The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:3577 advisory.

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:4035 advisory.

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build     system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will     downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of     entropy by not using a CSPRNG. This issue was patched in version 1.19.1. (CVE-2023-31124)

  - c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for     certain ipv6 addresses, in particular 0::00:00:00/2 was found to cause an issue. C-ares only uses this     function internally for configuration purposes which would require an administrator to configure such an     address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes     and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. (CVE-2023-31130)

  - c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares     uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not     seeded by srand() so will generate predictable output. Input from the random number generator is fed into     a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt     is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has     been fixed in version 1.19.1. (CVE-2023-31147)

  - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target     resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to     the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the     connection. This issue has been patched in version 1.19.1. (CVE-2023-32067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-4035 advisory.

    nodejs     [1:18.14.2-3]
    - Update bundled c-ares to 1.19.1       Resolves: CVE-2022-4904       Resolves: CVE-2023-31124 CVE-2023-31130 CVE-2023-31147 CVE-2023-32067

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6131:02 advisory.

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6227:01 advisory.

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)
      * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)
      * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)
      * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)
      * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6142:03 advisory.

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the c package has been released.

An update of the python3 package has been released.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2023_3584 advisory.

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
177604	Rocky Linux 9 : nodejs:18 (RLSA-2023:3577)	Nessus	Rocky Linux Local Security Checks	2023/6/25	2023/11/6	medium
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	2023/6/30	2023/7/6	critical
178195	CentOS 8 : nodejs:18 (CESA-2023:4035)	Nessus	CentOS Local Security Checks	2023/7/12	2024/2/8	high
178578	Oracle Linux 8 : nodejs:18 (ELSA-2023-4035)	Nessus	Oracle Linux Local Security Checks	2023/7/20	2025/9/9	high
292416	MiracleLinux 7 : c-ares-1.10.0-3.el7.1 (AXSA:2023-6131:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
292667	MiracleLinux 8 : nodejs:18 (AXSA:2023-6227:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
293189	MiracleLinux 8 : c-ares-1.13.0-6.el8.2 (AXSA:2023-6142:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
332164	Photon OS 5.0: C PHSA-2023-5.0-91-0015	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	medium
333691	Photon OS 5.0: Python3 PHSA-2023-5.0-91-0084	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/10	medium
355502	Rocky Linux 8 [CIQ] Security Update: c-ares / c-ares-debuginfo / c-ares-debugsource / c-ares-devel (crlsa-2023_3584)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high

检测

插件搜索

medium

critical

high

high

high

high

high

medium

medium

high