The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-     shot signing algorithms and reports success instead of an error.  Impact summary: A user signing or     verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe     the entire file is authenticated while trailing data beyond 16MB remains unauthenticated.  When the     'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519, Ed448, ML-     DSA-44, ML-DSA-65, ML-DSA-87), the input is buffered with a 16MB limit. If the input exceeds this limit,     the tool silently truncates to the first 16MB and continues without signaling an error, contrary to what     the documentation states. This creates an integrity gap where trailing bytes can be modified without     detection if both signing and verification are performed using the same affected codepath.  The issue     affects only the command-line tool behavior. Verifiers that process the full message using library APIs     will reject the signature, so the risk primarily affects workflows that both sign and verify with the     affected 'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and library users are     unaffected.  The FIPS modules in 3.5 and 3.6 are not affected by this issue, as the command-line tools are     outside the OpenSSL FIPS module boundary.  OpenSSL 3.5 and 3.6 are vulnerable to this issue.  OpenSSL 3.4,     3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue. Fixed in OpenSSL 3.5.5 (Affected since 3.5.0).
    (CVE-2025-15469)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-15469

medium Nessus Plugin ID 296778

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Jan 29, 2026, 5:23 AM CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 severity (based on None, severity decreased from "High" to "Medium") Detection (updated detection logic) Plugin Feed: 202601290523
Version 1.4 Jan 28, 2026, 9:04 PM Detection (updated detection logic) Plugin Feed: 202601282104
Version 1.3 Jan 28, 2026, 2:28 PM CVSS metrics ("CVSSv3 score" set to 7.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N") Plugin metadata Plugin Feed: 202601281428
Version 1.2 Jan 28, 2026, 8:38 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601280838
Version 1.1 Jan 28, 2026, 2:00 AM New Plugin Feed: 202601280200