The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1802 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * A vulnerability was found in Unbound due to incorrect default permissions,     allowing any process outside the unbound group to modify the unbound runtime     configuration. The default combination of the control-use-cert: no option with     either explicit or implicit use of an IP address in the control-interface     option could allow improper access. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows     an unprivileged local process to manipulate a running instance, potentially     altering forwarders, allowing them to track all queries forwarded by the local     resolver, and, in some cases, disrupting resolving altogether.

    To mitigate the vulnerability, a new file     /etc/unbound/conf.d/remote-control.conf has been added and included in the     main unbound configuration file, unbound.conf. The file contains two     directives that should limit access to unbound.conf:

        control-interface: /run/unbound/control         control-use-cert: yes

    For details about these directives, run man unbound.conf.

    Updating to the version of unbound provided by this advisory should, in most     cases, address the vulnerability. To verify that your configuration is not     vulnerable, use the unbound-control status | grep control command. If the     output contains control(ssl) or control(namedpipe), your configuration is     not vulnerable. If the command output returns only control, the configuration     is vulnerable because it does not enforce access only to the unbound group     members. To fix your configuration, add the line include:
    /etc/unbound/conf.d/remote-control.conf to the end of the file     /etc/unbound/unbound.conf. If you use a custom     /etc/unbound/conf.d/remote-control.conf file, add the new directives to this     file. (CVE-2024-1488)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1804 advisory.

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.

    Security Fix(es):

    * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)

    * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)

    Security Fix(es):

    * A vulnerability was found in Unbound due to incorrect default permissions,     allowing any process outside the unbound group to modify the unbound runtime     configuration. The default combination of the control-use-cert: no option with     either explicit or implicit use of an IP address in the control-interface     option could allow improper access. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows     an unprivileged local process to manipulate a running instance, potentially     altering forwarders, allowing them to track all queries forwarded by the local     resolver, and, in some cases, disrupting resolving altogether.

    To mitigate the vulnerability, a new file     /etc/unbound/conf.d/remote-control.conf has been added and included in the     main unbound configuration file, unbound.conf. The file contains two     directives that should limit access to unbound.conf:

        control-interface: /run/unbound/control         control-use-cert: yes

    For details about these directives, run man unbound.conf.

    Updating to the version of unbound provided by this advisory should, in most     cases, address the vulnerability. To verify that your configuration is not     vulnerable, use the unbound-control status | grep control command. If the     output contains control(ssl) or control(namedpipe), your configuration is     not vulnerable. If the command output returns only control, the configuration     is vulnerable because it does not enforce access only to the unbound group     members. To fix your configuration, add the line include:
    /etc/unbound/conf.d/remote-control.conf to the end of the file     /etc/unbound/unbound.conf. If you use a custom     /etc/unbound/conf.d/remote-control.conf file, add the new directives to this     file. (CVE-2024-1488)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2UNBOUND-1.17-2024-002 advisory.

    A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside     the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to     manipulate a running instance, potentially altering forwarders, allowing them to track all queries     forwarded by the local resolver, and, in some cases, disrupting resolving altogether. (CVE-2024-1488)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2025:0020 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-1488:
    A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside     the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to     port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to     manipulate a running instance, potentially altering forwarders, allowing them to track all queries     forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

    CVE-2024-8508:
    NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with     very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very     large RRsets can cause Unbound to spend a considerable time applying name compression to downstream     replies. This can lead to degraded performance and eventually denial of service in well orchestrated     attacks. The vulnerability can be exploited by a malicious actor querying Unbound for the specially     crafted contents of a malicious zone with very large RRsets. Before Unbound replies to the query it will     try to apply name compression which was an unbounded operation that could lock the CPU until the whole     packet was complete. Unbound version 1.21.1 introduces a hard limit on the number of name compression     calculations it is willing to do per packet. Packets that need more compression will result in semi-     compressed packets or truncated packets, even on TCP for huge messages, to avoid locking the CPU for long.
    This change should not affect normal DNS traffic.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.3 / AHV-10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3 advisory.

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
193322	RHEL 8 : unbound (RHSA-2024:1802)	Nessus	Red Hat Local Security Checks	2024/4/15	2025/1/24	high
193318	RHEL 8 : unbound (RHSA-2024:1804)	Nessus	Red Hat Local Security Checks	2024/4/15	2025/12/24	high
201041	Amazon Linux 2 : unbound (ALASUNBOUND-1.17-2024-002)	Nessus	Amazon Linux Local Security Checks	2024/6/26	2025/1/24	high
235973	Alibaba Cloud Linux 3 : 0020: unbound (ALINUX3-SA-2025:0020)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
240537	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3)	Nessus	Misc.	2025/6/25	2026/7/15	high

检测

插件搜索

high

high

high

high

medium

high