The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8678 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
      * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of golang / msft-golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9355 advisory.

  - A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an     uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It May also be     possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac     sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It     is also possible to force a derived key to be all zeros instead of an unpredictable value. This May have     follow-on implications for the Go TLS stack. (CVE-2024-9355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of golang installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9355 advisory.

  - A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an     uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It May also be     possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac     sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It     is also possible to force a derived key to be all zeros instead of an unpredictable value. This May have     follow-on implications for the Go TLS stack. (CVE-2024-9355)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9551 advisory.

    The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries     and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

    Security Fix(es):

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0224 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-9355:
    A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an     uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be     possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac     sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It     is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have     follow-on implications for the Go TLS stack.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:7256 advisory.

    Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics     with text pointers inside Git, while storing the file contents on a remote server.

    Security Fix(es):

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

    * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8957:17 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
      * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7118 advisory.

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild     under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It     is compatible with composer-cli and cockpit-composer clients.

    Security Fix(es):

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

    * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
210138	AlmaLinux 9 : grafana (ALSA-2024:8678)	Nessus	Alma Linux Local Security Checks	2024/11/4	2025/9/30	medium
213587	CBL Mariner 2.0 Security Update: golang / msft-golang (CVE-2024-9355)	Nessus	MarinerOS Local Security Checks	2025/1/9	2025/7/11	high
215560	Azure Linux 3.0 Security Update: golang (CVE-2024-9355)	Nessus	Azure Linux Local Security Checks	2025/2/10	2026/1/22	high
232194	RHEL 9 : grafana-pcp (RHSA-2024:9551)	Nessus	Red Hat Local Security Checks	2025/3/6	2025/3/6	medium
236244	Alibaba Cloud Linux 3 : 0224: go-toolset:rhel8 (ALINUX3-SA-2024:0224)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
237308	RHEL 9 : git-lfs (RHSA-2025:7256)	Nessus	Red Hat Local Security Checks	2025/5/27	2025/6/5	high
292890	MiracleLinux 9 : grafana-9.2.10-19.el9_4 (AXSA:2024-8957:17)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
235795	RHEL 9 : osbuild and osbuild-composer (RHSA-2025:7118)	Nessus	Red Hat Local Security Checks	2025/5/13	2025/7/1	high

检测

插件搜索

medium

high

high

medium

high

high

high

high