go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01989-1 advisory.

    golang-github-prometheus-prometheus was updated to version 2.53.4:

    - Security issues fixed:
      * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

    - Other bugs fixes from version 2.53.4:
      * Runtime: fixed GOGC being set to 0 when installed         with empty prometheus.yml file resulting high cpu usage
      * Scrape: fixed dropping valid metrics after previous         scrape failed

    prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

    - Security issues fixed:
      * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
      * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

    - Other changes from version 0.26.0:
      * Changes:
        - Replace go-kit/log with log/slog module.
      * Features:
        - Add metric to record tls ciphersuite negotiated during           handshake.
        - Add a way to export labels with content matched by the probe.
          Reports Certificate Serial number.
      * Enhancement:
        - Add stale workflow to start sync with stale.yaml in Prometheus.
      * Bug fixes:
        - Only register grpc TLS metrics on successful handshake.


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01991-1 advisory.

    grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

    - Security issues fixed:
        * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
        * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
        * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
        * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
        * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
        * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
        * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
        * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
        * CVE-2024-9264: SQL Expressions (bsc#1231844)
        * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
        * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

    - Potential breaking changes in version 11.5.0:
        * Loki: Default to /labels API with query param instead of /series API.
    - Potential breaking changes in version 11.0.1:
        * If you had selected your language as 'Portugu?s Brasileiro'         previously, this will be reset. You have to select it again in         your Preferences for the fix to be applied and the translations         will then be shown.
    - Potential breaking changes in version 11.0.0:
        * AngularJS support is turned off by default.
        * Legacy alerting is entirely removed.
        * Subfolders cause very rare issues with folders which have           slashes in their names.
        * The input data source is removed.
        * Data sources: Responses which are associated with hidden           queries will be removed (filtered) by Grafana.
        * The URL which is generated when viewing an individual repeated           panel has changed.
        * React Router is deprecated.
        * The grafana/e2e testing tool is deprecated.

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01987-1 advisory.

    golang-github-prometheus-prometheus was updated to version 2.53.4:

    - Security issues fixed:
      * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

    - Other bugs fixes from version 2.53.4:
      * Runtime: fixed GOGC being set to 0 when installed         with empty prometheus.yml file resulting high cpu usage
      * Scrape: fixed dropping valid metrics after previous         scrape failed

    prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

    - Security issues fixed:
      * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
      * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

    - Other changes from version 0.26.0:
      * Changes:
        - Replace go-kit/log with log/slog module.
      * Features:
        - Add metric to record tls ciphersuite negotiated during           handshake.
        - Add a way to export labels with content matched by the probe.
          Reports Certificate Serial number.
      * Enhancement:
        - Add stale workflow to start sync with stale.yaml in Prometheus.
      * Bug fixes:
        - Only register grpc TLS metrics on successful handshake.

    - Other changes from version 0.25.0:
      * Features:
        - Allow to get Probe logs by target.
        - Log errors from probe.
      * Bug fixes:
        - Prevent logging confusing error message.
        - Explicit registration of internal exporter metrics.

    grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

    - Security issues fixed:
      * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
      * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
      * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
      * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
      * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
      * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
      * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
      * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
      * CVE-2024-9264: SQL Expressions (bsc#1231844)
      * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
      * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

    - Potential breaking changes in version 11.5.0:
      * Loki: Default to /labels API with query param instead of /series API.

    - Potential breaking changes in version 11.0.1:
      * If you had selected your language as 'Portugu?s Brasileiro'         previously, this will be reset. You have to select it again in         your Preferences for the fix to be applied and the translations         will then be shown.

    - Potential breaking changes in version 11.0.0:
      * AngularJS support is turned off by default.
      * Legacy alerting is entirely removed.
      * Subfolders cause very rare issues with folders which have         slashes in their names.
      * The input data source is removed.
      * Data sources: Responses which are associated with hidden         queries will be removed (filtered) by Grafana.
      * The URL which is generated when viewing an individual repeated         panel has changed.
      * React Router is deprecated.
      * The grafana/e2e testing tool is deprecated.

    - This update brings many new features, enhancements and fixes highlighted at:
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
      * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

    golang-github-prometheus-node_exporter was updated to version 1.9.1:

    - Security issues fixed:
      * CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 300f86de-0e4d-11f0-ae40-b42e991fc52e advisory.

    security@golang.org reports:
    Matching of hosts against proxy patterns can improperly treat an             IPv6 zone ID as a hostname component.  For example, when the NO_PROXY             environment variable is set to *.example.com, a request             to [::1%25.example.com]:80` will incorrectly match and not             be proxied.
    go-redis is the official Redis client library for the Go programming             language.  Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially             responds out of order when `CLIENT SETINFO` times out during             connection establishment.  This can happen when the client is             configured to transmit its identity, there are network connectivity             issues, or the client was configured with aggressive timeouts.  The             problem occurs for multiple use cases.  For sticky connections, you             receive persistent out-of-order responses for the lifetime of the             connection.  All commands in the pipeline receive incorrect responses.
            When used with the default ConnPool once a connection is returned             after use with ConnPool#Put the read buffer will be checked and the             connection will be marked as bad due to the unread data.  This means             that at most one out-of-order response before the connection is             discarded.  This issue is fixed in 9.5.5, 9.6.3, and 9.7.3.  You             can prevent the vulnerability by setting the flag DisableIndentity             to true when constructing the client instance.
    golang-jwt is a Go implementation of JSON Web Tokens.  Prior to             5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a             call to strings.Split) its argument (which is untrusted data) on             periods.  As a result, in the face of a malicious request whose             Authorization header consists of Bearer followed by many period             characters, a call to that function incurs allocations to the tune             of O(n) bytes (where n stands for the length of the function's             argument), with a constant factor of about 16.  This issue is fixed             in 5.2.2 and 4.5.2.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
240840	SUSE SLES15 / openSUSE 15 Security Update : Multi-Linux Manager Client Tools (SUSE-SU-2025:01989-1)	Nessus	SuSE Local Security Checks	critical
240835	SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2025:01991-1)	Nessus	SuSE Local Security Checks	critical
240802	SUSE SLES12 Security Update : Multi-Linux Manager Client Tools (SUSE-SU-2025:01987-1)	Nessus	SuSE Local Security Checks	critical
233659	FreeBSD : gitea -- Multiple vulnerabilities (300f86de-0e4d-11f0-ae40-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2025-29923

low

Tenable Plugins

critical

critical

critical

medium