The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:6160-1 advisory.

  - systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6551 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    The following packages have been upgraded to a later upstream version: redhat-release-virtualization-host     (4.5.2), redhat-virtualization-host (4.5.2), redhat-virtualization-host-productimg (4.5.2). (BZ#2070049,     BZ#2093195)

    Security Fix(es):

    * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information     leak (CVE-2022-1012)

    * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132)

    * systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526)

    * kernel: a use-after-free in cls_route filter implementation may lead to privilege escalation     (CVE-2022-2588)

    * rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154)

    * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root     (CVE-2022-32250)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.207 advisory.

  - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in     xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
    (CVE-2021-45960)

  - The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path,     leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in     /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an     incomplete fix for CVE-2016-10009. (CVE-2023-38408)

  - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the     attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content     to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing     filenames with two or more newlines where selected content and the target file names are embedded in     crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write     arbitrary files on the system. (CVE-2022-1271)

  - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5     allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR     and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

  - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as     demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this     is similar to CVE-2020-26116. (CVE-2020-26137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of systemd installed on the remote host is prior to 219-78. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1854 advisory.

    It was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT     variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment     variable which allows for commands to be checked against polkit policies using the allow_active element     rather than allow_any. (CVE-2019-3842)

    An exploitable denial of service vulnerability exists in systemd which does not fully implement RFC3203,     as it does not support authentication of FORCERENEW packets. A specially crafted DHCP FORCERENEW packet     can cause a system, running the DHCP client, to be vulnerable to a DHCP ACK spoofing attack. An attacker     can forge a pair of FORCERENEW and DCHPACK packets to reconfigure the system with arbitrary network     settings. (CVE-2020-13529)

    A flaw was found in systemd, where it mishandles numerical usernames beginning with decimal digits, or     0x followed by hexadecimal digits. When the usernames are used by systemd, for example in service units,     an unexpected user may be used instead. In some particular configurations, this flaw allows local     attackers to elevate their privileges. (CVE-2020-13776)

    A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function     and dns_stream_complete() function in resolved-dns-stream.c not incrementing the reference counting for     theDnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object,     causing the use-after-free when the reference is still used later. (CVE-2022-2526)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6160 advisory.

    The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and     LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for     starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups.
    In addition, it supports snapshotting and restoring of the system state, maintains mount and automount     points, and implements an elaborate transactional dependency-based service control logic. It can also work     as a drop-in replacement for sysvinit.

    Security Fix(es):

    * systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5583-1 advisory.

    It was discovered that systemd incorrectly handled certain DNS requests,

    which leads to user-after-free vulnerability. An attacker could possibly use

    this issue to cause a crash or execute arbitrary code. (CVE-2022-2526)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2022:6206 advisory.

  - systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5583-2 advisory.

    USN-5583-1 fixed vulnerabilities in systemd. Unfortunately this caused a

    regression by introducing networking problems for some users. This update fixes the problem.

    We apologize for the inconvenience.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function     and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for     the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream     object, causing the use-after-free when the reference is still used later. (CVE-2022-2526)

  - An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An     attacker could supply specific values for time and accuracy that leads to buffer overrun in     format_timespan(), leading to a Denial of Service. (CVE-2022-3821)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
164480	Scientific Linux Security Update : systemd on SL7.x i686/x86_64 (2022:6160)	Nessus	Scientific Linux Local Security Checks	2022/8/29	2022/12/6	critical
165429	RHEL 8 : Red Hat Virtualization (RHSA-2022:6551)	Nessus	Red Hat Local Security Checks	2022/9/24	2024/11/7	critical
180469	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.207)	Nessus	Misc.	2023/9/4	2026/1/21	low
165993	Amazon Linux 2 : systemd (ALAS-2022-1854)	Nessus	Amazon Linux Local Security Checks	2022/10/10	2024/12/11	critical
164407	RHEL 7 : systemd (RHSA-2022:6160)	Nessus	Red Hat Local Security Checks	2022/8/25	2024/11/7	critical
164486	Ubuntu 18.04 LTS : systemd vulnerability (USN-5583-1)	Nessus	Ubuntu Local Security Checks	2022/8/29	2024/8/28	critical
164816	AlmaLinux 8 : systemd (ALSA-2022:6206)	Nessus	Alma Linux Local Security Checks	2022/9/7	2022/12/5	critical
165062	Ubuntu 18.04 LTS : systemd regression (USN-5583-2)	Nessus	Ubuntu Local Security Checks	2022/9/14	2024/10/29	critical
171180	EulerOS 2.0 SP8 : systemd (EulerOS-SA-2023-1339)	Nessus	Huawei Local Security Checks	2023/2/8	2023/9/5	critical

检测

插件搜索

critical

critical

low

critical

critical

critical

critical

critical

critical