A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases. It's worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn't been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6ef99deed4 advisory.

    Automatic update for asnmap-1.1.1-1.fc43.

    ##### **Changelog**

    ```
    * Mon Jul 14 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 1.1.1-1
    - Update to 1.1.1 and adopt Go Vendor Tools - Closes rhbz#2360621       rhbz#2360582 rhbz#2359392 rhbz#2352135 rhbz#2339903 rhbz#2333242       rhbz#2267159
    * Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.6-6
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4af86bb0f8 advisory.

    Automatic update for dnsx-1.2.2-1.fc43.

    ##### **Changelog**

    ```
    * Sun Jul 13 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 1.2.2-1
    - Update to 1.2.2 and adopt Go Vendor Tools - Closes rhbz#2360631       rhbz#2360591 rhbz#2359393 rhbz#2352157 rhbz#2340086 rhbz#2333247       rhbz#2267855
    * Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.6-6
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ae934d102c advisory.

    Automatic update for golang-github-projectdiscovery-mapcidr-1.1.94-1.fc43.

    ##### **Changelog**

    ```
    * Sun Jul 13 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 1.1.94-1
    - Update to 1.1.94 and adopt Go Vendor Tools - Closes rhbz#2247447       rhbz#2333252 rhbz#2340458 rhbz#2352242 rhbz#2359396rhbz#2360599       rhbz#2360639
    * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.13-6
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a6574c5095 advisory.

    Automatic update for golang-github-projectdiscovery-chaos-client-0.5.2-1.fc43.

    ##### **Changelog**

    ```
    * Sun Jul 13 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.5.2-1
    - Update to 0.5.2 and adopt Go Vendor Tools - Closes rhbz#2360638       rhbz#2360598 rhbz#2359395 rhbz#2352241 rhbz#2340453 rhbz#2333251       rhbz#2180343
    * Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 0.5.0-7
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242078	Fedora 43 : asnmap (2025-6ef99deed4)	Nessus	Fedora Local Security Checks	high
242047	Fedora 43 : dnsx (2025-4af86bb0f8)	Nessus	Fedora Local Security Checks	high
242046	Fedora 43 : golang-github-projectdiscovery-mapcidr (2025-ae934d102c)	Nessus	Fedora Local Security Checks	high
242045	Fedora 43 : golang-github-projectdiscovery-chaos-client (2025-a6574c5095)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2025-3445

high

Tenable Plugins

high

high

high

high