9186 matches found
Fedora 40 : golang-github-nvidia-container-toolkit (2025-c3c3774126)
The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-c3c3774126 advisory. Update to 1.17.4 Fixes CVE-2025-23359 or GHSA-4hmh-pm5p-9j7j Tenable has extracted the preceding description block directly from the Fedora security advisory...
RHEL 9 : osbuild-composer (RHSA-2025:4669)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4669 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...
RockyLinux 8 : container-tools:4.0 (RLSA-2024:0121)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0121 advisory. golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseab...
RockyLinux 8 : container-tools (RLSA-2024:4246)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4246 advisory. golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-24786...
Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...
Fedora 41 : golang-github-nvidia-container-toolkit (2025-0245d352e6)
The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0245d352e6 advisory. Update to 1.17.4 Fixes CVE-2025-23359 or GHSA-4hmh-pm5p-9j7j Tenable has extracted the preceding description block directly from the Fedora security advisory...
RockyLinux 8 : grafana (RLSA-2024:5291)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:5291 advisory. golang: net: malformed DNS message can cause infinite loop CVE-2024-24788 golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789...
Golang 1.24.x < 1.24.3 Directory Traversal
The version of Golang running on the remote host is 1.24.x prior to 1.24.3. It is, therefore, affected by a directory traversal vulnerability that makes it possible to improperly access the parent directory of an os.Root. Note that Nessus has not tested for this issue but has instead relied only ...
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
A flaw was found in the golang-jwt implementation of JSON Web Tokens JWT. In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an...
ROS-20250505-01
The vulnerability in the Golang programming language SSH server is related to the fact that the application does not control internal resources consumption in the ssh packet when working with clients that are slow or do not perform key exchange at all. or do not perform key exchange at all...
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
A flaw was found in the golang-jwt implementation of JSON Web Tokens JWT. In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an...
golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only...
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
A flaw was found in the golang-jwt implementation of JSON Web Tokens JWT. In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an...
Security Bulletin: IBM Planning Analytics Cartridge has addressed a security vulnerability in Golang Go (CVE-2024-24790)
Summary IBM Planning Analytics Cartridge is considered affected by a vulnerability in Golang Go. For more information about the vulnerability impact, refer to the table in the "Related Information" section. This Security Bulletin relates only to the direct usage of third-party components by IBM...
Fedora: Security Advisory (FEDORA-2025-c3c3774126)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian: Security Advisory (DLA-4151-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to a security bypass in Golang Go [CVE-2024-45337]
Summary IBM Watson Speech Services Cartridge is vulnerable to an authorization bypass in Golang Go, caused by applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback CVE-2024-45337. Golang Go is used by our Speech Service utilities...
[SECURITY] [DLA 4151-1] golang-github-gorilla-csrf security update
-------------------------------------------------------------------------- Debian LTS Advisory DLA-4151-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura May 01, 2025 https://wiki.debian.org/LTS -...
Debian dla-4151 : golang-github-gorilla-csrf-dev - security update
The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4151 advisory. - -------------------------------------------------------------------------- Debian LTS Advisory DLA-4151-1 [email protected] https://www.debian.org/lts/security...
