The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8327 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
    * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5790 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5790-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 13, 2024                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : node-dompurify     CVE ID         : CVE-2024-47875

    It was discovered that DOMPurify, a sanitizer for HTML, MathML and SVG was     susceptible to nesting-based mXSS.

    For the stable distribution (bookworm), this problem has been fixed in     version 2.4.1+dfsg+~2.4.0-2.

    We recommend that you upgrade your node-dompurify packages.

    For the detailed security status of node-dompurify please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-dompurify

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

リモートの Debian 12 ホストには、dsa-5790 のアドバイザリに記載された脆弱性の影響を受けるパッケージがインストールされています。

    - ------------------------------------------------------------------------- Debian セキュリティアドバイザリ DSA-5790-1 security@debian.org https://www.debian.org/security/Moritz Muehlenhoff 2024 年 10 月 13 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    パッケージ : node-dompurify CVE ID : CVE-2024-47875

    HTML、MathML および SVG 用のサニタイザーである DOMPurify がネストベースの mXSS の影響を受けやすいことが判明しました。

    安定版 (stable) ディストリビューション (bookworm) では、これらの問題はバージョン 2.4.1+dfsg+~2.4.0-2 で修正されています。

    お使いの node-dompurify パッケージをアップグレードすることを推奨します。

    node-dompurify の詳細なセキュリティステータスについては、そのセキュリティトラッカーページを参照してください。
    https://security-tracker.debian.org/tracker/node-dompurify

    Debian セキュリティアドバイザリに関する詳細、これらの更新をシステムに適用する方法、およびよくある質問については、こちらを参照してください。https://www.debian.org/security/

    メーリングリスト: debian-security-announce@lists.debian.org

Tenable は、前述の説明ブロックを Debian セキュリティアドバイザリから直接抽出しました。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端 Debian 12 主機上安裝的一個套件受到 dsa-5790 公告中提及的一個弱點影響。

    - ------------------------------------------------------------------------- Debian 安全公告 DSA-5790-1 security@debian.org https://www.debian.org/security/Moritz Muehlenhoff 2024 年 10 月 13 日https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    套件：node-dompurify CVE ID：CVE-2024-47875

    據發現，DOMPurify (一種適用於 HTML、MathML 和 SVG 的清理程式) 容受巢狀型 mXSS 影響。

    針對穩定的發行版本 (bookworm)，已在 2.4.1+dfsg+~2.4.0-2 版本中修正此問題。

    建議您升級 node-dompurify 套件。

    如需有關 node-dompurify 安全性狀態的詳細資訊，請參閱其安全追蹤頁面：
    https://security-tracker.debian.org/tracker/node-dompurify

    有關 Debian 安全公告、如何將這些更新套用至您的系統以及常見問題的詳細資訊，請參閱：https://www.debian.org/security/

    郵寄清單：debian-security-announce@lists.debian.org

Tenable 已直接從 Debian 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Debian 12 主机上安装的一个程序包受到 dsa-5790 公告中提及的一个漏洞影响。

    - ------------------------------------------------------------------------- Debian 安全公告 DSA-5790-1 security@debian.org https://www.debian.org/security/Moritz Muehlenhoff 2024 年 10 月 13 日 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    程序包：node-dompurify CVE ID：CVE-2024-47875

    据发现，适用于 HTML、MathML 和 SVG 的审查器 DOMPurify 容易受到嵌套型 mXSS 的影响。

    对于稳定发行版本 (bookworm)，已在版本 2.4.1+dfsg+~2.4.0-2 中修复此问题。

    我们建议您升级 node-dompurify 程序包。

    如需了解 node-dompurify 的详细安全状态，请参阅其安全跟踪页面：
    https://security-tracker.debian.org/tracker/node-dompurify

    有关 Debian 安全公告、如何将这些更新应用到系统以及常见问题解答的更多信息，请访问以下网址：https://www.debian.org/security/

    邮件列表：debian-security-announce@lists.debian.org

Tenable 已直接从 Debian 安全公告中提取上述描述块。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8327 advisory.

    Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &     OpenTSDB.

    Security Fix(es):

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8327 advisory.

    - Resolves RHEL-62307: CVE-2024-47875

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8327 advisory.

    * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

    * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
209563	AlmaLinux 8 : grafana (ALSA-2024:8327)	Nessus	Alma Linux Local Security Checks	2024/10/23	2024/10/23	medium
208927	Debian dsa-5790 : node-dompurify - security update	Nessus	Debian Local Security Checks	2024/10/13	2024/10/13	critical
208927	Debian dsa-5790 : node-dompurify - セキュリティ更新	Nessus	Debian Local Security Checks	2024/10/13	2024/10/13	critical
208927	Debian dsa-5790：node-dompurify - 安全性更新	Nessus	Debian Local Security Checks	2024/10/13	2024/10/13	critical
208927	Debian dsa-5790：node-dompurify - 安全更新	Nessus	Debian Local Security Checks	2024/10/13	2024/10/13	critical
209522	RHEL 8 : grafana (RHSA-2024:8327)	Nessus	Red Hat Local Security Checks	2024/10/22	2024/10/22	medium
209540	Oracle Linux 8 : grafana (ELSA-2024-8327)	Nessus	Oracle Linux Local Security Checks	2024/10/23	2024/10/23	medium
209691	RockyLinux 8 : grafana (RLSA-2024:8327)	Nessus	Rocky Linux Local Security Checks	2024/10/25	2024/10/25	medium

偵測

搜尋 Plugin

medium

critical

critical

critical

critical

medium

medium

medium