Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Parsing invalid messages can panic. Parsing a text-format message which contains a potential number     consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
    (CVE-2023-24535)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Parsing invalid messages can panic. Parsing a text-format message which contains a potential number
    consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
    (CVE-2023-24535)

The version of Google Protobuf module for Go is affected by a denial of service (DoS) vulnerability. Parsing invalid messages with a minus sign or whitespace can lead to a denial of service.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
252892	Linux Distros Unpatched Vulnerability : CVE-2023-24535	Nessus	Misc.	Local	high
415981	SCA: security update for google.golang.org/protobuf (GHSA-hw7c-3rfg-p46j)	Tenable Cloud Security	SCA Checks	Local	high
415981	SCA: security update for google.golang.org/protobuf (GHSA-hw7c-3rfg-p46j)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
174168	Google Protobuf Go Module 1.29 < 1.29.1 DoS	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2023-24535

high

Tenable Plugins

high

high

high

high