In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-2408b72979 advisory.

    Rebase trustee-guest-components to v0.13.0     Include rust-az-???-vtpm packages rebase to version 0.7.4     Adjust (patches) to work with 'sev' version 6.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-df23dd806a advisory.

    Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-369dc8a50e advisory.

    Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-ff79e403f1 advisory.

    Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which     could, in some circumstances, lead to a double-free that could result in memory corruption.
    (CVE-2025-4574)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-165ec5fe3b advisory.

    Automatic update for python-watchfiles-1.0.5-3.fc43.

    ##### **Changelog**

    ```
    * Thu May 15 2025 Benjamin A. Beasley <code@musicinmybrain.net> - 1.0.5-3
    - Security fix for CVE-2025-4574 (fix RHBZ#2366569)
    - The package was rebuilt with rust-crossbeam-channel 0.5.15.

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of azl-compliance / kata-containers / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4574 advisory.

  - In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which     could, in some circumstances, lead to a double-free that could result in memory corruption.
    (CVE-2025-4574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of azl-compliance / kata-containers / rust installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-4574 advisory.

  - In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which     could, in some circumstances, lead to a double-free that could result in memory corruption.
    (CVE-2025-4574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-297c7ac7fe advisory.

    Rebuild applications to apply two recent security updates:

    - build with idna 1.0.0+ to address CVE-2024-12224 (idna accepts Punycode labels that do not produce any     non-ASCII when decoded)
    - build with crossbeam-channel 0.5.15+ to address CVE-2025-4574 (potential double-free on Drop)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-8a18a5a077 advisory.

    Rebuild applications to apply two recent security updates:

    - build with idna 1.0.0+ to address CVE-2024-12224 (idna accepts Punycode labels that do not produce any     non-ASCII when decoded)
    - build with crossbeam-channel 0.5.15+ to address CVE-2025-4574 (potential double-free on Drop)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-da9b58be96 advisory.

    Rebuild for CVE-2024-12224, CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-26640e9e35 advisory.

    Rebuild for CVE-2024-12224, CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-9f8cbb5e03 advisory.

    Rebuild applications to apply two recent security updates:

    - build with idna 1.0.0+ to address CVE-2024-12224 (idna accepts Punycode labels that do not produce any     non-ASCII when decoded)
    - build with crossbeam-channel 0.5.15+ to address CVE-2025-4574 (potential double-free on Drop)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-04894ce9bd advisory.

    Security update for CVE-2025-4574, GHSA-pg9f-39pc-qf8g: by rebuilding `ruff`, we ensure that it uses     version 0.5.15 of the `crossbeam-channel` crate library.

    -----

    ## `rust-hashlink` 0.10.0

    - API incompatible change: upgrade `hashbrown` to 0.15
    - API incompatible change: we now wrap `DefaultHashBuilder` and `DefaultHasher`       from `hashbrown` so that in the future upgrading `hashbrown` is not an API       incompatible change

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7227c166f0 advisory.

    Update to version 1.8.6.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-4fc3431dab advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-c53905e83d advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3b4c75f23c advisory.

    Automatic update for rust-git-interactive-rebase-tool-2.4.1-9.fc43.

    ##### **Changelog**

    ```
    * Sun Jun  8 2025 Benjamin Gilbert <bgilbert@backtick.net> - 2.4.1-9
    - Rebuild for CVE-2024-12224, CVE-2025-4574 (rhbz#2370599, rhbz#2366573)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-57f7169b9d advisory.

    This release includes improvements and fixes, and updates crossbeam-channel dependency to address     CVE-2025-4574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-575023fff7 advisory.

    Security update for CVE-2025-4574, GHSA-pg9f-39pc-qf8g: by rebuilding `ruff`, we ensure that it uses     version 0.5.15 of the `crossbeam-channel` crate library.

    -----

    ## `rust-hashlink` 0.10.0

    - API incompatible change: upgrade `hashbrown` to 0.15
    - API incompatible change: we now wrap `DefaultHashBuilder` and `DefaultHasher`       from `hashbrown` so that in the future upgrading `hashbrown` is not an API       incompatible change

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-fb7b9c7c48 advisory.

    Update to version 1.8.6.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e5d435516f advisory.

    Security fix for CVE-2025-4574 (fix RHBZ#2366569)

    The package was rebuilt with rust-crossbeam-channel 0.5.15.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01591-1 advisory.

    - CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` when `Some(...)` value passed     as       `properties` argument to either function (bsc#1242631).
    - CVE-2025-4574: crossbeam-channel: double-free leading to possible memory corruption in `Channel::drop`     when dropping       a channel (bsc#1243177).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265937	Fedora 42 : rust-az-cvm-vtpm / rust-az-snp-vtpm / rust-az-tdx-vtpm / etc (2025-2408b72979)	Nessus	Fedora Local Security Checks	high
264648	Fedora 43 : tuigreet (2025-df23dd806a)	Nessus	Fedora Local Security Checks	low
264528	Fedora 42 : tuigreet (2025-369dc8a50e)	Nessus	Fedora Local Security Checks	low
264526	Fedora 41 : tuigreet (2025-ff79e403f1)	Nessus	Fedora Local Security Checks	low
252439	Linux Distros Unpatched Vulnerability : CVE-2025-4574	Nessus	Misc.	medium
249158	Fedora 43 : python-watchfiles (2025-165ec5fe3b)	Nessus	Fedora Local Security Checks	medium
241866	CBL Mariner 2.0 Security Update: azl-compliance / kata-containers / rust (CVE-2025-4574)	Nessus	MarinerOS Local Security Checks	medium
241836	Azure Linux 3.0 Security Update: azl-compliance / kata-containers / rust (CVE-2025-4574)	Nessus	Azure Linux Local Security Checks	medium
240528	Fedora 41 : atuin / awatcher / gotify-desktop / keylime-agent-rust / etc (2025-297c7ac7fe)	Nessus	Fedora Local Security Checks	medium
240524	Fedora 42 : atuin / awatcher / gotify-desktop / mirrorlist-server (2025-8a18a5a077)	Nessus	Fedora Local Security Checks	medium
240168	Fedora 42 : rust-git-interactive-rebase-tool (2025-da9b58be96)	Nessus	Fedora Local Security Checks	medium
240090	Fedora 41 : rust-git-interactive-rebase-tool (2025-26640e9e35)	Nessus	Fedora Local Security Checks	medium
238503	Fedora 43 : atuin / awatcher / gotify-desktop / mirrorlist-server (2025-9f8cbb5e03)	Nessus	Fedora Local Security Checks	medium
238467	Fedora 42 : ruff / rust-hashlink / rust-rusqlite (2025-04894ce9bd)	Nessus	Fedora Local Security Checks	medium
238456	Fedora 42 : maturin (2025-7227c166f0)	Nessus	Fedora Local Security Checks	medium
238450	Fedora 42 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-4fc3431dab)	Nessus	Fedora Local Security Checks	medium
238447	Fedora 41 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-c53905e83d)	Nessus	Fedora Local Security Checks	medium
237942	Fedora 43 : rust-git-interactive-rebase-tool (2025-3b4c75f23c)	Nessus	Fedora Local Security Checks	medium
237873	Fedora 43 : libkrun / rust-kbs-types / rust-sev / rust-sevctl (2025-57f7169b9d)	Nessus	Fedora Local Security Checks	medium
237560	Fedora 41 : ruff / rust-hashlink / rust-rusqlite (2025-575023fff7)	Nessus	Fedora Local Security Checks	medium
237526	Fedora 41 : maturin (2025-fb7b9c7c48)	Nessus	Fedora Local Security Checks	medium
237169	Fedora 41 : python-watchfiles (2025-e5d435516f)	Nessus	Fedora Local Security Checks	medium
237080	openSUSE 15 Security Update : python-maturin (SUSE-SU-2025:01591-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-4574

medium

Tenable Plugins

high

low

low

low

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium