リモートの Fedora 44 ホストには、FEDORA-2026-ad8394dc92 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    1.169.0 に更新してください

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Fedora 45 ホストには、FEDORA-2026-a205d8bdfd のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

    1.169.0 に更新してください

Tenable は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad8394dc92 advisory.

    Update to 1.169.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.19.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2026-142 advisory.

    A custom client can produce such an upload request to the BuildKit daemon that files can escape from the     BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit     control API to issue builds, e.g., bypass authentication, etc. (CVE-2026-15789)

    A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp     directory. The action that can normally be used to delete files inside the build container rootfs can     escape into the real host temp directory. (CVE-2026-15791)

    A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing     with a panic. (CVE-2026-15792)

    BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when     checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation     on the host. (CVE-2026-15793)

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the     ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive     can create or overwrite files outside the intended destination. (CVE-2026-17106)

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would     deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled     explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of     buffering and blocking. (CVE-2026-56855)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a     crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode     without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for     the build container even though Linux capabilities remained restricted. This issue is fixed in version     0.31.1. (CVE-2026-61711)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files     without an upper bound while resolving a username to a user identifier or group identifier in     executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide     oversized files that exhausted memory during user resolution and caused out-of-memory termination of the     buildkitd process. This issue is fixed in version 0.31.1. (CVE-2026-61712)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit     daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid     permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is     fixed in version 0.31.2. (CVE-2026-75593)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious     peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an     atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every     packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3140 advisory.

    A custom client can produce such an upload request to the BuildKit daemon that files can escape from the     BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit     control API to issue builds, e.g., bypass authentication, etc. (CVE-2026-15789)

    A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp     directory. The action that can normally be used to delete files inside the build container rootfs can     escape into the real host temp directory. (CVE-2026-15791)

    A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing     with a panic. (CVE-2026-15792)

    BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true when     checking out Git sources. If the Git source is malicious, this could lead to a crafted command invocation     on the host. (CVE-2026-15793)

    The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the     ApplyLayer helpers) do not confine filesystem operations to the destination directory. A crafted archive     can create or overwrite files outside the intended destination. (CVE-2026-17106)

    Memory exhaustion DoS causing OOM kill of containerd process

    NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq (CVE-2026-47262)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would     deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled     explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of     buffering and blocking. (CVE-2026-56855)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.1, a custom frontend could place an invalid SecurityMode value in a     crafted build request, and executor/oci/spec_linux.go treated the unsupported value as a non-sandbox mode     without requiring the security.insecure entitlement. This disabled Seccomp and AppArmor protections for     the build container even though Linux capabilities remained restricted. This issue is fixed in version     0.31.1. (CVE-2026-61711)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files     without an upper bound while resolving a username to a user identifier or group identifier in     executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide     oversized files that exhausted memory during user resolution and caused out-of-memory termination of the     buildkitd process. This issue is fixed in version 0.31.1. (CVE-2026-61712)

    BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and     repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit     daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid     permissions to access BuildKit control API to issue builds, eg., bypass authentication, etc. This issue is     fixed in version 0.31.2. (CVE-2026-75593)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious     peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an     atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every     packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a205d8bdfd advisory.

    Update to 1.169.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
348335	Fedora 44:doctl(2026-ad8394dc92)	Nessus	Fedora Local Security Checks	2026/9/20	2026/9/20	medium
349778	Fedora 45:doctl(2026-a205d8bdfd)	Nessus	Fedora Local Security Checks	2026/9/24	2026/9/24	medium
348335	Fedora 44 : doctl (2026-ad8394dc92)	Nessus	Fedora Local Security Checks	2026/9/20	2026/9/20	medium
351054	Amazon Linux 2 : runfinch-finch (ALASDOCKER-2026-142)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/9/29	high
351079	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-3140)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/9/29	high
349778	Fedora 45 : doctl (2026-a205d8bdfd)	Nessus	Fedora Local Security Checks	2026/9/24	2026/9/24	medium

偵測

搜尋 Plugin

medium

medium

medium

high

high

medium