There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2,
    30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools
    functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain
    a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the
    `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would
    not function without the ability to use XPath expressions to query complex content. Alternatively, one may
    utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2,
    27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven
    central, intended to quickly provide a fix to affected applications. (CVE-2024-36404)

远程主机上安装的 OSGeo GeoTools 版本受到远程代码执行漏洞的影响，如下所示：

  - 如果应用程序使用特定 GeoTools 功能来评估用户输入提供的 XPath 表达式，则可能导致远程代码执行漏洞。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

遠端主機上安裝的 OSGeo GeoTools 版本受到遠端程式碼執行弱點影響，如下所示：

  - 如果應用程式使用特定 GeoTools 功能來評估使用者輸入提供的 XPath 運算式，則可能導致遠端程式碼執行。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートホストにインストールされている OSGeo GeoTools のバージョンは、次のようにリモートコード実行の脆弱性の影響を受けます。

  - アプリケーションが GeoTools の特定の機能を使用して、ユーザー入力によって提供された XPath 式を評価する場合、リモートでコードが実行される可能性があります。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of OSGeo GeoTools installed on the remote host is affected by a remote code execution vulnerability, as follows:

  - Remote Code Execution is possible if an application uses certain GeoTools functionality to evaluate XPath     expressions supplied by user input.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
433819	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/2	critical
420825	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Self-Hosted Container Security	SCA Checks	2025/2/5	2025/9/23	critical
433819	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/2	critical
420825	SCA: security update for org.geotools.xsd:gt-xsd-core, org.geotools:gt-app-schema, org.geotools:gt-complex (GHSA-w3pj-wh35-fq8w)	Tenable Cloud Security	SCA Checks	2025/2/5	2025/9/23	critical
204971	OSGeo GeoTools RCE (CVE-2024-36404)	Nessus	CGI abuses	2024/8/2	2025/12/17	critical
204971	OSGeo GeoTools RCE (CVE-2024-36404)	Nessus	CGI abuses	2024/8/2	2025/12/17	critical
204971	OSGeo GeoTools の RCE (CVE-2024-36404)	Nessus	CGI abuses	2024/8/2	2025/12/17	critical
204971	OSGeo GeoTools RCE (CVE-2024-36404)	Nessus	CGI abuses	2024/8/2	2025/12/17	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical