The remote NewStart CGSL host, running version MAIN 7.02, has grub2 packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses     user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it     improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer     size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than     expected. As a result, the direct_read() will perform a heap based out-of-bounds write during data     reading. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary     code execution, by-passing secure boot protections. (CVE-2025-0678)

  - A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
    (CVE-2024-1048)

  - A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an     uncontrolled loop, causing grub2 to crash. (CVE-2024-45778)

  - An integer overflow flaw was found in the BFS file system driver in grub2. When reading a file with an     indirect extent map, grub2 fails to validate the number of extent entries to be read. A crafted or     corrupted BFS filesystem may cause an integer overflow during the file reading, leading to a heap of     bounds read. As a consequence, sensitive data may be leaked, or grub2 will crash. (CVE-2024-45779)

  - A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS     filesystem driver performs a strcpy() using the user-provided volume name as input without properly     validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting     grub's sensitive data integrity and eventually leading to a secure boot protection bypass.
    (CVE-2024-45782)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.10 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c1fabee30e advisory.

    Security fix for CVE-2024-1048



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
    (CVE-2024-1048)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or     blocks.(CVE-2024-1048)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization grub2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or     blocks.(CVE-2024-1048)

Tenable has extracted the preceding description block directly from the EulerOS grub2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.5 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be     affected: 8.5.0 though 8.5.100. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90,     which fixes the issue. (CVE-2024-34750)

  - A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in     NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as     libndp was not correctly validating the route length information. (CVE-2024-5564)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the grub2 package has been released.

ID	名稱	產品	系列	已發布	已更新	嚴重性
242813	NewStart CGSL MAIN 7.02 : grub2 Multiple Vulnerabilities (NS-SA-2025-0169)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	high
208234	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.10)	Nessus	Misc.	2024/10/7	2025/9/1	high
192326	Fedora 38 : grub2 (2024-c1fabee30e)	Nessus	Fedora Local Security Checks	2024/3/20	2024/11/14	low
195265	EulerOS 2.0 SP10 : grub2 (EulerOS-SA-2024-1591)	Nessus	Huawei Local Security Checks	2024/5/9	2024/5/9	low
198088	EulerOS Virtualization 2.11.0 : grub2 (EulerOS-SA-2024-1726)	Nessus	Huawei Local Security Checks	2024/5/29	2024/5/29	low
202535	EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2024-1935)	Nessus	Huawei Local Security Checks	2024/7/16	2024/7/16	low
202670	EulerOS Virtualization 2.10.1 : grub2 (EulerOS-SA-2024-2001)	Nessus	Huawei Local Security Checks	2024/7/18	2024/7/18	low
202950	EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2024-2033)	Nessus	Huawei Local Security Checks	2024/7/22	2024/7/22	low
206720	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.5)	Nessus	Misc.	2024/9/6	2025/9/1	high
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	2024/12/6	2025/9/1	medium
261147	Photon OS 4.0: Grub2 PHSA-2025-4.0-0861	Nessus	PhotonOS Local Security Checks	2025/9/3	2025/9/3	high
261150	Photon OS 5.0: Grub2 PHSA-2024-5.0-0241	Nessus	PhotonOS Local Security Checks	2025/9/3	2025/9/3	low

偵測

搜尋 Plugin

high

high

low

low

low

low

low

low

high

medium

high

low