According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-07 advisory.

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

  - Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input     provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of     megabytes. This results in a segmentation fault for the application using libpq. Versions before     PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected. (CVE-2025-12818)

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (libssh, postgresql) were found to contain vulnerabilities, and updated versions     have been made available by the providers. Out of caution and in line with best practice, Tenable has     opted to upgrade these components to address the potential impact of the issues. Security Center 6.8.0     updates libssh to version 1.11.1 and postgresql to version 16.11 to address the identified     vulnerabilities. (CVE-2023-6918, CVE-2025-12818)

  - An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to     escalate privileges via the 'owner' parameter. (CVE-2026-2697)

  - An improper access control vulnerability exists where an authenticated user could access areas outside     of their authorized scope. (CVE-2026-2698)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3233 advisory.

    - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol (BPP)
    - Fix CVE-2023-6918 Missing checks for return values for digests
    - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection       of malicious code through hostname
    - Fix NULL dereference during rekeying with algorithm guessing       GHSL-2023-032 / CVE-2023-1667
    - Fix possible authentication bypass       GHSL 2023-085 / CVE-2023-2283
    - Fix CVE-2021-3634: Fix possible heap-buffer overflow when       rekeying with different key exchange mechanism
    - Fix CVE-2021-3634: Fix possible heap-buffer overflow when       rekeying with different key exchange mechanism (#1978810)
    - Fix CVE-2020-16135 NULL pointer dereference in sftpserver.c if       ssh_buffer_new returns NULL (#1862646)
    - Add a test for CVE-2019-14889
    - Fixed CVE-2019-14889 (#1781782)
    - Fixed CVE-2020-1730 (#1802422)
    - Fix more regressions introduced by the fixes for CVE-2018-10933
    - Fix regressions introduced by the fixes for CVE-2018-10933
    - resolves: #1311259 - Fix CVE-2016-0739
    - resolves: #1311332 - Update to version 0.7.3
      * Fixed CVE-2016-0739
      * Fixed ssh-agent on big endian
      * Fixed some documentation issues
    - resolves: #1213775 - Security fix for CVE-2015-3146
    - resolves: #1218076 - Security fix for CVE-2015-3146
    - Security fix for CVE-2014-8132.
    - Fix CVE-2014-0017.
    - CVE-2013-0176 (#894407)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6592-1 advisory.

    It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A remote     attacker could possibly use this issue to inject malicious code into the command of the features mentioned     through the hostname parameter. (CVE-2023-6004)

    It was discovered that libssh incorrectly handled return codes when performing message digest operations.
    A remote attacker could possibly use this issue to cause libssh to crash, obtain sensitive information, or     execute arbitrary code. (CVE-2023-6918)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0733306be9 advisory.

    New upstream release fixing (CVE-2023-48795, CVE-2023-6004, CVE-2023-6918)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other     products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the     extension negotiation message), and a client and server may consequently end up with a connection for     which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because     the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and     mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of     ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and     (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API     before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,     AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,     Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,     SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH     through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang     XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd     through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and     LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,     Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server     before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the     mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh     crate before 0.40.2 for Rust. (CVE-2023-48795)

  - A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit     unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into     the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

  - A flaw was found in the libssh implements abstract layer for message digest (MD) operations implemented by     different supported crypto backends. The return values from these were not properly checked, which could     cause low-memory situations failures, NULL dereferences, crashes, or usage of the uninitialized memory as     an input for the KDF. In this case, non-matching keys will result in decryption/integrity failures,     terminating the connection. (CVE-2023-6918)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0539-1 advisory.

    Update to version 0.9.8 (jsc#PED-7719):

    * Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
    * Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
    * Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
    * Allow @ in usernames when parsing from URI composes

    Update to version 0.9.7

    * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm       guessing (bsc#1211188)
    * Fix CVE-2023-2283: a possible authorization bypass in       pki_verify_data_signature under low-memory conditions (bsc#1211190)
    * Fix several memory leaks in GSSAPI handling code

    Update to version 0.9.6 (bsc#1189608, CVE-2021-3634)

    * https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.9.6

    Update to version 0.9.5 (bsc#1174713, CVE-2020-16135):

    * CVE-2020-16135: Avoid null pointer dereference in sftpserver (T232)
    * Improve handling of library initialization (T222)
    * Fix parsing of subsecond times in SFTP (T219)
    * Make the documentation reproducible
    * Remove deprecated API usage in OpenSSL
    * Fix regression of ssh_channel_poll_timeout() returning SSH_AGAIN
    * Define version in one place (T226)
    * Prevent invalid free when using different C runtimes than OpenSSL (T229)
    * Compatibility improvements to testsuite

    Update to version 0.9.4:

    * https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
    * Fix possible Denial of Service attack when using AES-CTR-ciphers       CVE-2020-1730 (bsc#1168699)

    Update to version 0.9.3:

    * Fixed CVE-2019-14889 - SCP: Unsanitized location leads to command execution (bsc#1158095)
    * SSH-01-003 Client: Missing NULL check leads to crash in erroneous state
    * SSH-01-006 General: Various unchecked Null-derefs cause DOS
    * SSH-01-007 PKI Gcrypt: Potential UAF/double free with RSA pubkeys
    * SSH-01-010 SSH: Deprecated hash function in fingerprinting
    * SSH-01-013 Conf-Parsing: Recursive wildcards in hostnames lead to DOS
    * SSH-01-014 Conf-Parsing: Integer underflow leads to OOB array access
    * SSH-01-001 State Machine: Initial machine states should be set explicitly
    * SSH-01-002 Kex: Differently bound macros used to iterate same array
    * SSH-01-005 Code-Quality: Integer sign confusion during assignments
    * SSH-01-008 SCP: Protocol Injection via unescaped File Names
    * SSH-01-009 SSH: Update documentation which RFCs are implemented
    * SSH-01-012 PKI: Information leak via uninitialized stack buffer

    Update to version 0.9.2:

    * Fixed libssh-config.cmake
    * Fixed issues with rsa algorithm negotiation (T191)
    * Fixed detection of OpenSSL ed25519 support (T197)

    Update to version 0.9.1:

    * Added support for Ed25519 via OpenSSL
    * Added support for X25519 via OpenSSL
    * Added support for localuser in Match keyword
    * Fixed Match keyword to be case sensitive
    * Fixed compilation with LibreSSL
    * Fixed error report of channel open (T75)
    * Fixed sftp documentation (T137)
    * Fixed known_hosts parsing (T156)
    * Fixed build issue with MinGW (T157)
    * Fixed build with gcc 9 (T164)
    * Fixed deprecation issues (T165)
    * Fixed known_hosts directory creation (T166)

    Update to verion 0.9.0:

    * Added support for AES-GCM
    * Added improved rekeying support
    * Added performance improvements
    * Disabled blowfish support by default
    * Fixed several ssh config parsing issues
    * Added support for DH Group Exchange KEX
    * Added support for Encrypt-then-MAC mode
    * Added support for parsing server side configuration file
    * Added support for ECDSA/Ed25519 certificates
    * Added FIPS 140-2 compatibility
    * Improved known_hosts parsing
    * Improved documentation
    * Improved OpenSSL API usage for KEX, DH, and signatures

    - Add libssh client and server config files

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-9cee4b3ac0 advisory.

    This update, to the current upstream libssh2 release, addresses a couple of security issues:

     * CVE-2023-6918 (missing checks for return values for digests)
     * CVE-2023-48795 (prefix truncation attack on Binary Packet Protocol (BPP) - Terrapin)

    It also removes support for a number of legacy algorithms that were disabled by default or removed from     OpenSSH in the 2015-2018 time period. See the `RELEASE_NOTES` file for full details.

    In addition, there are a large number of bug fixes and enhancements, which again are described in the     `RELEASE_NOTES` file.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
299698	Tenable Security Center < 6.8.0 Multiple Vulnerabilities (TNS-2026-07)	Nessus	Misc.	2026/2/20	2026/4/24	high
198033	Oracle Linux 8 : libssh (ELSA-2024-3233)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2026/1/21	medium
189295	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : libssh vulnerabilities (USN-6592-1)	Nessus	Ubuntu Local Security Checks	2024/1/22	2024/8/27	medium
187188	Fedora 39 : libssh (2023-0733306be9)	Nessus	Fedora Local Security Checks	2023/12/21	2026/1/21	critical
190308	EulerOS 2.0 SP9 : libssh (EulerOS-SA-2024-1197)	Nessus	Huawei Local Security Checks	2024/2/8	2026/1/21	medium
190835	SUSE SLES12 Security Update : libssh (SUSE-SU-2024:0539-1)	Nessus	SuSE Local Security Checks	2024/2/21	2026/6/26	medium
192000	EulerOS 2.0 SP10 : libssh (EulerOS-SA-2024-1338)	Nessus	Huawei Local Security Checks	2024/3/12	2026/1/21	medium
232832	Fedora 41 : libssh2 (2025-9cee4b3ac0)	Nessus	Fedora Local Security Checks	2025/3/16	2026/1/21	critical
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium

检测

插件搜索

high

medium

medium

critical

medium

medium

medium

critical

medium