The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0715-1 advisory.

  - All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via     splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time     complexity. (CVE-2021-23343)

  - The npm package tar (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File     Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that     any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved     by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary     `stat` calls to determine whether a given path is a directory, paths are cached when directories are     created. This logic was insufficient when extracting tar files that contained both a directory and a     symlink with the same name as the directory. This order of operations resulted in the directory being     created and added to the `node-tar` directory cache. When a directory is present in the directory cache,     subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks     for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it     was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted     tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that     location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3,     4.4.15, 5.0.7 and 6.1.2. (CVE-2021-32803)

  - The npm package tar (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File     Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent     extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths`     flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file     paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This     logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`.
    `node-tar` would only strip a single path root from such paths. When given an absolute file path with     repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute     path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2,     4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom     `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute     paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in     later versions of tar. (CVE-2021-32804)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3228 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3228-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     December 07, 2022                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : node-json-schema     Version        : 0.2.3-1+deb10u1     CVE ID         : CVE-2021-3918     Debian Bug     : 999765

    node-json-schema, JSON Schema validation and specifications, was     vulnerable to Improperly Controlled Modification of Object Prototype     Attributes.

    For Debian 10 buster, this problem has been fixed in version     0.2.3-1+deb10u1.

    We recommend that you upgrade your node-json-schema packages.

    For the detailed security status of node-json-schema please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-json-schema

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2575-1 advisory.

  - All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
    (CVE-2020-7753)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues()     method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)

  - follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor     (CVE-2022-0155)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch     prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified     Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor     to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10     contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.
    (CVE-2022-31097)

  - Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9,     8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana     instance via a configured OAuth IdP which provides a login name to take over the account of another user     in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via     OAuth, the malicious user's external user id is not already associated with an account in Grafana, the     malicious user's email address is not already associated with an account in Grafana, and the malicious     user knows the Grafana username of the target user. If these conditions are met, the malicious user can     set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log     in to Grafana. Due to the way that external and internal user accounts are linked together during login,     if the conditions above are all met then the malicious user will be able to log in to the target user's     Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a     workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users     authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.
    (CVE-2022-31107)

  - An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage     will take significant time to parse. (CVE-2022-32149)

  - Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13     are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to     take over the server admin account and gain full control of the grafana instance. All installations should     be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at:
    https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-     proxy/ (CVE-2022-35957)

  - Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9,     and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on     some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where     RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder     permissions to RBAC permissions do not account for the scenario where the only user permission in the     folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and     view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround     when the impacted folder/dashboard is known is to remove the additional permissions manually.
    (CVE-2022-36062)

  - Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana     introduced the ability to search for a JWT in the URL query parameter auth_token and use it as the     authentication token. By enabling the url_login configuration option (disabled by default), a JWT might     be sent to data sources. If an attacker has access to the data source, the leaked token could be used to     authenticate to Grafana. (CVE-2023-1387)

  - Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS     vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due     the value of the Function Description was not properly sanitized. An attacker needs to have control over     the Graphite data source in order to manipulate a function description and a Grafana admin needs to     configure the data source, later a Grafana user needs to select a tampered function and hover over the     description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix. (CVE-2023-1410)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
158624	openSUSE 15 Security Update : nodejs14 (openSUSE-SU-2022:0715-1)	Nessus	SuSE Local Security Checks	2022/3/5	2023/11/6	critical
168463	Debian dla-3228 : node-json-schema - security update	Nessus	Debian Local Security Checks	2022/12/7	2025/1/22	critical
177500	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2575-1)	Nessus	SuSE Local Security Checks	2023/6/22	2023/7/14	critical

检测

插件搜索

critical

critical

critical