The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3009 advisory.

  - golang: net: lookup functions may return invalid host names (CVE-2021-33195)

  - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

  - golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

  - golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2214-1 advisory.

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4156 advisory.

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:3555 advisory.

    Red Hat OpenShift Serverless Client kn 1.17.0 provides a CLI to interact with Red Hat OpenShift Serverless     1.17.0. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for     non-Linux platforms.

    Security Fix(es):

    * serverless: incomplete fix for CVE-2021-27918 / CVE-2021-31525 / CVE-2021-33196 (CVE-2021-3703)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic     (CVE-2021-34558)
    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)
    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)
    * golang: match/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very     large exponents (CVE-2021-33198)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2021-2800:06 advisory.

    * golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)
      * grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API     call (CVE-2021-27358)
      * golang: net: lookup functions may return invalid host names (CVE-2021-33195)
      * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)
      * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
312471	RHCOS 4 : OpenShift Container Platform 4.6.42 (RHSA-2021:3009)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
151204	SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2021:2214-1)	Nessus	SuSE Local Security Checks	2021/7/1	2023/7/13	high
184701	Rocky Linux 8 : go-toolset:rhel8 (RLSA-2021:4156)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
194274	RHEL 8 : Release of OpenShift Serverless Client kn 1.17.0 (Moderate) (RHSA-2021:3555)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/8	high
291747	MiracleLinux 8 : grafana-7.5.9-4.el8 (AXSA:2021-2800:06)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	high

检测

插件搜索

high

high

high

high

high