The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0781 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-45290:
    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with     Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed     form were not applied to the memory consumed while reading a single form line. This permits a maliciously     crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory,     potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits     the maximum size of form lines.

    CVE-2024-1394:
    A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That     function uses named return parameters to free pkey and ctx if there is an error initializing the     context or setting the different properties. All return statements related to error cases follow the     return nil, nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred     function that should free them.

    CVE-2024-3727:
    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger     unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local     path traversal, and other attacks.

    CVE-2024-6104:
    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

    CVE-2024-24783:
    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause     Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth     to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not     verify client certificates.

    CVE-2024-24784:
    The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
    Since this is a misalignment with conforming address parsers, it can result in different trust decisions     being made by programs using different parsers.

    CVE-2024-24789:
    The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most     zip implementations. This misalignment could be exploited to create an zip file with contents that vary     depending on the implementation reading the file. The archive/zip package now rejects files containing     these errors.

    CVE-2024-37298:
    gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running     schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious     attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of     schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory     exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0227-1 advisory.

    Update to version 2.53.0:

    * CVE-2024-6104: gh: hashicorp/go-retryablehttp: url might write sensitive information to log file     (boo#1227035)

    * Disable `TestGetTrustedRoot/successfully_verifies_TUF_root` test due to     https://github.com/cli/cli/issues/8928
    * Rename package directory and files
    * Rename package name to `update_branch`
    * Rename `gh pr update` to `gh pr update-branch`
    * Add test case for merge conflict error
    * Handle merge conflict error
    * Return error if PR is not mergeable
    * Replace literals with consts for `Mergeable` field values
    * Add separate type for `PullRequest.Mergeable` field
    * Remove unused flag
    * Print message on stdout instead of stderr
    * Raise error if editor is used in non-tty mode
    * Add tests for JSON field support on issue and pr view commands
    * docs: Update documentation for `gh repo create` to clarify owner
    * Ensure PR does not panic when stateReason is requested
    * Add `createdAt` field to tests
    * Add `createdAt` field to `Variable` type
    * Add test for exporting as JSON
    * Add test for JSON output
    * Only populate selected repo information for JSON output
    * Add test to verify JSON exporter gets set
    * Add `--json` option support
    * Use `Variable` type defined in `shared` package
    * Add tests for JSON output
    * Move `Variable` type and `PopulateSelectedRepositoryInformation` func to shared
    * Fix query parameter name
    * Update tests to account for ref comparison step
    * Improve query variable names
    * Check if PR branch is already up-to-date
    * Add `ComparePullRequestBaseBranchWith` function
    * Run `go mod tidy`
    * Add test to verify `--repo` requires non-empty selector
    * Require non-empty selector when `--repo` override is used
    * Run `go mod tidy`
    * Register `update` command
    * Add tests for `pr update` command
    * Add `pr update` command
    * Add `UpdatePullRequestBranch` method
    * Upgrade `shurcooL/githubv4`

    Update to version 2.52.0:

    * Attestation Verification - Buffer Fix
    * Remove beta note from attestation top level command
    * Removed beta note from `gh at download`.
    * Removed beta note from `gh at verify`, clarified reusable workflows use case.
    * add `-a` flag to `gh run list`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4858 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.16.5. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2024:4855

    Security Fix(es):

    * gorilla/schema: Potential memory exhaustion attack due to sparse slice     deserialization (CVE-2024-37298)
    * go-retryablehttp: url might write sensitive information to log file     (CVE-2024-6104)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6194 advisory.

    [4.9.4-10.0.1]
    - Fixes issue of podman execvp error while using podmansh [Orabug: 36073625]
    - Improved saving remote build context to tarfile in Podman daemon [Orabug: 36495655]
    - Add devices on container startup, not on creation
    - Backport fast gzip for compression [Orabug: 36420418]
    - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [4:4.9.4-10]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/6b45bb1)
    - Resolves: RHEL-53250

    [4:4.9.4-9]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/1a2d8e3)
    - Resolves: RHEL-50507

    [4:4.9.4-8]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/affa589)
    - Resolves: RHEL-45916

    [4:4.9.4-7]
    - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel       (https://github.com/containers/podman/commit/8fa0c76)
    - Resolves: RHEL-40804

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3546-1 advisory.

    - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (bsc#1231230)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1037-1 advisory.

    - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239330).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2025:02091-1 advisory.

    - Added patch to remove using rw as a default mount option (bsc#1239776)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0333 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-30204:
    golang-jwt is a Go implementation of JSON Web Tokens. Prior to     5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument     (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization     header consists of Bearer  followed by many period characters, a call to that function incurs allocations     to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant     factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

    CVE-2025-30153:
    kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a     multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file     (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from     the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the     documentation says). This vulnerability is fixed in 0.131.0.

    CVE-2025-22868:
    An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during     parsing.

    CVE-2024-6104:
    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

    CVE-2024-51744:
    golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in     `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they     should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims`     return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will     ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has     been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the     `ParseWithClaims` function will immediately return in dangerous situations (e.g., an invalid signature),     limiting the combined errors only to situations where the signature is valid, but further validation     failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of     the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100     % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0,     please make sure that you are properly checking for all errors (dangerous ones first), so that you are     not running in the case detailed above.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4853 advisory.

  - haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers     (CVE-2023-45539)

  - go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4963 advisory.

  - go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

  - gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0458-1 advisory.

    - CVE-2024-6104: possible sensitive data exposure due to hashicorp/go-retryablehttp not sanitizing URLs     when writing       them to log files. (bsc#1227052)
    - CVE-2023-45288: possible excessive CPU consumption due to no limit being set on the number of     CONTINUATION frames       read for an HTTP/2 request in golang.org/x/net/http2. (bsc#1236507)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0775-1 advisory.

    - CVE-2025-27144: Fixed denial of service in parsing function of embedded library Go JOSE (bsc#1237641)
    - CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the     containers/storage library can cause Denial of Service (DoS) (bsc#1231698)
    - CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)
    - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount     Instruction in buildah (bsc#1231208)
    - CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (bsc#1231230)
    - CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)
    - CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a     malicious Containerfile. (bsc#1236270)
    - CVE-2024-6104: Fixed hashicorp/go-retryablehttp writing sensitive information to log files (bsc#1227052)
    - CVE-2023-45288: Fixed golang.org/x/net/http2 excessive resource consumption when receiving too many     headers (bsc#1236507)


    - Load ip_tables and ip6_tables kernel module (bsc#1214612)
      * Required for rootless mode as a regular user has no permission         to load kernel modules


    - Refactor network backend dependencies:
      * podman requires either netavark or cni-plugins. On ALP, require         netavark, otherwise prefer netavark but don't force it.
      * This fixes missing cni-plugins in some scenarios
      * Default to netavark everywhere where it's available

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1332-1 advisory.

    - CVE-2023-45288: rekor: golang.org/x/net/http2: Fixed close connections when receiving too many headers     (bsc#1236519)
    - CVE-2024-6104: rekor: hashicorp/go-retryablehttp: Fixed sensitive information disclosure inside log file     (bsc#1227053)
    - CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token parsing     (bsc#1239191)
    - CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Fixed denial of service in the Key Exchange     (bsc#1239327)
    - CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-     jose/v3: Fixed denial of service in Go JOSE's parsing (bsc#1237638)
    - CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: Fixed jwt-go allowing excessive memory allocation     during header parsing (bsc#1240468)

    Other fixes:

    - Update to version 1.3.10:
      * Features
        - Added --client-signing-algorithms flag (#1974)
      * Fixes / Misc
        - emit unpopulated values when marshalling (#2438)
        - pkg/api: better logs when algorithm registry rejects a key           (#2429)
        - chore: improve mysql readiness checks (#2397)
        - Added --client-signing-algorithms flag (#1974)

    - Update to version 1.3.9 (jsc#SLE-23476):
      * Cache checkpoint for inactive shards (#2332)
      * Support per-shard signing keys (#2330)

    - Update to version 1.3.8:
      * Bug Fixes
        - fix zizmor issues (#2298)
        - remove unneeded value in log message (#2282)
      * Quality Enhancements
        - chore: relax go directive to permit 1.22.x
        - fetch minisign from homebrew instead of custom ppa (#2329)
        - fix(ci): simplify GOVERSION extraction
        - chore(deps): bump actions pins to latest
        - Updates go and golangci-lint (#2302)
        - update builder to use go1.23.4 (#2301)
        - clean up spaces
        - log request body on 500 error to aid debugging (#2283)

    - Update to version 1.3.7:
      * New Features
        - log request body on 500 error to aid debugging (#2283)
        - Add support for signing with Tink keyset (#2228)
        - Add public key hash check in Signed Note verification (#2214)
        - update Trillian TLS configuration (#2202)
        - Add TLS support for Trillian server (#2164)
        - Replace docker-compose with plugin if available (#2153)
        - Add flags to backfill script (#2146)
        - Unset DisableKeepalive for backfill HTTP client (#2137)
        - Add script to delete indexes from Redis (#2120)
        - Run CREATE statement in backfill script (#2109)
        - Add MySQL support to backfill script (#2081)
        - Run e2e tests on mysql and redis index backends (#2079)
      * Bug Fixes
        - remove unneeded value in log message (#2282)
        - Add error message when computing consistency proof (#2278)
        - fix validation error handling on API (#2217)
        - fix error in pretty-printed inclusion proof from verify           subcommand (#2210)
        - Fix index scripts (#2203)
        - fix failing sharding test
        - Better error handling in backfill script (#2148)
        - Batch entries in cleanup script (#2158)
        - Add missing workflow for index cleanup test (#2121)
        - hashedrekord: fix schema $id (#2092)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0164 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-45290:
    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with     Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed     form were not applied to the memory consumed while reading a single form line. This permits a maliciously     crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory,     potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits     the maximum size of form lines.

    CVE-2024-1394:
    A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That     function uses named return parameters to free pkey and ctx if there is an error initializing the     context or setting the different properties. All return statements related to error cases follow the     return nil, nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred     function that should free them.

    CVE-2024-24783:
    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause     Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth     to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not     verify client certificates.

    CVE-2024-24784:
    The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
    Since this is a misalignment with conforming address parsers, it can result in different trust decisions     being made by programs using different parsers.

    CVE-2024-24789:
    The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most     zip implementations. This misalignment could be exploited to create an zip file with contents that vary     depending on the implementation reading the file. The archive/zip package now rejects files containing     these errors.

    CVE-2024-3727:
    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger     unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local     path traversal, and other attacks.

    CVE-2024-37298:
    gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running     `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious     attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of     `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory     exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

    CVE-2024-6104:
    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5258 advisory.

    aardvark-dns     buildah     [2:1.33.8-4]
    - rebuild for  golang fixes
    - Related: RHEL-28452

    cockpit-podman     [84.1-1]
    - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1
    - Related: Jira:RHEL-25557

    conmon     [3:2.1.10-1]
    - update to https://github.com/containers/conmon/releases/tag/v2.1.10
    - Related: Jira:RHEL-2110

    containernetworking-plugins     [1:1.4.0-5]
    - rebuild for  golang fixes
    - Related: RHEL-28452

    containers-common     [1-82.0.1]
    - Updated removed references [Orabug: 33473101] (Alex Burmashev)
    - Adjust registries.conf (Nikita Gerasimov)
    - remove references to RedHat registry (Nikita Gerasimov)

    container-selinux     [2:2.229.0-2]
    - remove watch statements properly for RHEL8 and lower
    - Related: Jira:RHEL-2110

    criu     crun     [1.14.3-2]
    - remove BR libgcrypt-devel, no longer needed
    - Related: Jira:RHEL-2110

    fuse-overlayfs     [1.13-1]
    - update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.13
    - Related: Jira:RHEL-2110

    libslirp     netavark     oci-seccomp-bpf-hook     [1.2.10-1]
    - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10
    - Related: Jira:RHEL-2110

    podman     [4.9.4-12.0.2]
    - Fixes issue of podman execvp error while using podmansh [Orabug: 36756665]

    python-podman     [4.9.0-2]
    - depend directly on urllib3
    - Resolves: RHEL-43567

    runc     [1:1.1.12-4]
    - rebuild for  golang fixes
    - Related: RHEL-28452

    skopeo     [2:1.14.5-3]
    - rebuild for  golang fixes
    - Related: RHEL-28452

    slirp4netns     [1.2.3-1]
    - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3
    - Related: Jira:RHEL-2110

    udica

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9102:06 advisory.

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)
      * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
      * go-retryable[http:](http:) url might write sensitive information to log file (CVE-2024-6104)
      * net/[http:](http:) Denial of service due to improper 100-continue handling in net/http     (CVE-2024-24791)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239203	TencentOS Server 3: container-tools:rhel8 (TSSA-2024:0781)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium
204823	openSUSE 15 Security Update : gh (openSUSE-SU-2024:0227-1)	Nessus	SuSE Local Security Checks	2024/7/28	2024/7/28	medium
204927	RHEL 8 / 9 : OpenShift Container Platform 4.16.5 (RHSA-2024:4858)	Nessus	Red Hat Local Security Checks	2024/7/31	2024/11/7	medium
206506	Oracle Linux 9 : podman (ELSA-2024-6194)	Nessus	Oracle Linux Local Security Checks	2024/9/3	2025/9/11	medium
208418	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2024:3546-1)	Nessus	SuSE Local Security Checks	2024/10/9	2024/11/26	high
233461	SUSE SLES15 Security Update : podman (SUSE-SU-2025:1037-1)	Nessus	SuSE Local Security Checks	2025/3/28	2025/3/28	high
240576	SUSE SLES15 : Recommended update for podman (SUSE-SU-SUSE-RU-2025:02091-1)	Nessus	SuSE Local Security Checks	2025/6/26	2025/6/26	high
239114	TencentOS Server 4: osbuild-composer (TSSA-2025:0333)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
311867	RHCOS 4 : OpenShift Container Platform 4.15.24 (RHSA-2024:4853)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	high
311905	RHCOS 4 : OpenShift Container Platform 4.14.34 (RHSA-2024:4963)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	medium
216398	openSUSE 15 Security Update : podman (SUSE-SU-2025:0458-1)	Nessus	SuSE Local Security Checks	2025/2/17	2025/2/17	medium
225811	SUSE SLES15 Security Update : podman (SUSE-SU-2025:0775-1)	Nessus	SuSE Local Security Checks	2025/3/5	2025/3/5	high
234607	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rekor (SUSE-SU-2025:1332-1)	Nessus	SuSE Local Security Checks	2025/4/18	2025/4/18	high
236270	Alibaba Cloud Linux 3 : 0164: container-tools:rhel8 (ALINUX3-SA-2024:0164)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
205538	Oracle Linux 8 : container-tools:ol8 (ELSA-2024-5258)	Nessus	Oracle Linux Local Security Checks	2024/8/14	2025/9/9	medium
292848	MiracleLinux 9 : skopeo-1.16.1-1.el9 (AXSA:2024-9102:06)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium

检测

插件搜索

medium

medium

medium

medium

high

high

high

high

high

medium

medium

high

high

medium

medium

medium