The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21285-1 advisory.

    This update for python-maturin fixes the following issues

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22583-1 advisory.

    Update to version 0.2.9+49.

    Security issues fixed:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270174).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270614).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270699).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270792).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270842).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270523).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270903).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270999).

    Other updates and bugfixes:

    - Update openssl to 0.10.81.
    - Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
    - Build with Clang <= 21 (bsc#1260596).
    - Version 0.2.9+49:
      * build(deps): bump uuid from 1.23.3 to 1.23.4
      * build(deps): bump syn from 2.0.117 to 2.0.118
      * build(deps): bump openssl from 0.10.80 to 0.10.81
      * build(deps): bump rand from 0.9.4 to 0.10.1
      * Added new regression test into packit-ci.yaml
      * build(deps): bump actions/checkout from 6 to 7
      * build(deps): bump uuid from 1.23.1 to 1.23.3
      * build(deps): bump log from 0.4.29 to 0.4.32
      * build(deps): bump http from 1.4.0 to 1.4.2
      * build(deps): bump codecov/codecov-action from 6 to 7
      * build(deps): bump retry-policies from 0.5.1 to 0.5.2
      * fix: Remove unused base64::Engine import in context_info tests
      * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
      * build(deps): bump serde_json from 1.0.149 to 1.0.150
      * build(deps): bump openssl from 0.10.79 to 0.10.80
      * agent: Hash agent ID before TPM2_Certify qualifying data
      * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
      * build(deps): bump openssl from 0.10.78 to 0.10.79
      * build(deps): bump once_cell from 1.21.3 to 1.21.4
      * build(deps): bump tempfile from 3.23.0 to 3.27.0
      * push-model: cache UEFI event log bytes at startup
      * build(deps): bump quote from 1.0.40 to 1.0.45
      * build(deps): bump chrono from 0.4.42 to 0.4.44
      * build(deps): bump openssl from 0.10.73 to 0.10.78
      * build(deps): bump serde_json from 1.0.143 to 1.0.149
      * build(deps): bump syn from 2.0.106 to 2.0.117
      * build(deps): bump libc from 0.2.175 to 0.2.184
      * build(deps): bump rand from 0.9.2 to 0.9.4
    - Version 0.2.9+21:
      * tests: use Express-style named params in Mockoon endpoints
      * build(deps): bump pest_derive from 2.8.1 to 2.8.6
      * build(deps): bump trybuild from 1.0.110 to 1.0.115
      * build(deps): bump log from 0.4.28 to 0.4.29
      * build(deps): bump uuid from 1.19.0 to 1.20.0
      * build(deps): bump codecov/codecov-action from 5 to 6
      * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
      * build(deps): bump cfg-if from 1.0.3 to 1.0.4
      * build(deps): bump tokio from 1.49.0 to 1.50.0
      * build(deps): bump actix-web from 4.12.1 to 4.13.0
      * build(deps): bump anyhow from 1.0.99 to 1.0.102
      * build(deps): bump clap from 4.5.57 to 4.5.60
      * build(deps): bump tracing from 0.1.36 to 0.1.44

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3040-1 advisory.

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3152-1 advisory.

    This update for aws-nitro-enclaves-cli fixes the following issues

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270542).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270705).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270747).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270839).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270492).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270932).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffers (bsc#1270952).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2832-1 advisory.

    This update for rustup fixes the following issues

    Security issues:

    - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded     (bsc#1243862).
    - CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270186).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270619).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270795).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270870).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270521).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270874).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270989).
    - rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

    Non security issue:

    - devel:languages:rust/rustup: Missing symlink for rust-analyzer (bsc#1203257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory.

    Security issues fixed:

    - CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1       (bsc#1270192).
    - CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-     openssl       crate (bsc#1270616).
    - CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
    - CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl     crate       (bsc#1270742).
    - CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak     adjacent       memory in rust-openssl crate (bsc#1270863).
    - CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate       (bsc#1270471).
    - CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl     crate       (bsc#1270922).
    - CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in     rust-       openssl crate (bsc#1270995).

    Non security issues fixed:

    - sdbootutil-update-predictions.service fails with  Failed to start Update TPM predictions (bsc#1273384).
    - systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
    - Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

    Changes for sdbootutil:

    - Update to version 1+git20260908.c641fc2:
     * Update the shim when required
     * Warn when recovery PIN is different from recovery key
     * Improves extra boot entries support
     * Better report when the default snapshot diverges
     * Explain how to do re-enrolling if recovery PIN fails
     * Explain why update-prediction fails and how to solve it
     * Hide comparison output
     * Add bootctl default entry in the prediction
    - Update to version 1+git20260903.f91f636:
     * Include FIDO2 unlocked devices for ordering (bsc#1234010)
     * Test in parallel for speed up
     * Add --repair parameter to cleanup
     * Fix shellcheck complain
     * Report entries with missing files
     * Avoid duplicate entries in non-snapper systems
     * Add initial tests for sdbootutil
     * Report the error if bootctl clean fails
    - Update to version 1+git20260901.41540d5:
     * No warn if a component is not in the event log
     * Add status command
     * Select the new sdbootutil if available
     * Skip blank lines in measure-pcr-generator.sh
     * Do not change crypttab for unrelated entries
     * Report the bad PCR when update-prediction fail
     * Do not write the recovery PIN in the journal
     * Improves non snapshot system support
     * Update help message for --measure-pcr
     * Report when PCR 7 is dropped because shim update
     * Add --strict parameter for --pcr policy
     * Report dropped PCRs via a warn
     * Adjust the limits for PolicyOR issues
     * Avoid update predictions if the service is up
     * Keep the exit status of sdbootutil call
    - Update to version 1+git20260827.786f9a8:
     * Do not accept empty passwords
     * jeos-firstboot-enroll: report errors also in the journal
     * Restore old crypttab via the exit trap
     * Update CLAUDE data
     * Detect half created openssl keys
     * check_enrolled report when something was written in the LUKS2 header
     * Improve a bit the disk-encryption-tool keyslot detection
     * Avoid leak of env var secrets
     * Wipe the d-e-t key in the enroll service and jeos module
     * Remove the correct keyslot left by d-e-t
     * Differentiate tpm2 and tpm2+pin for unattended unlock
     * Use is_same_device in detect_tracked_device and drop greps
     * Refactor check to avoid shellcheck complain
     * Parse the entry file in a sigle place
     * Validate the entry with the new kernel name
     * Refactor enrollment interface and deprecate the old one
     * New kernels will have different hash
     * Warn If no crypttab entry found
     * Extend is_same_device
     * jeos-firstboot-enroll: validate the passwords
     * sdbootutil-enroll: report when no encryption method is provided
     * Write recovery pin after enrollment in jeos module
     * Write recovery pin after enrollment
     * Improve error detection in sdbootutil-enroll
     * Increase keyctl timeout
     * Merge require_unlock and set_unlock_method
     * Be sure that the terminal check works with snapper
     * Renerate initrd when new measure-pcr keys are created
     * Separate ask-* parameters
     * Fix reading credential and keyctl password
     * Get the device password for each enrolling mechanism
     * Drop elements from crypttab if the enrollment fails
     * Validate the enrollment for each method
     * Add warning when enrolling FIDO2 token
    - Update to version 1+git20260825.c7a5a97:
     * Refactor free space calculation
     * Do not use /proc/cmdline in half configured systems
     * Warning when the recovery PIN is not validated
     * Show default and booted snapshots with marks
     * Improve detection of snapshot systems
     * Fix when searching for a boot entry
     * Fix boot order and boot order entry
     * Create the entries directory in the ESP
     * Fix get_final_pcr parser
     * Keep btrfs error and show it when fails
     * Fix set -e early exit instances
     * Fix measure-pcr-validator when there is no terminal
     * Don't include measure-pcr-validator in initrd if TPM2 is not used
     * Update predictions even if crypttab did not change
     * Improve PCR 15 signing
     * Detect NAME=VALUE passed as parameters and complain
     * When asking a password, require a terminal
     * Filter some warnings from pcrlock
     * Detect directories that are not part of the snapshot
     * Write bash completion errors to /dev/null
     * Detect when t-u apply is done and avoid data corruption
     * Detect pcr-oracle leftovers
     * Show in title that it's the initial version for transactional systems
     * Manually generate PCR7 measurements
     * Regenerate pcrlock.json when it is missing
    - Update to version 1+git20260813.357956d:
     * Do not update the predictions without a TPM2 enrollment (bsc#1273384)
    - Update to version 1+git20260812.305d9f2:
     * Do not supplement if GRUB2-EFI is installed (bsc#1272525)
    - Update to version 1+git20260714.d9bb736:
     * tukit: do not fail if service is not found
    - Update to version 1+git20260713.d869cf8:
     * Ignore errors in the snapper plugin
    - Update to version 1+git20260709.7dfd021:
     * Remove the background process in the plugin
     * Fix missing initrd condition (bsc#1270420)
     * After reboot the shutdown service is not active
     * Disable the shutdown service after main service
     * Update uhmac dependencies (rust-openssl)      bsc#1270192, CVE-2026-41676      bsc#1270995, CVE-2026-45784      bsc#1270922, CVE-2026-44662      bsc#1270863, CVE-2026-41898      bsc#1270742, CVE-2026-41681      bsc#1270670, CVE-2026-41678      bsc#1270616, CVE-2026-41677      bsc#1270471, CVE-2026-42327
     * Add systemd transient service to update predictions
     * Install extra EFI binaries
    - Update to version 1+git20260625.7fa275e:
     * Remove duplicate code and parametrize timers
     * Check boot entry before kernel installation
     * Re-install an old kernel if initrd cannot be reused
     * Skip installation for already installed kernel
     * Add configurable devicetree entry support
     * Set explicit kernel and initrd paths
     * Remove the full tmpdir in the service
     * Fix /run/sdbootutil permissions
     * Execute predictions in the background
     * Add --disable-predictions parameter
     * Fix comparison operator
     * Add print-loader-path command

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21406-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270542).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270747).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270839).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270492).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270932).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270952).

    Changes for aws-nitro-enclaves-cli:

    - Update to version 1.4.5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3642-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270541).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270642).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270720).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270799).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270527).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270873).
    - CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in     `CipherCtxRef::cipher_update_inplace`       when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
326670	openSUSE 16 Security Update : python-maturin (openSUSE-SU-2026:21285-1)	Nessus	SuSE Local Security Checks	2026/7/14	2026/10/21	critical
326983	SUSE SLES16 Security Update : rust-keylime (SUSE-SU-2026:22583-1)	Nessus	SuSE Local Security Checks	2026/7/15	2026/10/21	critical
327313	SUSE SLES15 Security Update : python-cryptography (SUSE-SU-2026:3040-1)	Nessus	SuSE Local Security Checks	2026/7/16	2026/10/21	critical
328902	SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:3152-1)	Nessus	SuSE Local Security Checks	2026/7/22	2026/10/21	critical
326320	SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2832-1)	Nessus	SuSE Local Security Checks	2026/7/10	2026/10/21	critical
326333	SUSE SLES15 Security Update : rustup (SUSE-SU-2026:2831-1)	Nessus	SuSE Local Security Checks	2026/7/10	2026/10/21	critical
350771	openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)	Nessus	SuSE Local Security Checks	2026/9/26	2026/10/22	critical
362898	openSUSE 16 Security Update : rustup (openSUSE-SU-2026:22016-1)	Nessus	SuSE Local Security Checks	2026/10/4	2026/10/22	critical
329720	openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:21406-1)	Nessus	SuSE Local Security Checks	2026/7/25	2026/10/28	critical
337986	SUSE SLES15 Security Update : snphost (SUSE-SU-2026:3642-1)	Nessus	SuSE Local Security Checks	2026/8/19	2026/10/28	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical