The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2830-1 advisory.

  - A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call     memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service     after authentication in rare circumstances. (CVE-2021-4209)

  - A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call     memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service     after authentication in rare circumstances. (CVE-2021-4209)

  - A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during     verification of pkcs7 signatures in gnutls_pkcs7_verify function. (CVE-2022-2509)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the gnutls package has been released.

遠端主機上安裝的 gnutls 版本低於 3.7.7。因此，它受到 SSA:2022-210-01 公告中提及的一個弱點影響。

  - 在 gnutls 中發現一個弱點。造成此安全問題的原因在於，在 gnutls_pkcs7_verify 函式中驗證 pkcs7 簽章期間會發生重複釋放錯誤。(CVE-2022-2509)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 11 主機上安裝的多個套件受到 dsa-5203 公告中提及的一個弱點影響。

  - 在 gnutls 中發現一個弱點。造成此安全問題的原因在於，在 gnutls_pkcs7_verify 函式中驗證 pkcs7 簽章期間會發生重複釋放錯誤。(CVE-2022-2509)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Oracle Linux 9 主機上安裝的套件受到 ELSA-2022-6854 公告中提及的一個弱點影響。

  - 在 gnutls 中發現一個弱點。造成此安全問題的原因在於，在 gnutls_pkcs7_verify 函式中驗證 pkcs7 簽章期間會發生重複釋放錯誤。(CVE-2022-2509)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的多個套件受到 RHSA-2022: 7105 公告中提及的一個弱點影響。

  - gnutls：gnutls_pkcs7_verify 期間會發生重複釋放 (CVE-2022-2509)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名稱	產品	系列	已發布	已更新	嚴重性
164265	SUSE SLES15 Security Update : gnutls (SUSE-SU-2022:2830-1)	Nessus	SuSE Local Security Checks	2022/8/18	2023/7/14	high
166862	EulerOS 2.0 SP10 : gnutls (EulerOS-SA-2022-2650)	Nessus	Huawei Local Security Checks	2022/11/2	2022/11/30	high
203875	Photon OS 3.0: Gnutls PHSA-2022-3.0-0445	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
163635	Slackware Linux 15.0 / 最新 gnutls 弱點 (SSA:2022-210-01)	Nessus	Slackware Local Security Checks	2022/7/29	2023/3/21	high
163927	Debian DSA-5203-1：gnutls28 - 安全性更新	Nessus	Debian Local Security Checks	2022/8/9	2022/12/7	high
166051	Oracle Linux 9：gnutls / 和 / nettle (ELSA-2022-6854)	Nessus	Oracle Linux Local Security Checks	2022/10/12	2022/12/1	high
166479	RHEL 8：gnutls (RHSA-2022: 7105)	Nessus	Red Hat Local Security Checks	2022/10/25	2024/4/28	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high