SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20080-1 advisory.

    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed non validated message size causing a panic due to     an out       of bounds read (bsc#1254054)
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving an     unexpected       message type in response to a key listing or signing request (bsc#1253598)
    - CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed container breakouts by bypassing runc's restrictions     for writing to arbitrary /proc       files (bsc#1253096)

    Other fixes:

    - Updated to version 1.39.5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-094 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a     single-line payload larger than 64KB without newline characters. Due to limitations in the internal     bufio.Scanner, the read fails with token too long and the writer pipe is closed, leaving Writer()     unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2.
    The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to     function even if an error is logged. (CVE-2025-65637)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fb561db9-0fc1-4d92-81a2-ee01839c9119 advisory.

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption.
    A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a     certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not     restrict the usage of wildcard SANs in the leaf certificate.
    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read.
    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-openSUSE-RU-2026:20010-1 advisory.

    - Update to version 0.68.2:
      * release: v0.68.2 [release/v0.68] (#9950)
      * fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)
      * ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0067-1 advisory.

    - CVE-2025-47914: Fixed ssh-agent that could cause a panic due to an       out-of-bounds read with non validated message size (bsc#1253993)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1336 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect     (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split)     its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an     (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL     incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument),     with a constant factor of about 16. This vulnerability is fixed in 1.8.3. (CVE-2025-66506)

    Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function     api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is     untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which     is also untrusted data) on an application string. As a result, in the face of a malicious request with     either an excessively long OID in the payload containing many period characters or a malformed Content-     Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where     n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
    (CVE-2025-66564)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1358 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin     functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal     over user-provided data structures without enforcing a maximum recursion depth. If the evaluation     environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely     until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host     application to crash. While exploitability depends on whether an attacker can influence or inject cyclic     or pathologically deep data into theevaluation environment, this behavior represents a denial-of-service     (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error,     the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke     certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-     level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to     evaluate expressions against externally supplied or dynamically constructed environments; cyclic     references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no     application-level safeguards preventing deeply nested input data. In typical use cases with controlled,     acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to     reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7     versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions.
    When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of     panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing     applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly     encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive     test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are     recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize     externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with     panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds     reduce risk but do not fully eliminate the issue without the patch. (CVE-2025-68156)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0014-1 advisory.

    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated       message size (bsc#1254054)
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving       an unexpected message type in response to a key listing or signing request (bsc#1253598)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300062.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3120 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin     functions in Expr, including `flatten`, `min`, `max`, `mean`, and `median`, perform recursive traversal     over user-provided data structures without enforcing a maximum recursion depth. If the evaluation     environment contains deeply nested or cyclic data structures, these functions may recurse indefinitely     until exceed the Go runtime stack limit. This results in a stack overflow panic, causing the host     application to crash. While exploitability depends on whether an attacker can influence or inject cyclic     or pathologically deep data into theevaluation environment, this behavior represents a denial-of-service     (DoS) risk and affects overall library robustness. Instead of returning a recoverable evaluation error,     the process may terminate unexpectedly. In affected versions, evaluation of expressions that invoke     certain builtin functions on untrusted or insufficiently validated data structures can lead to a process-     level crash due to stack exhaustion. This issue is most relevant in scenarios where Expr is used to     evaluate expressions against externally supplied or dynamically constructed environments; cyclic     references (directly or indirectly) can be introduced into arrays, maps, or structs; and there are no     application-level safeguards preventing deeply nested input data. In typical use cases with controlled,     acyclic data, the issue may not manifest. However, when present, the resulting panic can be used to     reliably crash the application, constituting a denial of service. The issue has been fixed in the v1.17.7     versions of Expr. The patch introduces a maximum recursion depth limit for affected builtin functions.
    When this limit is exceeded, evaluation aborts gracefully and returns a descriptive error instead of     panicking. Additionally, the maximum depth can be customized by users via `builtin.MaxDepth`, allowing     applications with legitimate deep structures to raise the limit in a controlled manner. Users are strongly     encouraged to upgrade to the patched release, which includes both the recursion guard and comprehensive     test coverage to prevent regressions. For users who cannot immediately upgrade, some mitigations are     recommended. Ensure that evaluation environments cannot contain cyclic references, validate or sanitize     externally supplied data structures before passing them to Expr, and/or wrap expression evaluation with     panic recovery to prevent a full process crash (as a last-resort defensive measure). These workarounds     reduce risk but do not fully eliminate the issue without the patch. (CVE-2025-68156)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-093 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-091 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-090 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runfinch-finch installed on the remote host is prior to 1.10.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-092 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

    Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect     (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split)     its argument (which is untrusted data) on periods. As a result, in the face of a malicious request with an     (invalid) OIDC identity token in the payload containing many period characters, a call to extractIssuerURL     incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument),     with a constant factor of about 16. This vulnerability is fixed in 1.8.3. (CVE-2025-66506)

    Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function     api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is     untrusted data) on periods. Similarly, function api.getContentType splits the Content-Type header (which     is also untrusted data) on an application string. As a result, in the face of a malicious request with     either an excessively long OID in the payload containing many period characters or a malformed Content-     Type header, a call to api.ParseJSONRequest or api.getContentType incurs allocations of O(n) bytes (where     n stands for the length of the function's argument). This vulnerability is fixed in 2.0.3.
    (CVE-2025-66564)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-083 advisory.

    SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

    SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in     the request, allowing an attacker to cause unbounded memory consumption. (CVE-2025-58181)

    crypto/x509: excluded subdomain constraint does not restrict wildcard SANs

    An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in     the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not     prevent a leaf certificate from claiming the SAN *.example.com. (CVE-2025-61727)

    Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts     that will be printed out. Furthermore, the error string is constructed by repeated string concatenation,     leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in     excessive resource consumption. (CVE-2025-61729)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4526-1 advisory.

    - CVE-2025-47914: golang.org/x/crypto/ssh/agent: Fixed out of bounds read caused by non validated       message size (bsc#1254054)
    - CVE-2025-47913: golang.org/x/crypto/ssh/agent: Fixed client process termination when receiving       an unexpected message type in response to a key listing or signing request (bsc#1253598)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:20177-1 advisory.

    - Security:
      * CVE-2025-47913: Fix client process termination (bsc#1253593)
      * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922)
      * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051)
      * Replace golang.org/x/crypto=golang.org/x/crypto@v0.45.0
      * Replace golang.org/x/net=golang.org/x/net@v0.47.0
      * Replace golang.org/x/sys=golang.org/x/sys@v0.38.0

    - Packaging improvements:
      * Drop Requires: golang-packaging. The recommended Go toolchain         dependency expression is BuildRequires: golang(API) >= 1.x or         optionally the metapackage BuildRequires: go
      * Use BuildRequires: golang(API) >= 1.19 matching go.mod
      * Build PIE with pattern that may become recommended procedure:
        %%ifnarch ppc64 GOFLAGS=-buildmode=pie %%endif go build         A go toolchain buildmode default config would be preferable         but none exist at this time.
      * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable
      * Remove go build -o output binary location and name. Default         binary has the same name as package of func main() and is         placed in the top level of the build directory.
      * Add basic %check to execute binary --help

    - Packaging improvements:
      * Service go_modules replace dependencies with CVEs
      * Replace github.com/cloudflare/circl=github.com/cloudflare/circl@v1.6.1         Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm
      * Replace golang.org/x/net=golang.org/x/net@v0.36.0         Fixes GO-2025-3503 CVE-2025-22870
      * Replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0         Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8         Fixes GO-2025-3487 CVE-2025-22869
      * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/v5@v5.13.0         Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4         Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m
      * Service tar_scm set mode manual from disabled
      * Service tar_scm create archive from git so we can exclude         vendor directory upstream committed to git. Committed vendor         directory contents have build issues even after go mod tidy.
      * Service tar_scm exclude dir vendor
      * Service set_version set mode manual from disabled
      * Service set_version remove param basename not needed

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20143-1 advisory.

    Changes in git-bug:

    - Revendor to include fixed version of depending libraries:
      - GO-2025-4116 (CVE-2025-47913, bsc#1253506) upgrade         golang.org/x/crypto to v0.43.0
      - GO-2025-3900 (GHSA-2464-8j7c-4cjm) upgrade         github.com/go-viper/mapstructure/v2 to v2.4.0
      - GO-2025-3787 (GHSA-fv92-fjc5-jj9h) included in the previous
      - GO-2025-3754 (GHSA-2x5j-vhc8-9cwm) upgrade         github.com/cloudflare/circl to v1.6.1
      - GO-2025-4134 (CVE-2025-58181, bsc#1253930) upgrade         golang.org/x/crypto/ssh to v0.45.0
      - GO-2025-4135 (CVE-2025-47914, bsc#1254084) upgrade         golang.org/x/crypto/ssh/agent to v0.45.0

    - Revendor to include golang.org/x/net/html v 0.45.0 to prevent       possible DoS by various algorithms with quadratic complexity       when parsing HTML documents (bsc#1251463, CVE-2025-47911 and       bsc#1251664, CVE-2025-58190).

    Update to version 0.10.1:

      - cli: ignore missing sections when removing configuration (ddb22a2f)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - webui: remark upgrade + gfm + syntax highlighting (6ee47b96)
      - BREAKING CHANGE: dev-infra: remove gokart (89b880bd)

    Update to version 0.10.0:

      - bridge: correct command used to create a new bridge (9942337b)
      - web: simplify header navigation (7e95b169)
      - web: remark upgrade + gfm + syntax highlighting (6ee47b96)

    Update to version 0.9.0:

      - completion: remove errata from string literal (aa102c91)
      - tui: improve readability of the help bar (23be684a)

    Update to version 0.8.1+git.1746484874.96c7a111:

      * docs: update install, contrib, and usage documentation (#1222)
      * fix: resolve the remote URI using url.*.insteadOf (#1394)
      * build(deps): bump the go_modules group across 1 directory with 3 updates (#1376)
      * chore: gofmt simplify gitlab/export_test.go (#1392)
      * fix: checkout repo before setting up go environment (#1390)
      * feat: bump to go v1.24.2 (#1389)
      * chore: update golang.org/x/net (#1379)
      * fix: use -0700 when formatting time (#1388)
      * fix: use correct url for gitlab PATs (#1384)
      * refactor: remove depdendency on pnpm for auto-label action (#1383)
      * feat: add action: auto-label (#1380)
      * feat: remove lifecycle/frozen (#1377)
      * build(deps): bump the npm_and_yarn group across 1 directory with 12 updates (#1378)
      * feat: support new exclusion label: lifecycle/pinned (#1375)
      * fix: refactor how gitlab title changes are detected (#1370)
      * revert: Create Dependabot config file (#1374)
      * refactor: rename //:git-bug.go to //:main.go (#1373)
      * build(deps): bump github.com/vektah/gqlparser/v2 from 2.5.16 to 2.5.25 (#1361)
      * fix: set GitLastTag to an empty string when git-describe errors (#1355)
      * chore: update go-git to v5@masterupdate_mods (#1284)
      * refactor: Directly swap two variables to optimize code (#1272)
      * Update README.md Matrix link to new room (#1275)

    - Update to version 0.8.0+git.1742269202.0ab94c9:
      * deps(crypto): bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337) (#1312)

    - Update golang.org/x/crypto/ssh to v0.35.0 (bsc#1239494,       CVE-2025-22869).

    - Add missing Requires to completion subpackages.

    Update to version 0.8.0+git.1733745604.d499b6e:

      * fix typos in docs (#1266)
      * build(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#1289)

    - bump golang.org/x/crypto from v0.26.0 to v0.31.0 (fix for CVE-2024-45337, bsc#1234565).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SSH Agent servers do not validate the size of messages when processing new identity requests, which may     cause the program to panic if the message is malformed due to an out of bounds read. (CVE-2025-47914)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
296574	openSUSE 16 Security Update : buildah (openSUSE-SU-2026:20080-1)	Nessus	SuSE Local Security Checks	high
294908	Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-094 (ALASECS-2026-094)	Nessus	Amazon Linux Local Security Checks	high
291340	FreeBSD : oauth2-proxy -- multiple vulnerabilities (fb561db9-0fc1-4d92-81a2-ee01839c9119)	Nessus	FreeBSD Local Security Checks	medium
282650	openSUSE 16 : Recommended update for trivy (SUSE-SU-openSUSE-RU-2026:20010-1)	Nessus	SuSE Local Security Checks	high
282499	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2026:0067-1)	Nessus	SuSE Local Security Checks	medium
282402	Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-1336)	Nessus	Amazon Linux Local Security Checks	medium
282383	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1358)	Nessus	Amazon Linux Local Security Checks	medium
281838	SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2026:0014-1)	Nessus	SuSE Local Security Checks	high
281798	Amazon Linux 2 : amazon-cloudwatch-agent, --advisory ALAS2-2025-3120 (ALAS-2025-3120)	Nessus	Amazon Linux Local Security Checks	medium
281797	Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2025-093 (ALASDOCKER-2025-093)	Nessus	Amazon Linux Local Security Checks	medium
281781	Amazon Linux 2 : containerd, --advisory ALAS2ECS-2025-091 (ALASECS-2025-091)	Nessus	Amazon Linux Local Security Checks	medium
281773	Amazon Linux 2 : docker, --advisory ALAS2ECS-2025-090 (ALASECS-2025-090)	Nessus	Amazon Linux Local Security Checks	medium
281772	Amazon Linux 2 : runfinch-finch, --advisory ALAS2DOCKER-2025-092 (ALASDOCKER-2025-092)	Nessus	Amazon Linux Local Security Checks	medium
281771	Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2025-083 (ALASNITRO-ENCLAVES-2025-083)	Nessus	Amazon Linux Local Security Checks	medium
280087	SUSE SLES15 Security Update : buildah (SUSE-SU-2025:4526-1)	Nessus	SuSE Local Security Checks	high
279664	openSUSE 16 Security Update : cheat (openSUSE-SU-2025:20177-1)	Nessus	SuSE Local Security Checks	medium
277676	openSUSE 16 Security Update : git-bug (openSUSE-SU-2025-20143-1)	Nessus	SuSE Local Security Checks	critical
275847	Linux Distros Unpatched Vulnerability : CVE-2025-47914	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-47914

medium

Tenable Plugins

high

high

medium

high

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

high

medium

critical

medium