According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3151 advisory.

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sssd packages installed that are affected by a vulnerability:

  - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-     fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a     specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3621)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3235 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host.
    These packages include redhat-release-virtualization-host, ovirt-node, and     rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a     special build of Red Hat Enterprise Linux with only the packages required to     host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe ()

    * kernel: Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks (CVE-2021-22543)

    * kernel: race condition in net/can/bcm.c leads to local privilege escalation (CVE-2021-3609)

    * sssd: shell command injection in sssctl (CVE-2021-3621)

    * kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Rebase package(s) to version: 1.2.23

    Highlights, important fixes, or notable enhancements:

    * imgbase should not copy the selinux binary policy file (BZ# 1979624) (BZ#1989397)

    * RHV-H has been rebased on Red Hat Enterprise Linux 8.4 Batch #2. (BZ#1975177)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3477 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host.
    These packages include redhat-release-virtualization-host. Red Hat     Virtualization Hosts (RHVH) are installed using a special build of Red Hat     Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user     interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * sssd: shell command injection in sssctl (CVE-2021-3621)

    * kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715)

    * kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555)

    * libX11: missing request length checks (CVE-2021-31535)

    * kernel: race condition for removal of the HCI controller (CVE-2021-32399)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
170810	EulerOS Virtualization 3.0.2.2 : sssd (EulerOS-SA-2023-1295)	Nessus	Huawei Local Security Checks	2023/1/30	2023/1/30	high
157743	Rocky Linux 8 : sssd (RLSA-2021:3151)	Nessus	Rocky Linux Local Security Checks	2022/2/9	2023/11/7	high
160759	NewStart CGSL CORE 5.04 / MAIN 5.04 : sssd Vulnerability (NS-SA-2022-0013)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2022/5/9	high
152688	RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.7] (Important) (RHSA-2021:3235)	Nessus	Red Hat Local Security Checks	2021/8/19	2025/10/6	high
165135	RHEL 7 : RHV-H security update (redhat-virtualization-host) 4.3.18 (Important) (RHSA-2021:3477)	Nessus	Red Hat Local Security Checks	2022/9/15	2025/10/6	critical

检测

插件搜索

high

high

high

high

critical