The version of c-ares / fluent-bit / grpc / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-31130 advisory.

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users May externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the c-ares-1.19.1-1.el9 build changelog.

  - AutoTools does not set CARES_RANDOM_FILE during cross compilation [rhel-9] (CVE-2023-31124)

  - Buffer Underwrite in ares_inet_net_pton() [rhel-9] (CVE-2023-31130)

  - Insufficient randomness in generation of DNS query IDs [rhel-9] (CVE-2023-31147)

  - 0-byte UDP payload Denial of Service [rhel-9.3.0] (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7207 advisory.

  - Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in     ares_parse_soa_reply.c. (CVE-2020-22217)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7207 advisory.

    [1.13.0-9.1]
    - Resolves: RHEL-11931 - Buffer Underwrite in ares_inet_net_pton() [rhel-8.9.0.z]

    [1.13.0-9]
    - Resolves: rhbz#2238293 - CVE-2020-22217 c-ares: read-heap-buffer-overflow in ares_parse_soa_reply     [rhel-8] [rhel-8.9.0.z]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4034 advisory.

    nodejs     [1:16.19.1-2]
    - Update bundled c-ares to 1.19.1       Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3586 advisory.

    - Update bundled c-ares to 1.19.1       Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067
    - Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920
    - Resolves: CVE-2022-25881 CVE-2022-4904
    - Resolves: CVE-2021-44906
    - Rebase to version 16.17.1       Resolves: CVE-2022-35255 CVE-2022-35256
    - Rebase to version 16.16.0       Resolves: RHBZ#2106290       Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215       Resolves: CVE-2022-29244

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
201696	CBL Mariner 2.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-31130)	Nessus	MarinerOS Local Security Checks	2024/7/3	2025/4/9	medium
191301	CentOS 9 : c-ares-1.19.1-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
190217	CentOS 8 : c-ares (CESA-2023:7207)	Nessus	CentOS Local Security Checks	2024/2/8	2024/2/8	medium
186199	Oracle Linux 8 : c-ares (ELSA-2023-7207)	Nessus	Oracle Linux Local Security Checks	2023/11/22	2024/10/22	medium
178579	Oracle Linux 8 : nodejs:16 (ELSA-2023-4034)	Nessus	Oracle Linux Local Security Checks	2023/7/20	2025/9/9	medium
177339	Oracle Linux 9 : nodejs (ELSA-2023-3586)	Nessus	Oracle Linux Local Security Checks	2023/6/15	2025/9/9	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium