Fedora 44 : lego (2026-578a96e5f5)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-578a96e5f5 advisory. Update to 5.5.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Fedora 45 : lego (2026-9eaee019b6)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9eaee019b6 advisory. Update to 5.5.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

[SECURITY] Fedora 44 Update: lego-5.4.0-1.fc44

Let's Encrypt/ACME client written in Go...

[SECURITY] Fedora 43 Update: lego-5.4.0-1.fc43

Let's Encrypt/ACME client written in Go...

Fedora 44 : lego (2026-801a29e61d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-801a29e61d advisory. Update to 5.4.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 43 : lego (2026-3dea695305)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3dea695305 advisory. Update to 5.4.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...

[SECURITY] Fedora 43 Update: lego-5.3.1-2.fc43

Let's Encrypt/ACME client written in Go...

Fedora 43 : lego (2026-256592dfe7)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-256592dfe7 advisory. Update to 5.3.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

[SECURITY] Fedora 44 Update: lego-5.3.1-2.fc44

Let's Encrypt/ACME client written in Go...

Fedora 44 : lego (2026-30e8e9a2b2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-30e8e9a2b2 advisory. Update to 5.3.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

GO-2026-5593 ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego...

CVE-2026-48614

A flaw was found in Plesk. An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives. This can result in arbitrary file write as root, leading to full privilege escalation on the underlying server. Mitigation Red Hat...

Arbitrary File Write And Deletion

github.com/go-acme/lego is vulnerable to arbitrary file write and deletion. The vulnerability is due to improper validation of the HTTP-01 challenge token in the webroot challenge provider, which allows a malicious ACME server to supply crafted ../ path traversal sequences and write or delete fil...

CVE-2026-40611

A flaw was found in lego, the Let's Encrypt client and ACME library written in Go. A malicious ACME Automated Certificate Management Environment server can exploit a path traversal vulnerability in the webroot HTTP-01 challenge provider. By supplying a specially crafted challenge token containing...

SUSE CVE-2026-40611

Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to...

Linux Distros Unpatched Vulnerability : CVE-2026-40611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write...

CVE-2026-40611

Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to...

DEBIAN-CVE-2026-40611

Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to...

UBUNTU-CVE-2026-40611

Let's Encrypt client and ACME library written in Go Lego. Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to...