The version of ecs-service-connect-agent installed on the remote host is prior to v1.26.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-006 advisory.

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions     1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with     permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC     payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and     1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's     domain configuration. (CVE-2023-35941)

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions     1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause     a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and     1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update.
    (CVE-2023-35942)

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions     1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the     `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0,     1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the     `origin` header in the Envoy configuration. (CVE-2023-35943)

    Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-     case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0,     1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes     such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections.
    With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme     values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive.
    There are no known workarounds for this issue. (CVE-2023-35944)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header     map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames     from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame     skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code     path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The     clean-up code is right after the return statement, causing memory leak. Denial of service through memory     exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
    (CVE-2023-35945)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Siemens SINEC NMS installed on the remote host is prior to 2.0.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA-943925 advisory.

  - coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type     request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload,     aka Content-Type confusion between the WAF and the backend application. This occurs when the web     application relies on only the last Content-Type header. Other platforms may reject the additional     Content-Type header or merge conflicting headers, leading to detection as a malformed header.
    (CVE-2023-38199)

  - Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request     Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of     RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied     request-target (URL) data and is then re-inserted into the proxied request-target using variable     substitution. For example, something like: RewriteEngine on RewriteRule ^/here/(.*)     http://example.com:8080/elsewhere?$1; [P] ProxyPassReverse /here/ http://example.com:8080/ Request     splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended     URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version     2.4.56 of Apache HTTP Server. (CVE-2023-25690)

  - The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json     definition for a given module. This vulnerability affects all users using the experimental policy     mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was     issued, the policy is an experimental feature of Node.js. (CVE-2023-32002)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header     map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames     from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame     skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code     path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The     clean-up code is right after the return statement, causing memory leak. Denial of service through memory     exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
    (CVE-2023-35945)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header     map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames     from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame     skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code     path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The     clean-up code is right after the return statement, causing memory leak. Denial of service through memory     exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.
    (CVE-2023-35945)

  - The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation     can reset many streams quickly, as exploited in the wild in August through October 2023. (CVE-2023-44487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
180563	Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-006)	Nessus	Amazon Linux Local Security Checks	2023/9/6	2024/12/11	critical
191429	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	Nessus	Windows	2024/2/29	2024/10/7	critical
188791	EulerOS Virtualization 2.9.0 : nghttp2 (EulerOS-SA-2024-1019)	Nessus	Huawei Local Security Checks	2024/1/16	2024/2/9	high
188925	EulerOS 2.0 SP9 : nghttp2 (EulerOS-SA-2023-3314)	Nessus	Huawei Local Security Checks	2024/1/16	2024/2/9	high

偵測

搜尋 Plugin

critical

critical

high

high