The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:0950-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2984 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.4. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2021:2983

    Security Fix(es):

    * golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header     (CVE-2021-31525)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: archive/zip: Malformed archive may cause panic or memory exhaustion (CVE-2021-33196)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.8 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote host is prior to 1.16.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1811 advisory.

    An infinite loop vulnerability was found in golang. If an application defines a custom token parser     initializing with `xml.NewTokenDecoder` it is possible for the parsing loop to never return. An attacker     could potentially craft a malicious XML document which has an XML element with `EOF` within it, causing     the parsing application to endlessly loop, resulting in a Denial of Service (DoS). (CVE-2021-27918)

    archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon     attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any     filename. (CVE-2021-27919)

    A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the     net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing     injection of unexpected contents. The highest threat from this vulnerability is to integrity.
    (CVE-2021-33195)

    A flaw was found in Go, acting as an unintended proxy or intermediary, where ReverseProxy forwards     connection headers if the first one was empty. This flaw allows an attacker to drop arbitrary headers. The     highest threat from this vulnerability is to integrity. (CVE-2021-33197)

    A flaw was found in Go, where it attempts to allocate excessive memory. This issue may cause panic or     unrecoverable fatal error if passed inputs with very large exponents. The highest threat from this     vulnerability is to system availability. (CVE-2021-33198)

    A race condition flaw was found in Go. The incoming requests body weren't closed after the handler panic     and as a consequence this could lead to ReverseProxy crash.  The highest threat from this vulnerability is     to Availability. (CVE-2021-36221)

    A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm     GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from     the arguments. The highest threat from this vulnerability is to integrity. (CVE-2021-38297)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic     or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a     crafted ZIP file to a Go application using archive/zip to process that file could cause a denial of     service via memory exhaustion or panic. This particular flaw is an incomplete fix for a previous flaw.
    (CVE-2021-39293)

    An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the     debug/macho standard library (stdlib) and malformed binaries are parsed using Open or OpenFat, it can     cause golang to attempt to read outside of a slice (array) causing a panic when calling ImportedSymbols.
    An attacker can use this vulnerability to craft a file which causes an application using this library to     crash resulting in a denial of service. (CVE-2021-41771)

    A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where     Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can panic when parsing a crafted ZIP     archive containing completely invalid names or an empty filename argument. (CVE-2021-41772)

    There's an uncontrolled resource consumption flaw in golang's net/http library in the canonicalHeader()     function. An attacker who submits specially crafted requests to applications linked with net/http's http2     functionality could cause excessive resource consumption that could lead to a denial of service or     otherwise impact to system performance and resources. (CVE-2021-44716)

    There's a flaw in golang's syscall.ForkExec() interface. An attacker who manages to first cause a file     descriptor exhaustion for the process, then cause syscall.ForkExec() to be called repeatedly, could     compromise data integrity and/or confidentiality in a somewhat uncontrolled way in programs linked with     and using syscall.ForkExec(). (CVE-2021-44717)

    Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

    cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

    A stack overflow flaw was found in Golang's regexp module, which can crash the runtime if the application     using regexp accepts very long or arbitrarily long regexps from untrusted sources that have sufficient     nesting depths. To exploit this vulnerability, an attacker would need to send large regexps with deep     nesting to the application. Triggering this flaw leads to a crash of the runtime, which causes a denial of     service. (CVE-2022-24921)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8008 advisory.

    - fix CVE-2022-2990

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of python-tensorboard installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-33197 advisory.

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3248 advisory.

  - golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header (CVE-2021-31525)

  - golang: net: lookup functions may return invalid host names (CVE-2021-33195)

  - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

  - golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

  - golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3820 advisory.

  - jenkins: improper permission checks allow canceling queue items and aborting builds (CVE-2021-21670)

  - jenkins: session fixation vulnerability (CVE-2021-21671)

  - golang: net: lookup functions may return invalid host names (CVE-2021-33195)

  - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

  - golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:3820 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.8.15. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2021:3821

    Security Fix(es):

    * jenkins: improper permission checks allow canceling queue items and aborting builds (CVE-2021-21670)

    * jenkins: session fixation vulnerability (CVE-2021-21671)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.8 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.8/updating/updating-cluster-between-     minor.html#understanding-upgrade-channels_updating-cluster-between-minor.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4156 advisory.

  - golang: net: lookup functions may return invalid host names (CVE-2021-33195)

  - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

  - golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

  - golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7954 advisory.

  - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing     the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)     (CVE-2020-28851)

  - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage     while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language     header.) (CVE-2020-28852)

  - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual     machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is     accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an     attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making     private services on the VM accessible to the network. This issue could be also used to interrupt the     host's services by forwarding all ports to the VM. (CVE-2021-4024)

  - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including     from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by     default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)

  - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a     container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid     `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits     for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a     malicious image, which when downloaded and stored by an application using containers/storage, would then     cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2792:01 advisory.

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)
      * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)
      * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very     large exponents (CVE-2021-33198)
      * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-02 (Go: Multiple Vulnerabilities)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. (CVE-2020-28366)

  - Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. (CVE-2020-28367)

  - encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader     (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode,     DecodeElement, or Skip method. (CVE-2021-27918)

  - archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon     attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any     filename. (CVE-2021-27919)

  - Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address     octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses,     because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR. (CVE-2021-29923)

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code     execution when using the go get command to fetch modules that make use of cgo (for example, cgo can     execute a gcc program from an untrusted download). (CVE-2021-3115)

  - net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of     service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each     be affected in some configurations. (CVE-2021-31525)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's     header) can cause a NewReader or OpenReader panic. (CVE-2021-33196)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

  - Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function     invocation from a WASM module, when GOARCH=wasm GOOS=js is used. (CVE-2021-38297)

  - ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3     Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
    (CVE-2021-41771)

  - Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP     archive containing an invalid name or an empty filename field. (CVE-2021-41772)

  - net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the     header canonicalization cache via HTTP/2 requests. (CVE-2021-44716)

  - Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or     unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-     descriptor exhaustion. (CVE-2021-44717)

  - Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to     Uncontrolled Memory Consumption. (CVE-2022-23772)

  - cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to     be version tags. This can lead to incorrect access control if an actor is supposed to be able to create     branches but not tags. (CVE-2022-23773)

  - Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return     true in situations with a big.Int value that is not a valid field element. (CVE-2022-23806)

  - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount     of PEM data. (CVE-2022-24675)

  - regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested     expression. (CVE-2022-24921)

  - Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when     presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to     panic. (CVE-2022-27536)

  - The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic     via long scalar input. (CVE-2022-28327)

  - Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero     flags parameter, the Faccessat function could incorrectly report that a file is accessible.
    (CVE-2022-29526)

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - Automatic update for grafana-8.5.6-1.fc37.  ##### **Changelog**  ``` * Wed Jun 29 2022 Andreas Gerstmayr     <agerstmayr@redhat.com> 8.5.6-1 - update to 8.5.6 tagged upstream community sources, see CHANGELOG -     updated license to AGPLv3 - place commented sample config file in /etc/grafana/grafana.ini - enable Go     modules in build process - adapt Node.js bundling to yarn v3 and Zero Install feature * Sun Jun 19 2022     Robert-Andr Mauchin <zebob.m@gmail.com> - 7.5.15-3 - Rebuilt for CVE-2022-1996, CVE-2022-24675,     CVE-2022-28327, CVE-2022-27191,   CVE-2022-29526, CVE-2022-30629  ``` (CVE-2022-30629)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

  - The Go project reports: encoding/gob & math/big: decoding big.Float and             big.Rat can panic     Decoding big.Float and big.Rat types can panic if the             encoded message is too short.
    (CVE-2022-32189)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4226 advisory.

  - The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to     trigger a Denial of Service via a remote API call if a commonly used configuration is set.
    (CVE-2021-27358)

  - In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs,     related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
    (CVE-2021-3114)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an     X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS     server to cause a TLS client to panic. (CVE-2021-34558)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4226 advisory.

  - grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call     (CVE-2021-27358)

  - golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

  - golang: net: lookup functions may return invalid host names (CVE-2021-33195)

  - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

  - golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
151282	openSUSE 15 Security Update : go1.15 (openSUSE-SU-2021:0950-1)	Nessus	SuSE Local Security Checks	2021/7/2	2023/12/11	high
152440	RHEL 7 / 8 : OpenShift Container Platform 4.8.4 (RHSA-2021:2984)	Nessus	Red Hat Local Security Checks	2021/8/10	2024/11/7	high
163229	Amazon Linux 2 : golang (ALAS-2022-1811)	Nessus	Amazon Linux Local Security Checks	2022/7/15	2025/4/11	critical
168110	Oracle Linux 9 : buildah (ELSA-2022-8008)	Nessus	Oracle Linux Local Security Checks	2022/11/22	2024/10/22	high
250998	Linux Distros Unpatched Vulnerability : CVE-2021-33197	Nessus	Misc.	2025/8/18	2025/8/18	medium
296054	Azure Linux 3.0 Security Update: python-tensorboard (CVE-2021-33197)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
312406	RHCOS 4 : OpenShift Container Platform 4.8.9 (RHSA-2021:3248)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
312512	RHCOS 4 : OpenShift Container Platform 4.8.15 (RHSA-2021:3820)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
154293	RHEL 8 : OpenShift Container Platform 4.8.15 (RHSA-2021:3820)	Nessus	Red Hat Local Security Checks	2021/10/21	2024/11/7	high
155083	CentOS 8 : go-toolset:rhel8 (CESA-2021:4156)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	high
155254	EulerOS 2.0 SP9 : golang (EulerOS-SA-2021-2710)	Nessus	Huawei Local Security Checks	2021/11/11	2023/11/24	high
167982	AlmaLinux 9 : podman (ALSA-2022:7954)	Nessus	Alma Linux Local Security Checks	2022/11/19	2023/10/3	medium
294202	MiracleLinux 8 : go-toolset:rhel8 (AXSA:2021-2792:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
163840	GLSA-202208-02 : Go: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/4	2023/10/16	critical
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	2024/5/2	2024/7/29	critical
184684	Rocky Linux 8 : grafana (RLSA-2021:4226)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
155338	CentOS 8 : grafana (CESA-2021:4226)	Nessus	CentOS Local Security Checks	2021/11/13	2023/11/23	high

检测

插件搜索

high

high

critical

high

medium

medium

high

high

high

high

high

medium

high

critical

critical

high

high