The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1102-1 advisory.

    - CVE-2025-22868: Fixed unexpected memory consumption during token parsing in golang.org/x/oauth2     (bsc#1239185).
    - CVE-2025-22869: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322).
    - CVE-2024-29018: Fixed external DNS requests from 'internal' networks leading to data exfiltration     (bsc#1234089).
    - CVE-2024-23650: Fixed BuildKit daemon crash via malicious BuildKit client or frontend request     (bsc#1219437).

    Other fixes:
    - Make container-selinux requirement conditional on selinux-policy (bsc#1237367).
    - Updated docker-buildx to 0.19.3.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2706-1 advisory.

    This update for buildah fixes the following issues

    - CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html:
    multiple issues       when parsing HTML files (bsc#1267179).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262953).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266648).
    - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266191).
    - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266191).
    - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266191).
    - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266191).
    - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in     golang.org/x/crypto/ssh/knownhosts       (bsc#1266191).
    - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in     golang.org/x/crypto/ssh       (bsc#1266191).
    - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh     (bsc#1266191).
    - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266191).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
233792	SUSE SLES12 Security Update : docker, docker-stable (SUSE-SU-2025:1102-1)	Nessus	SuSE Local Security Checks	2025/4/3	2026/3/3	critical
324853	SUSE SLES15 Security Update : buildah (SUSE-SU-2026:2706-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/7/2	high

检测

插件搜索

critical

high