The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Moby is an open source container framework developed by Docker Inc. that is distributed as Docker,     Mirantis Container Runtime, and various other downstream projects/products. The Moby daemon component     (`dockerd`), which is developed as moby/moby is commonly referred to as *Docker*. Swarm Mode, which is     compiled in and delivered by default in `dockerd` and is thus present in most major Moby downstreams, is a     simple, built-in container orchestrator that is implemented through a combination of SwarmKit and     supporting network code. The `overlay` network driver is a core feature of Swarm Mode, providing isolated     virtual LANs that allow communication between containers and services across the cluster. This driver is     an implementation/user of VXLAN, which encapsulates link-layer (Ethernet) frames in UDP datagrams that tag     the frame with the VXLAN metadata, including a VXLAN Network ID (VNI) that identifies the originating     overlay network. In addition, the overlay network driver supports an optional, off-by-default encrypted     mode, which is especially useful when VXLAN packets traverses an untrusted network between nodes.
    Encrypted overlay networks function by encapsulating the VXLAN datagrams through the use of the IPsec     Encapsulating Security Payload protocol in Transport mode. By deploying IPSec encapsulation, encrypted     overlay networks gain the additional properties of source authentication through cryptographic proof, data     integrity through check-summing, and confidentiality through encryption. When setting an endpoint up on an     encrypted overlay network, Moby installs three iptables (Linux kernel firewall) rules that enforce both     incoming and outgoing IPSec. These rules rely on the `u32` iptables extension provided by the `xt_u32`     kernel module to directly filter on a VXLAN packet's VNI field, so that IPSec guarantees can be enforced     on encrypted overlay networks without interfering with other overlay networks or other users of VXLAN. An     iptables rule designates outgoing VXLAN datagrams with a VNI that corresponds to an encrypted overlay     network for IPsec encapsulation. Encrypted overlay networks on affected platforms silently transmit     unencrypted data. As a result, `overlay` networks may appear to be functional, passing traffic as     expected, but without any of the expected confidentiality or data integrity guarantees. It is possible for     an attacker sitting in a trusted position on the network to read all of the application traffic that is     moving across the overlay network, resulting in unexpected secrets or user data disclosure. Thus, because     many database protocols, internal APIs, etc. are not protected by a second layer of encryption, a user may     use Swarm encrypted overlay networks to provide confidentiality, which due to this vulnerability this is     no longer guaranteed. Patches are available in Moby releases 23.0.3, and 20.10.24. As Mirantis Container     Runtime's 20.10 releases are numbered differently, users of that platform should update to 20.10.16. Some     workarounds are available. Close the VXLAN port (by default, UDP port 4789) to outgoing traffic at the     Internet boundary in order to prevent unintentionally leaking unencrypted traffic over the Internet,     and/or ensure that the `xt_u32` kernel module is available on all nodes of the Swarm cluster.
    (CVE-2023-28841)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2023-28841

medium Nessus Plugin ID 226947

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Jul 18, 2026, 3:00 PM Detection (updated detection logic) Plugin Feed: 202607181500
Version 1.4 Jan 31, 2026, 11:07 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.3 Oct 28, 2025, 9:02 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:U/RC:C") Detection (updated detection logic) Plugin Feed: 202510280902
Version 1.2 Aug 18, 2025, 9:35 AM CVSS metrics ("CVSSv2 score" set to 2.3) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:A/AC:M/Au:S/C:P/I:N/A:N") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2023-28841, severity decreased from "Medium" to "Low") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202508180935
Version 1.1 Mar 6, 2025, 7:23 AM New Plugin Feed: 202503060723