The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-4226 advisory.

    - resolve CVE-2021-39226
    - rebuild to resolve CVE-2021-34558

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:5072 advisory.

    A highly-available key value store for shared configuration

    Security Fix(es):

    * net/http: panic in ReadRequest and ReadResponse when reading a very large     header (CVE-2021-31525)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3248 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.9. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:3247

    Security Fix(es):

    * golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header     (CVE-2021-31525)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.8 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3431 advisory.

    Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

    Security Fix(es):

    * golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet     (CVE-2021-29923)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4226 advisory.

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.
    (CVE-2021-27358)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1402 advisory.

    OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container     Platform.

    This advisory contains OpenShift Virtualization 2.6.10 RPMs.

    Security Fix(es):

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:5085 advisory.

    Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red     Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade     persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In     addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multicloud data management     service with an S3 compatible API.

    Security Fix(es):

    * kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9     (CVE-2020-8565)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    These updated  Multicloud Object Gateway command line (mcg) packages     include numerous bug fixes and enhancements. Space precludes documenting     all of these changes in this advisory. Users are directed to the Red Hat OpenShift Data Foundation Release     Notes for information on the most     significant of these changes:

    https://access.redhat.com//documentation/en-     us/red_hat_openshift_data_foundation/4.9/html/4.9_release_notes/index

    All Red Hat OpenShift Data Foundation users are advised to upgrade to these updated packages, which     provide numerous bug fixes and enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1329 advisory.

    OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container     Platform.

    This advisory contains OpenShift Virtualization 4.8.5 RPMs.

    Security Fix(es):

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.18.6-1.42. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1635 advisory.

    2023-11-29: CVE-2021-39293 was added to this advisory.

    2023-11-29: CVE-2022-23806 was added to this advisory.

    2023-11-29: CVE-2022-23772 was added to this advisory.

    2023-11-29: CVE-2021-33196 was added to this advisory.

    2023-11-29: CVE-2021-33195 was added to this advisory.

    2023-11-29: CVE-2022-24921 was added to this advisory.

    2023-11-29: CVE-2021-27918 was added to this advisory.

    2023-11-29: CVE-2021-27919 was added to this advisory.

    2023-11-29: CVE-2022-23773 was added to this advisory.

    An infinite loop vulnerability was found in golang. If an application defines a custom token parser     initializing with `xml.NewTokenDecoder` it is possible for the parsing loop to never return. An attacker     could potentially craft a malicious XML document which has an XML element with `EOF` within it, causing     the parsing application to endlessly loop, resulting in a Denial of Service (DoS). (CVE-2021-27918)

    An out of bounds read vulnerability was found in golang. When using the archive/zip standard library     (stdlib) and an unexpected file is parsed, it can cause golang to attempt to read outside of a slice     (array) causing a panic in the runtime. A potential attacker can use this vulnerability to craft an     archive which causes an application using this library to crash resulting in a Denial of Service (DoS).
    (CVE-2021-27919)

    A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the     net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing     injection of unexpected contents. The highest threat from this vulnerability is to integrity.
    (CVE-2021-33195)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic     or potentially exhaust system memory when parsing malformed ZIP files. (CVE-2021-33196)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic     or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a     crafted ZIP file to a Go application using archive/zip to process that file could cause a denial of     service via memory exhaustion or panic. This particular flaw is an incomplete fix for a previous flaw.
    (CVE-2021-39293)

    A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating     chunked encoding. This issue could allow request smuggling, but only if combined with an intermediate     server that also improperly accepts the header as invalid. (CVE-2022-1705)

    A flaw was found in the golang standard library, go/parser. When calling any Parse functions on the Go     source code, which contains deeply nested types or declarations, a panic can occur due to stack     exhaustion. This issue allows an attacker to impact system availability. (CVE-2022-1962)

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

    A flaw was found in the elliptic package of the crypto library in golang when the IsOnCurve function could     return true for invalid field elements. This flaw allows an attacker to take advantage of this undefined     behavior, affecting the availability and integrity of the resource. (CVE-2022-23806)

    A buffer overflow flaw was found in Golang's library encoding/pem. This flaw allows an attacker to use a     large PEM input (more than 5 MB) ), causing a stack overflow in Decode, which leads to a loss of     availability. (CVE-2022-24675)

    A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application     using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient     nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep     nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of     service. (CVE-2022-24921)

    A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to     fail authentification with RSA keys to servers that reject signature algorithms based on SHA-2, enabling     an attacker to crash the server, resulting in a loss of availability. (CVE-2022-27191)

    In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

    A flaw was found in golang encoding/xml. When calling Decoder.Skip while parsing a deeply nested XML     document, a panic can occur due to stack exhaustion and allows an attacker to impact system availability.
    (CVE-2022-28131)

    An integer overflow flaw was found in Golang's crypto/elliptic library. This flaw allows an attacker to     use a crafted scaler input longer than 32 bytes, causing P256().ScalarMult or P256().ScalarBaseMult to     panic, leading to a loss of availability. (CVE-2022-28327)

    A flaw was found in the syscall.Faccessat function when calling a process by checking the group. This flaw     allows an attacker to check the process group permissions rather than a member of the file's group,     affecting system availability. (CVE-2022-29526)

    Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3     allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket     ages during session resumption. (CVE-2022-30629)

    A flaw was found in the golang standard library, io/fs. Calling Glob on a path that contains a large     number of path separators can cause a panic issue due to stack exhaustion. This could allow an attacker to     impact availability. (CVE-2022-30630)

    A flaw was found in golang. Calling the Reader.Read method on an archive that contains a large number of     concatenated 0-length compressed files can cause a panic issue due to stack exhaustion. (CVE-2022-30631)

    A flaw was found in golang. Calling Glob on a path that contains a large number of path separators can     cause a panic issue due to stack exhaustion. This can cause an attacker to impact availability.
    (CVE-2022-30632)

    Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to     cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a     nested field that uses the any field tag. (CVE-2022-30633)

    A flaw was found in golang. When calling Decoder.Decode on a message that contains deeply nested     structures, a panic can occur due to stack exhaustion and allows an attacker to impact system     availability. (CVE-2022-30635)

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8008 advisory.

  - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a     container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid     `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits     for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a     malicious image, which when downloaded and stored by an application using containers/storage, would then     cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5056:01 advisory.

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u-     extension (CVE-2020-28851)
      * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing     bcp47 tag (CVE-2020-28852)
      * podman: podman machine spawns gvproxy with port bound to all IPs     (CVE-2021-4024)
      * podman: Remote traffic to rootless containers is seen as orginating from     localhost (CVE-2021-20199)
      * containers/storage: DoS via malicious image (CVE-2021-20291)
      * golang: net/http/httputil: ReverseProxy forwards connection headers if first     one is empty (CVE-2021-33197)
      * golang: crypto/tls: certificate of wrong type is causing TLS client to panic     (CVE-2021-34558)
      * golang: net: lookup functions may return invalid host names (CVE-2021-33195)
      * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if     passed inputs with very large exponents (CVE-2021-33198)
      * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
      * podman: possible information disclosure and modification (CVE-2022-2989)
      * buildah: possible information disclosure and modification (CVE-2022-2990)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)     CVE(s):
    CVE-2020-28851     CVE-2020-28852     CVE-2021-20199     CVE-2021-20291     CVE-2021-33195     CVE-2021-33197     CVE-2021-33198     CVE-2021-34558     CVE-2021-4024     CVE-2022-1705     CVE-2022-2989     CVE-2022-2990     CVE-2022-27191     CVE-2022-30630     CVE-2022-30631     CVE-2022-30632

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
155406	Oracle Linux 8 : grafana (ELSA-2021-4226)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/10/22	high
156004	RHEL 8 : Red Hat OpenStack Platform 16.1 (etcd) (RHSA-2021:5072)	Nessus	Red Hat Local Security Checks	2021/12/11	2024/11/7	high
152975	RHEL 7 / 8 : OpenShift Container Platform 4.8.9 (RHSA-2021:3248)	Nessus	Red Hat Local Security Checks	2021/9/2	2024/11/7	high
153098	RHEL 7 : go-toolset-1.15-golang (RHSA-2021:3431)	Nessus	Red Hat Local Security Checks	2021/9/7	2024/11/7	high
157604	AlmaLinux 8 : grafana (ALSA-2021:4226)	Nessus	Alma Linux Local Security Checks	2022/2/9	2023/11/10	high
194203	RHEL 7 / 8 : OpenShift Virtualization 2.6.10 RPMs (RHSA-2022:1402)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
194270	RHEL 8 : Red Hat OpenShift Data Foundation 4.9.0 (RHSA-2021:5085)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
194335	RHEL 7 / 8 : OpenShift Virtualization 4.8.5 RPMs (RHSA-2022:1329)	Nessus	Red Hat Local Security Checks	2024/4/28	2024/11/7	high
168435	Amazon Linux AMI : golang (ALAS-2022-1635)	Nessus	Amazon Linux Local Security Checks	2022/12/7	2024/12/11	critical
167960	AlmaLinux 9 : buildah (ALSA-2022:8008)	Nessus	Alma Linux Local Security Checks	2022/11/19	2023/10/3	high
292898	MiracleLinux 9 : container-tools, python-podman-4.2.0-1.el9, toolbox-0.0.99.3-5.el9 (AXSA:2023-5056:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

critical

high

high