The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20300 advisory.

    [2.28-251.0.3.16]
    - Forward port of Oracle patches       Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com>       Oracle history:
      March-26-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.14
      - OraBug: 36625686 Add MTE support on string functions         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.14
      - Forward port of Oracle patches         Reviewed-by: David Faust <david.faust@oracle.com>       February-19-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.13
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       January-28-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.11
      - Forward port of Oracle patches         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.5
      - Forward port of Oracle patches over 2.28-251.5         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.28-251.0.2.4
      - Forward port of Oracle patches over 2.28-251.4         Reviewed-by: David Faust <david.faust@oracle.com>       May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.2
      - Forward port of Oracle patches over 2.28-251.2         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-23-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.1
      - Forward port of Oracle patches over 2.28-251.1         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-22-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2
      - Forward port of Oracle patches for ol8-u10         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.1
      - Forward port of Oracle patches for ol8-u10-beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-5-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.12
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       November-14-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.7
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.6
      - Forward port of Oracle patches.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-21-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.3
      - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks
      - Created tunable glibc.pthread.stack_hugetlb to control when hugepages         can be used for stack allocation.
      - In case THP are enabled and glibc.pthread.stack_hugetlb is set to         0, glibc will madvise the kernel not to use allow hugepages for stack         allocations.
        Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       April-11-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.2
      - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.1
      - Merge of Oracle patches for ol8u8 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-211.0.1
      - Merge of Oracle patches for ol8u7 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       August-8-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-189.5.0.2
      - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs.
      - These changes enable reading the realtime clock without a kernel syscall.
        OraBug: 30478315         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>       May-2-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-199.0.1
      - Merge of patches from c8s 199 with ol8u6 beta         Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com>
      - Update siginfo constants from linux kernel (OraBug: 33734528)
      - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826)
      - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive
      - spin mutex (Orabug: 27982358)         Reviewed-by: Qing Zhao <qing.zhao@oracle.com>
      - add Ampere emag  to tunable cpu list (Patrick McGehearty)
      - add optimized memset for emag
      - add an ASIMD variant of strlen for falkor         Orabug: 2700101.
      - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085)
      - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile         Both should test           if (stream->_flags & _IO_USER_LOCK) == 0)
            _IO_lock_lock (*stream->_lock);
        OraBug: 28481550.
        Reviewed-by: Qing Zhao <qing.zhao@oracle.com>

    [2.28-251.16]
    - nscd: Fix an unlikely TTL issue in the netgroup cache (RHEL-35280)

    [2.28-251.15]
    - CVE-2025-0395: Fix a buffer overflow in assert (RHEL-83306)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : glibc (ELSA-2025-20300)

high Nessus Plugin ID 235013

Version 1.2

Version 1.1

Version 1.2 May 1, 2025, 5:31 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202505010531
Version 1.1 Apr 30, 2025, 5:21 PM New Plugin Feed: 202504301721