The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the python3 package has been released.

The 13.5.0.0 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2024 CPU advisory.

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (BSAFE Crypto-J)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover     of Oracle Enterprise Manager Base Platform. (CVE-2022-34381)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Agent Next Gen (Eclipse Jetty)). The supported version that is affected is 13.5.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise     Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in     unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise     Manager Base Platform. (CVE-2024-22201)

  - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager     (component: Job System (Netty)). The supported version that is affected is 13.5.0.0. Easily exploitable     vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise     Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to     cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform.
    (CVE-2024-29025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-297 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0109 advisory.

  - Line directives (//line) can be used to bypass the restrictions on //go:cgo_ directives, allowing     blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution     of arbitrary code when running go build. The line directive requires the absolute path of the file in     which the directive lives, which makes exploiting this issue significantly more complex. (CVE-2023-39323)

  - An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial     of service via crafted Set-Cookie header from malicious web server. (CVE-2022-40899)

  - The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value. (CVE-2023-29406)

  - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time     verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=     8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in     circulation with keys larger than this, and all three appear to be test certificates that are not actively     deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so     causing breakage here in the interests of increasing the default safety of users of crypto/tls seems     reasonable. (CVE-2023-29409)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. The arguments for a number of flags     which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled     through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. (CVE-2023-29404)

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - The go command may generate unexpected code at build time when using cgo. This may result in unexpected     behavior when running a go program which uses cgo. This may occur when running an untrusted module which     contains directories with newline characters in their names. Modules which are retrieved using the go     command, i.e. via go get, are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off,     may be affected). (CVE-2023-29402)

  - On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid     bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of     standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors     closed, opening any files can result in unexpected content being read or written with elevated privileges.
    Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents     of its registers. (CVE-2023-29403)

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes     e-Tugra root certificates. e-Tugra's root certificates were subject to an investigation prompted by     reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from e-Tugra     from the root store. (CVE-2023-37920)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7378 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7385 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7753 advisory.

    - python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7528 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

    * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
227117	Linux Distros Unpatched Vulnerability : CVE-2023-37920	Nessus	Misc.	2025/3/5	2026/7/27	critical
332288	Photon OS 5.0: Python3 PHSA-2023-5.0-91-0179	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	medium
209256	Oracle Enterprise Manager Cloud Control (October 2024 CPU)	Nessus	Misc.	2024/10/17	2026/2/24	critical
180117	Amazon Linux 2023 : ca-certificates (ALAS2023-2023-297)	Nessus	Amazon Linux Local Security Checks	2023/8/24	2024/12/11	critical
194920	Splunk Enterprise 9.0.0 < 9.0.8, 9.1.0 < 9.1.3 (SVD-2024-0109)	Nessus	CGI abuses	2024/5/2	2024/5/29	critical
186044	RHEL 9 : fence-agents (RHSA-2023:7378)	Nessus	Red Hat Local Security Checks	2023/11/21	2024/11/7	critical
186061	RHEL 9 : fence-agents (RHSA-2023:7385)	Nessus	Red Hat Local Security Checks	2023/11/21	2024/11/7	critical
187089	Oracle Linux 9 : fence-agents (ELSA-2023-7753)	Nessus	Oracle Linux Local Security Checks	2023/12/19	2025/9/9	high
189667	RHEL 8 : fence-agents (RHSA-2023:7528)	Nessus	Red Hat Local Security Checks	2024/1/26	2024/11/7	critical

检测

插件搜索

critical

medium

critical

critical

critical

critical

critical

high

critical