The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-2120 advisory.

    - do not perform PROMPT_SUBST evaluation on file.file/%K arguments (CVE-2021-45444)
    - improve printing of error messages introduced by the fix of CVE-2019-20044

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-034 advisory.

    A vulnerability was found in zsh in the parsecolorchar() function of prompt.c file. This flaw allows an     attacker to perform code execution if they control a command output inside the prompt, as stated by a %F%K     argument. This occurs because of recursive PROMPT_SUBST expansion. (CVE-2021-45444)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161282	Oracle Linux 8 : zsh (ELSA-2022-2120)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/10/23	high
212478	Amazon Linux 2022 : zsh, zsh-html (ALAS2022-2022-034)	Nessus	Amazon Linux Local Security Checks	2024/12/11	2024/12/11	high
161410	macOS 12.x < 12.4 Multiple Vulnerabilities (HT213257)	Nessus	MacOS X Local Security Checks	2022/5/20	2024/8/23	critical

检测

插件搜索

high

high

critical