The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0487-1 advisory.

  - All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
    (CVE-2020-7753)

  - ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

  - json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype     Pollution') (CVE-2021-3918)

  - In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues()     method, aka lib/internal/iterator.js createObjectIterator prototype pollution. (CVE-2021-43138)

  - Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through     8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files.
    The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any     installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched     versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about     vulnerable URL paths, mitigation, and the disclosure timeline. (CVE-2021-43798)

  - Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and     7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the     developer testing tool called TestData DB data source enabled and configured. The vulnerability is limited     in scope, and only allows access to files with the extension .csv to authenticated users only. Grafana     Cloud instances have not been affected by the vulnerability. Versions 8.3.2 and 7.5.12 contain a patch for     this issue. There is a workaround available for users who cannot upgrade. Running a reverse proxy in front     of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to     also be able to handle url encoded paths. (CVE-2021-43815)

  - follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor     (CVE-2022-0155)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2024:0487-1)

critical Nessus Plugin ID 190632

Version 1.2

Version 1.1

Version 1.1

Version 1.0

Version 1.2 Feb 19, 2024, 3:57 PM Exploit attributes ("Exploit framework canvas" set to "True") Plugin Feed: 202402191557
Version 1.1 Feb 17, 2024, 12:49 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202402171249
Version 1.1 Feb 19, 2024, 2:01 PM Exploit attributes ("Exploit framework canvas" set to "True") Plugin Feed: 202402191401
Version 1.0 Feb 17, 2024, 7:25 AM New Plugin Feed: 202402170725