qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp file.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-dacf699829 advisory.

    Security fix for CVE-2022-45866

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-9172acadf8 advisory.

    Automatic update for qpress-20220819-1.fc38.

    ##### **Changelog**

    ```
    * Fri Nov 25 2022 Davide Cavalca <dcavalca@fedoraproject.org> 20220819-1
    - Switch to new upstream and update to 20220819 (Fixes: RHBZ#2147535,       RHBZ#2147537)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2f38c6a2-04a4-11ee-8cb0-e41f13b9c674 advisory.

  - qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other     products, allows directory traversal via ../ in a .qp file. (CVE-2022-45866)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-0ff8149aad advisory.

    Security fix for CVE-2022-45866

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e19ca639ef advisory.

    Security fix for CVE-2022-45866

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211150	Fedora 37 : qpress (2022-dacf699829)	Nessus	Fedora Local Security Checks	medium
211011	Fedora 38 : qpress (2022-9172acadf8)	Nessus	Fedora Local Security Checks	medium
176757	FreeBSD : qpress -- directory traversal (2f38c6a2-04a4-11ee-8cb0-e41f13b9c674)	Nessus	FreeBSD Local Security Checks	medium
169195	Fedora 35 : qpress (2022-0ff8149aad)	Nessus	Fedora Local Security Checks	medium
169025	Fedora 36 : qpress (2022-e19ca639ef)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-45866

medium

Tenable Plugins

medium

medium

medium

medium

medium