace` when used     with       AES key-wrap-with-padding ciphers can lead to attacker-controlled heap corruption (bsc#1270985).
    - Arbitrary HTTP or HTTPS URLs classified as Office documents based on an attacker-controlled file query     parameters are       forwarded to Electron applications and allow for code execution through Electron (bsc#1273910).
    - Directory-provided RFC2307 user identifiers accepted without exclusion of systemd's dynamic-user range     allows for       daemon impersonation and command execution through the task helper (bsc#1273911).
    - Daemon acts on Hello PIN enrollment requests whose identity claims it never cryptographically verifies     and allows for       local authentication bypass (bsc#1273912).

    Other updates and bugfixes:

    - Version 2.3.14+git0.e23b4c54:
      * fix(`nss`): avoid locked shadow entries
      * fix(`deps`): update libhimmelblau lockfile
      * fix(`pam`): make account denials terminal
      * `debian`: make the `pam_allow_groups` denial terminal in the account phase
    - Version 2.3.13:
      * Update `cargo vet` audits for backport
      * Fix `cargo-fuzz` install in fuzz CI
      * `cargo vet`
      * Update `ldap3_proto` to 0.7.1
      * Update `openssl`
    - Version 2.3.12:
      * Remove invalid `himmelblau.conf` example info
      * Fix SSHd configuration load order on Fedora/RHEL systems
      * `himmelblau-init-hsm-pin`: don't bind the `hsm-pin` to PCR7
      * `qr-greeter`: support GNOME Shell 50
      * Update `libhimmelblau` to latest version
      * deps(`rust`): bump `tonic` in the `all-cargo-updates` group across 1 directory
      * `cargo audit`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21579-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270541).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270642).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270720).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270799).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270527).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270873).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers       (bsc#1270947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21638-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270541).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270642).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270720).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270799).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270527).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270873).
    - CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in     `CipherCtxRef::cipher_update_inplace`       when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23983-1 advisory.

    - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded     (bsc#1243868).
    - CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes       (bsc#1274146).
    - CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack     exhaustion       (bsc#1257923).
    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270206).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270559).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270736).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270869).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270512).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270938).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270948).
    - CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
    - CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash     the server by       sending a crafted percent-encoded URL (bsc#1273884).
    - CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
    - CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
    - CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
    - CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
    - CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
    - CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

    Changes for sccache:

    Update to version 0.18.0~2:
     * Add experimental concurrent cache support
     * chore: Remove dependency status badge (#2856)
     * Don't hand the jobserver to children that can't use it
     * dist: refuse to trim rlibs from crates that also emit a cdylib
     * fix(cache): avoid duplicate multilevel reads
     * Strip basedirs from the compiler arguments too
     * tests/integration: replace MinIO with Silo
     * ci: dump sccache logs on integration failures
     * multilevel: a chain with any writable level is writable
     * Fix parsing of #line directives
     * Release 0.18.0
     * daemonize: use an allow-list approach to inherited FDs
     * gcc, clang: make the assembler part of the cache key
     * support cl.exe /openmp:llvm
     * support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
     * support MSVC /feature argument
     * msvc: support lots of flags (#2832)
     * Update shlex dependency to version 2 (#2836)
     * gcc: mark flags as TooHard if need to cache something else (#2833)
     * clang: support more CLI options (#2834)
     * msvc: support arm64EC and fastfail flags (#2830)
     * chore: fix typo in comment (#2829)
     * nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
     * cache: allow skipping capability checks (#2822)
     * Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
     * nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
     * Add an agent (#2812)
     * Add support for d20bforceinline. (#2807)
     * feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
     * Bump MSRV to 1.91.0 (#2793)
     * Fix `nvcc` dryrun parsing for CUDA 13.3 (#2722)
     * test: Fixed hardcoded binary path in test
     * Release 0.17.0
     * tests: pin libc in the dist test crate
     * doc: clarify server-side outputs and drop 'recommended mode' claim
     * doc: document SCCACHE_CLIENT_SIDE env var
     * doc: document client-side and direct modes in Architecture.md
     * Fix description of Unix socket-based Redis connection
     * server: remove redundant async block in start_compile_task
     * server: simplify bind() request loops with ? instead of manual match arms
     * Add support for arg files in Rust (#2782)
     * feat: support S3 SSE-KMS with AWS-managed and customer-managed keys (#2770)
     * abort compile tasks and associated subprocesses when a client disconnects
     * treat -ivfsoverlay as a preprocessor-only argument
     * gcc: refine response-file tokenizer visibility and whitespace handling
     * integration: convert cmake 4.x modules XFAIL test to a passing test
     * gcc/clang: cache and distribute builds using quoted @response files
     * fix: Fix ToolchainPackager cfg gate to build on ppc64le/s390x
     * fix: make gcc diagnostics color output work the same as for rustc
     * implement client-side mode
     * split handle_compile_response so that the compilation result can be handled separately
     * implement IpcStorage -- Storage backend over IPC
     * extend wire protocol with storage RPCs
     * implement AddAssign for ServerStats and related types
     * add Storage::get_path for direct file access
     * implement get_raw/put_raw on MultiLevelStorage
     * add client_side_mode config flag (SCCACHE_CLIENT_SIDE)
     * Extract new_client_runtime() helper to DRY up client runtime creation
     * Clarify single-threaded runtime rationale comment (grammar)
     * fix: use single-threaded tokio runtime in sccache dist-client
     * fix: use single-threaded tokio runtime in sccache client
     * fix: handle disabled cache backend features in multilevel chain
     * Fix ldd output parsing: remove .exists() check that failed on systems where the symlink source path     does not exist locally (e.g. aarch64)
     * Fix cfg guard for PanicToolchainPackager to also cover non-x86_64 Linux architectures (e.g. aarch64)
     * Release 0.16.0
     * fix: strip SCCACHE_BASEDIRS from escaped-backslash paths on Windows (#2736)
     * Ignore empty-set environment values (#2639)
     * feat: all backends support making them as read-only (#2705)
     * Enable RE on Linux-aarch64 (#2668)
     * Slightly improve logging (#2734)
     * chore: encode jwt key and cert digest with base64 in logs (#2712)
     * chore: make clippy happy (#2727)
     * feat: avoid sccache wrapper when resolving compiler (#2720)
     * Fall back to direct cache write if tempfile creation on the same fs fails (#2369)
     * remove too noisy bench
     * feat(nvcc): support argument: `--dependency-output` (#2708)
     * fix: add newline when printing dist-status to stdout
     * Revert Classify .s files as AssemblerToPreprocess so #include/#ifdef are hon...
     * Don't wait depfiles for gcc/clang preprocessed inputs
     * Classify .s files as AssemblerToPreprocess so #include/#ifdef are honored
     * prepare release 0.15.0
     * Add cargo-binstall metadata for prebuilt binary installation
     * Fix coverage
     * fix: handle directories in dep-info source file hashing
     * docs(Rust.md): Add caveats from README
     * Add retry for dists docker image build
     * ci: set crt-static for riscv64 musl targets
     * feat: Add loongarch64 support
     * feat: Implement multi-tier caching with fallback and backfilling (#2581)
     * msvc: add support for Y-, YI, Zf flags
     * Group tests logging in CI
     * Add failing test for cmake-modules + cmake 4 version
     * Unfold ninja output in the test
     * Add a comment for maintaining integration tests
     * Move cmake-modules to integration tests
     * fix: exclude CARGO_ENCODED_RUSTFLAGS from env var hash (#2651)
     * chore(deps): update rust crate quinn-proto to v0.11.14
     * Fix sync GCS initialization
     * clippy: fix from_iter_instead_of_collect lint
     * fix: add Win32_Security feature to windows-sys dependency
     * build(deps): bump actions/download-artifact from 5 to 8
     * msvc: Append the default .pdb extension for the /Fd argument (#2621)
     * build(deps): bump actions/upload-artifact from 4 to 7
     * clippy: fix ref_option lint
     * ci: install grcov from prebuilt binary instead of cargo install
     * ci: use default toolchain to install grcov
     * ci: fix artifact_failure action when target dir does not exist
     * Remove benchmark normalize_win_path_utf8 (#2634)
     * Revert actions: add security audit workflow (#2594) (#2603)
     * partial c++20 module support (#2516)
     * clippy: fix ptr_as_ptr lint (#2611)
     * Add support for `d1nodatetime` & `await:strict` MSVC flags (#2617)
     * chore: switch thirtyfour_sync to thirtyfour (#2613)
     * clippy: fix manual_string_new lint (#2609)
     * clippy: fix unnecessary_semicolon lint (#2615)
     * clippy: fix explicit_into_iter_loop lint (#2616)
     * Avoid double-caching when ccache is installed in PATH (#2524)
     * clippy: fix cloned_instead_of_copied lint (#2605)
     * clippy: fix semicolon_if_nothing_returned lint (#2601)
     * Move PreprocessorCacheModeConfig to src/config.rs (#2604)
     * clippy: fix cloned_ref_to_slice_refs lint (#2602)
     * prepare the new release (#2600)
     * chore: update to toml 0.9 (#2599)
     * ci: Add coverage to integration tests, report it to Codecov.io (#2598)
     * Preparation for multilevel caching (#2597)
     * Add sccache-dist to flake.nix (#2579)
     * fixup! cargo fmt
     * fixup! rustfmt update
     * Extract FileObjectSource, CacheRead and CacheWrite to cache_io.rs
     * chore: update to nix 0.30
     * Add a helper method to get a correct backend name
     * Add cos feature gate to RemoteStorage
     * Simplify profiles for integration tests
     * clippy: fix implicit_clone lint (#2584)
     * actions: add security audit workflow (#2594)
     * docs: fix examples showing an xz-compress toolchain archive (#2587)
     * add benches for normalize_win_path strip_basedirs (#2588)
     * snap: update to core24 (#2570)
     * Add .rustfmt.toml for consistent style between `rustfmt` and `cargo fmt` (#2582)
     * add comments about auth token requirements (#2583)
     * chore: update to tokio-serde 0.9 (#2585)
     * ci: update freebsd to 15.0 (#2586)
     * distributed compilation support for asm & preprocessor outputs (#2557)
     * remove unused declaration (#2577)
     * Extract LazyDiskCache to a separated file (#2573)
     * Revert ci: show diff for toml_format (#2578)
     * Open Add SCCACHE_BASEDIRS support
     * ci: show diff for toml_format
     * chore: update to syslog 7
     * refactor: use matrix to reduce deduplication
     * fix: remove outdated `analysis` mode
     * Unbreak the s390x CI
     * ci: add macos-15-intel for prebuilt binary (#2555)
     * Integration tests (#2564)
     * Fix code review.
     * Impl for COS.
     * build(deps): bump opendal from 0.54.0 to 0.55.0
     * Move integration tests related stuff to subdir
     * Add Objective C Header for consistency
     * github action: fix the syntax - fails in the ci
     * sccache: prepare a new release
     * msvc: add msbuild support test
     * msvc: fix detect_showincludes_prefix with MSBuild
     * chore: update to gzp 2
     * build(deps): bump rsa from 0.9.6 to 0.9.10
     * codspeed: evaluate the memory benchmarking
     * remove too quick benchmarks
     * codspeed: move to simulation mode
     * Add realistic LRU cache access pattern benchmarks
     * Add compression characteristics benchmarks
     * Add build workflow simulation benchmarks
     * Add hash computation scenario benchmarks
     * Add batch cache entry benchmarks
     * Add cache artifact serialization benchmarks
     * Add /etc/ld.so.conf.d (if present) to compiler package
     * Assembly language support
     * fix(ci): pin serde_json to avoid zmij dependency
     * fix(ci): update zmij to fix s390x cross-compilation
     * Fix the run of the CI
     * run the benchmark in the ci
     * add benchmarks
     * dedup some code
     * Fix hash logging prefix
     * Add support for C preprocessor output
     * Add GCC pipe flag support
     * Improve save-temps gcc flags detection
     * MSVC: support forward slash as an output dir marker
     * add clang -fplugin=x regression test
     * canbeconcatenated is not accounted for in cmp
     * Reversed the order for looking `rustc`, added comment
     * Fix failing test_rlib_dep_reader_call for omit CARGO_HOME
     * fix: don't hash -parallel-jobs in Clang
     * docs: add installation steps for nix (#2523)
     * Support clang -fexperimental-assignment-tracking option (#2517)
     * add a nix flake (#2518)
     * Switch from the unmaintained daemonize crate to a maintained fork
     * chore: update to fs-err 3
     * Fix grammar of error message
     * Add server name info to stderr of remote jobs that ran, but failed
     * Remove another pointless destructuring
     * try to unbreak the ci
     * fix s390x build error
     * Add riscv64 support
     * fix: make aarch64-pc-windows-msvc also zip not tar.gz
     * Free up disk space in CI
     * MSVC on Windows only
     * Avoid 'No space left on device' errors in CI
     * GitHub dropped macos-13 runners
     * Proper function pointer to int cast
     * Avoid unused structs with dist-server disabled
     * no check cfg (#2507)
     * chore: switch once_cell crate to standard library (#2499)
     * Avoid unreliable assert_cmd::cargo::cargo_bin (#2489)
     * Fix build on macOS which doesn't have separate 32-bit dirent (#2492)
     * Fix Clippy warnings (#2490)
     * docs: bump MSRV to 1.85.0
     * msvc: handle '/FoRelease\' command-line argument
     * chore: drop tower dependency
     * chore: update to itertools 0.14
     * Use generator in CMAKE_MSVC_DEBUG_INFORMATION_FORMAT in README
     * Update directories to 6.0
     * Configuration.md - note logging env variables
     * chore: update to env_logger 0.11
     * deps: update blake3
     * prepare version 0.12.0
     * Update README with winget installation instructions
     * Skip CARGO_BUILD_JOBS in hash keys
     * build(deps): bump object from 0.36.7 to 0.37.1
     * Adjust tests after the rust update
     * Fix CI by adding cargo-features and updating coverage test to use modern -Cinstrument-coverage
     * Fix more clippy warnings
     * bump rustc in the ci too
     * Fix rustc 1.85 clippy warnings
     * bump to rustc 1.85 / edition 2024. mandatory for reqsign-core and run rustfmt with the version
     * fix clippy warnings
     * bump opendal to 0.54.0 & reqsign to 0.18.0
     * github action: when creating a release, make it as draft before (#2458)
     * prepare version 0.11.0 (#2457)
     * document SCCACHE_LOG_MILLIS (#2456)
     * logging: add a option to log milliseconds (Closes: #2454) (#2455)
     * feat: handle human size prefixes (#2405)
     * fix: in stats, Compare values AND keys to have a fully deterministic order (#2403)
     * Add --diagnostic-width to test for args ignored in hash
     * Ignore --diagnostic-width argument when computing hash
     * build(deps): bump actions/checkout from 4 to 5
     * build(deps): bump actions/download-artifact from 4 to 5
     * build(deps): bump actions/github-script from 7 to 8
     * Fix rustfmt
     * Fix comments on request
     * Fix clippy and rustfmt
     * Add test for count toolchain and use Determenistic for create tar archive
     * Fix mtime for reproducable toolchains
     * build(deps): bump chrono from 0.4.41 to 0.4.42
     * fix typo in an environment variable name
     * Fix documentation of azure configuration
     * Account for clippy-driver having extra prefix `rustc`
     * Fix build on Android (in Termux)
     * add support for s390x build
     * chore: replace retry crate with backon
     * Remove or replace Windows 2019 CI config
     * Needs another result unwrapping, it seems
     * Test: invoking symlink compiler to sccache invokes compiler
     * Add a comment about the problem with symlinks and current_exe()
     * Fix symbolic links to sccache on linux
     * Allow the CI configuration to disable clang++ for CUDA testing
     * Don't run tests using clang++ as CUDA compiler on Windows
     * add description to sccache-dist commands
     * Display a more user-friendly error when compiling on Linux/arm64
     * Clarify documentation about the hash (aka cache key)
     * Remove stray ')'
     * Remove documentation for removed limitations of preprocessor cache mode
     * Fix preprocessor cache mode when the compiler outputs a dep file
     * Partially revert Don't cache dep file (#2322)
     * Do not disable preprocessor cache mode if there is a dep file
     * Fix preprocessor cache mode with distributed builds (#2173)
     * Change self of generate_hash_key() from Box<Self> to &mut Self
     * Remove a few IMO pointless indirections / aliases
     * Remove workaround for #2173
     * Add test for bug #2173
     * chore: fix some minor issues in comments
     * build(deps): bump chrono from 0.4.40 to 0.4.41
     * build(deps): bump memchr from 2.7.1 to 2.7.5
     * check if we can use a specific version of rust to build grcov
     * Move comment that hadn't moved with its corresponding code
     * Rework direct mode documentation some more
     * Explain what preprocessor cache mode really does
     * Reword and correct the preprocessor cache mode documentation
     * chore: Remove not working mozilla code
     * Add support for -fsanitize-ignorelist
     * github storage: adjust the doc
     * github storage: ACTIONS_CACHE_URL => ACTIONS_RESULTS_URL
     * github storage: force version 2
     * Update codecov badge in README.md
     * Expand tests for dist-server
     * ci: Consolidate testing, coverage
     * ci: Update ubuntu-20.04 runners to ubuntu-22.04
     * chore: fix some comments
     * Give the --dist-status user some information about when a retry will happen.
     * Add support for Xclang flag '-mrelax-all'
     * Add support for Xclang flag '-mconstructor-aliases'
     * feat(utils): Add support for object >= 0.33
     * fix(tests): Remove executable bit from oauth.rs
     * build(deps): bump openssl from 0.10.64 to 0.10.72
     * build(deps): bump tokio from 1.41.0 to 1.43.1
     * Improve the CARGO_INCREMENTAL checking (#2364)
     * build(deps): bump chrono from 0.4.38 to 0.4.40
     * build(deps): bump clap from 4.4.18 to 4.5.13
     * build(deps): bump ring from 0.17.7 to 0.17.13
     * Bail on `nvcc -time` and `nvcc -fdevice-time-trace` flags
     * test hip with librandomize_readdir
     * Add randomize_readdir test utility
     * fix non-strict HIP device lib order
     * Create config during testing to collect coverage data
     * Extend coverage to distributed tests
     * chore: replace num_cpus crate with available_parallelism in standard library (#2342)
     * Update CI coverage: grcov/codecov

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
350771	openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)	Nessus	SuSE Local Security Checks	2026/9/26	2026/9/26	critical
362898	openSUSE 16 Security Update : rustup (openSUSE-SU-2026:22016-1)	Nessus	SuSE Local Security Checks	2026/10/4	2026/10/4	critical
322005	Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-1870)	Nessus	Amazon Linux Local Security Checks	2026/6/22	2026/10/15	critical
326416	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:21274-1)	Nessus	SuSE Local Security Checks	2026/7/12	2026/7/17	critical
326672	openSUSE 16 Security Update : python-cryptography (openSUSE-SU-2026:21294-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/7/17	critical
335091	SUSE SLES15: himmelblau / himmelblau-sshd-config / himmelblau-sso / etc (SUSE-SU-2026:3576-1)	Nessus	SuSE Local Security Checks	2026/8/13	2026/8/13	critical
340995	SUSE SLES15 Security Update : snpguest (SUSE-SU-2026:3791-1)	Nessus	SuSE Local Security Checks	2026/8/27	2026/8/29	critical
335485	openSUSE 16: himmelblau / himmelblau-qr-greeter / himmelblau-sshd-config / etc (openSUSE-SU-2026:21573-1)	Nessus	SuSE Local Security Checks	2026/8/15	2026/8/15	medium
335939	openSUSE 16 Security Update : snpguest (openSUSE-SU-2026:21579-1)	Nessus	SuSE Local Security Checks	2026/8/17	2026/8/17	critical
341173	openSUSE 16 Security Update : snphost (openSUSE-SU-2026:21638-1)	Nessus	SuSE Local Security Checks	2026/8/28	2026/8/28	critical
363083	SUSE SLES16 Security Update : sccache (SUSE-SU-2026:23983-1)	Nessus	SuSE Local Security Checks	2026/10/6	2026/10/6	critical
364123	SUSE SLES16 Security Update : rustup (SUSE-SU-2026:24014-1)	Nessus	SuSE Local Security Checks	2026/10/8	2026/10/8	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical