The remote NewStart CGSL host, running version MAIN 6.02, has sos packages installed that are affected by a vulnerability:

  - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in:
    sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev (CVE-2022-2806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

リモートの Ubuntu 16.04ESM / 18.04LTS / 20.04LTS / 22.04ホストにインストールされているパッケージは、USN-5636-1 アドバイザリに記載されている脆弱性の影響を受けます。

  - ovirt-log-collector/sosreport が RHV 管理パスワードをフィルタリングせずに収集していることが判明しました。修正済み：
    sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev (CVE-2022-2806)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存しています。

遠端 Ubuntu 16.04 ESM/18.04 LTS/20.04 LTS/22.04 LTS 主機上安裝的套件受到 USN-5636-1 公告中所提及的一個弱點影響。

  - 據發現，ovirt-log-collector/sosreport 會收集未經篩選的 RHV 管理員密碼。已在 
    sos-4.2-20.el8_6、ovirt-log-collector-4.4.7-2.el8ev 中修正此問題 (CVE-2022-2806)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Ubuntu 16.04 ESM/18.04 LTS/20.04 LTS/22.04 LTS 主机上安装的一个程序包受到 USN-5636-1 公告中提及的漏洞影响。

  - 已发现 ovirt-log-collector/sosreport 收集未经筛选的 RHV 管理员密码。已在
    sos-4.2-20.el8_6、ovirt-log-collector-4.4.7-2.el8ev 中修复 (CVE-2022-2806)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

According to the versions of the sos package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in:
    sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev (CVE-2022-2806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has sos packages installed that are affected by a vulnerability:

  - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in:
    sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev (CVE-2022-2806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

リモート Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2022: 6393 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - jquery：injQuery.htmlPrefilterメソッドが不適切なことによるクロスサイトスクリプティング（CVE-2020-11022）

  - jquery：DOM 操作メソッドへ渡される HTML の <option>タグを介した信頼されていないコード実行 (CVE-2020-11023)

  - springframework: 悪意のある入力により、追加のログエントリが挿入される (CVE-2021-22096)

  -nodejs-underscore：テンプレート関数による任意のコード実行（CVE-2021-23358）

  - ovirt-log-collector: RHVM 管理者パスワードがフィルタリングされずに記録されます（CVE-2022-2806）

  - moment: 非効率的な解析アルゴリズムにより DoS が発生 (CVE-2022-31129)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6393 advisory.

    The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform     that allows system administrators to view and manage virtual machines. The Manager provides a     comprehensive range of features including search capabilities, resource management, live migrations, and     virtual infrastructure provisioning.

    Security Fix(es):

    * nodejs-underscore: Arbitrary code execution via the template function (CVE-2021-23358)

    * moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)

    * jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

    * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods     (CVE-2020-11023)

    * ovirt-log-collector: RHVM admin password is logged unfiltered (CVE-2022-2806)

    * springframework: malicious input leads to insertion of additional log entries (CVE-2021-22096)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, running engine-setup did not always renew OVN certificates close to expiration or expired.
    With this release, OVN certificates are always renewed by engine-setup when needed. (BZ#2097558)

    * Previously, the Manager issued warnings of approaching certificate expiration before engine-setup could     update certificates. In this release expiration warnings and certificate update periods are aligned, and     certificates are updated as soon as expiration warnings occur. (BZ#2097725)

    * With this release, OVA export or import work on hosts with a non-standard SSH port. (BZ#2104939)

    * With this release, the certificate validity test is compatible with RHEL 8 and RHEL 7 based hypervisors.
    (BZ#2107250)

    * RHV 4.4 SP1 and later are only supported on RHEL 8.6, customers cannot use RHEL 8.7 or later, and must     stay with RHEL 8.6 EUS. (BZ#2108985)

    * Previously, importing templates from the Administration Portal did not work. With this release,     importing templates from the Administration Portal is possible. (BZ#2109923)

    * ovirt-provider-ovn certificate expiration is checked along with other RHV certificates. If ovirt-     provider-ovn is about to expire or already expired, a warning or alert is raised in the audit log. To     renew the ovirt-provider-ovn certificate, administators must run engine-setup. If your ovirt-provider-ovn     certificate expires on a previous RHV version, upgrade to RHV 4.4 SP1 batch 2 or later, and ovirt-     provider-ovn certificate will be renewed automatically in the engine-setup. (BZ#2097560)

    * Previously, when importing a virtual machine with manual CPU pinning, the manual pinning string was     cleared, but the CPU pinning policy was not set to NONE. As a result, importing failed. In this release,     the CPU pinning policy is set to NONE if the CPU pinning string is cleared, and importing succeeds.
    (BZ#2104115)

    * Previously, the Manager could start a virtual machine with a Resize and Pin NUMA policy on a host     without an equal number of physical sockets to NUMA nodes. As a result, wrong pinning was assigned to the     policy. With this release, the Manager does not allow the virtual machine to be scheduled on such a     virtual machine, and the pinning is correct based on the algorithm. (BZ#1955388)

    * Rebase package(s) to version: 4.4.7.
    Highlights, important fixes, or notable enhancements: fixed BZ#2081676 (BZ#2104831)

    * In this release, rhv-log-collector-analyzer provides detailed output for each problematic image,     including disk names, associated virtual machine, the host running the virtual machine, snapshots, and     current SPM. The detailed view is now the default. The compact option can be set by using the --compact     switch in the command line. (BZ#2097536)

    * UnboundID LDAP SDK has been rebased on upstream version 6.0.4. See     https://github.com/pingidentity/ldapsdk/releases for changes since version 4.0.14 (BZ#2092478)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5636-1 advisory.

    It was discovered that SoS incorrectly handled certain data. An attacker could possibly use this issue to     expose sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of sos installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2806 advisory.

  - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in:
    sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev (CVE-2022-2806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2022: 6393 公告中提及的多個弱點影響。

  - jquery：存在跨網站指令碼，這是 injQuery.htmlPrefilter 方法不當所致 (CVE-2020-11022)

  - jquery：透過傳遞給 DOM 操作方法的 HTML 中的 <option> 標記，進行不受信任的程式碼執行 (CVE-2020-11023)

  - springframework：藉由惡意輸入可插入其他記錄項目 (CVE-2021-22096)

  - nodejs-underscore：透過範本函式執行任意程式碼 (CVE-2021-23358)

  - ovirt-log-collector：記錄 RHVM 管理員密碼時未執行篩選 (CVE-2022-2806)

  - moment：低效剖析演算法可導致 DoS (CVE-2022-31129)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2022: 6393 公告中提及的多个漏洞影响。

  - jquery：存在跨站脚本，这是 injQuery.htmlPrefilter 方法不当所致 (CVE-2020-11022)

  - jquery：通过传递给 DOM 操纵方法的 HTML 中的 <option> 标签执行不受信任的代码 (CVE-2020-11023)

  - springframework：通过恶意输入导致插入额外的日志条目 (CVE-2021-22096)

  - nodejs-underscore：通过模板函数造成任意代码执行 (CVE-2021-23358)

  - ovirt-log-collector：记录 RHVM 管理员密码时未执行筛选 (CVE-2022-2806)

  - moment：导致 DoS 的低效解析算法 (CVE-2022-31129)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
171704	NewStart CGSL MAIN 6.02 : sos Vulnerability (NS-SA-2023-0003)	Nessus	NewStart CGSL Local Security Checks	2023/2/21	2023/2/21	medium
165457	Ubuntu 16.04ESM / 18.04LTS / 20.04LTS / 22.04LTS : SoS の脆弱性 (USN-5636-1)	Nessus	Ubuntu Local Security Checks	2022/9/26	2024/8/27	medium
165457	Ubuntu 16.04 ESM/18.04 LTS/20.04 LTS/22.04 LTS：SoS 弱點 (USN-5636-1)	Nessus	Ubuntu Local Security Checks	2022/9/26	2024/8/27	medium
165457	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS：SoS 漏洞 (USN-5636-1)	Nessus	Ubuntu Local Security Checks	2022/9/26	2024/8/27	medium
191841	EulerOS 2.0 SP8 : sos (EulerOS-SA-2024-1300)	Nessus	Huawei Local Security Checks	2024/3/12	2024/3/12	medium
171711	NewStart CGSL CORE 5.04 / MAIN 5.04 : sos Vulnerability (NS-SA-2023-0002)	Nessus	NewStart CGSL Local Security Checks	2023/2/21	2023/2/21	medium
164843	RHEL 8: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
164843	RHEL 8 : RHV Manager (ovirt-engine) [ovirt-4.5.2] (RHSA-2022:6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
165457	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : SoS vulnerability (USN-5636-1)	Nessus	Ubuntu Local Security Checks	2022/9/26	2024/8/27	medium
173554	CBL Mariner 2.0 Security Update: sos (CVE-2022-2806)	Nessus	MarinerOS Local Security Checks	2023/3/28	2023/3/28	medium
164843	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.2] 錯誤修正和 (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high
164843	RHEL 8：RHV Manager (ovirt-engine) [ovirt-4.5.2] 错误修正和 (RHSA-2022: 6393)	Nessus	Red Hat Local Security Checks	2022/9/8	2025/1/24	high

检测

插件搜索

medium

medium

medium

medium

medium

medium

high

high

medium

medium

high

high