There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all
    of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric
    value must be immediately preceded by a minus; there must be a second placeholder for a string value after
    the first placeholder; both must be on the same line; and both parameter values must be user-controlled.
    The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a
    minus directly before a placeholder. (CVE-2024-27289)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - pgx 是適用於 Go 的 PostgreSQL 驅動程式和工具組。在 4.18.2版之前，當符合下列所有條件時，可能會發生 SQL 插入：使用非預設的簡單通訊協定；數值的預留位置前面必須緊接一個減號；在第一個預留位置之後，必須有第二個預留位置供字串值使用；兩者必須在同一行；和 兩個參數值都必須由使用者控制。
    此問題已在 v4.18.2 中解決。因應措施為不使用簡單通訊協定，或不在預留位置前直接放置減號。 (CVE-2024-27289)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - pgx 是适用于 Go 的 PostgreSQL 驱动程序和工具包。在低于版本 4.18.2的版本中，当满足下列所有条件时，就会发生 SQL 注入：使用非默认的简单协议；数值占位符的前面必须紧接着一个减号；在第一个占位符之后必须有字符串值的第二个占位符；两者必须在同一行；和 两个参数值必须由用户控制。
    此问题已在 v4.18.2 中解决。变通方案是不使用 simple 协议或不在占位符前面直接放置减号。 (CVE-2024-27289)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - pgx は、Go 用の PostgreSQL ドライバーおよびツールキットです。 4.18.2より前のバージョンでは、次の条件がすべて満たされた場合に SQL インジェクションが発生する可能性があります。デフォルト以外の単純なプロトコルが使用された場合。数値のプレースホルダーは、直前にマイナスをつける必要があります。文字列値の場合は、最初のプレースホルダーの後に 2 番目のプレースホルダーが必要です。両方が同じ行にある必要があります。また、両方のパラメーター値をユーザーが制御する必要があります。
    この問題は v4.18.2 で解決されています。回避策として、simple プロトコルを使用しないか、プレースホルダーの直前にマイナス記号を置かないようにします。 （CVE-2024-27289）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-bd8fe42929 advisory.

    Automatic update for caddy-2.8.4-1.fc41.

    ##### **Changelog**

    ```
    * Fri Jul  5 2024 Carl George <carlwgeorge@fedoraproject.org> - 2.8.4-1
    - Update to version 2.8.4 rhbz#2278549
    - Resolves CVE-2023-49295 rhbz#2257829
    - Resolves CVE-2024-27304 rhbz#2268278
    - Resolves CVE-2024-27289 rhbz#2268468
    - Resolves CVE-2024-28180 rhbz#2268877
    - Resolves CVE-2024-22189 rhbz#2273517
    - Remove LimitNPROC from systemd unit files

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of telegraf installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27289 advisory.

  - pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all     of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric     value must be immediately preceded by a minus; there must be a second placeholder for a string value after     the first placeholder; both must be on the same line; and both parameter values must be user-controlled.
    The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a     minus directly before a placeholder. (CVE-2024-27289)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all     of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric     value must be immediately preceded by a minus; there must be a second placeholder for a string value after     the first placeholder; both must be on the same line; and both parameter values must be user-controlled.
    The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a     minus directly before a placeholder. (CVE-2024-27289)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
416823	SCA: security update for github.com/jackc/pgx, github.com/jackc/pgx/v4 (GHSA-m7wr-2xf7-cm9p)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
416823	SCA: security update for github.com/jackc/pgx, github.com/jackc/pgx/v4 (GHSA-m7wr-2xf7-cm9p)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
227782	Linux Distros 未修補弱點：CVE-2024-27289	Nessus	Misc.	3/5/2025	7/18/2026	high
227782	Linux Distros 未修补的漏洞: CVE-2024-27289	Nessus	Misc.	3/5/2025	7/18/2026	high
227782	Linux Distros のパッチ未適用の脆弱性: CVE-2024-27289	Nessus	Misc.	3/5/2025	7/18/2026	high
211175	Fedora 41 : caddy (2024-bd8fe42929)	Nessus	Fedora Local Security Checks	11/14/2024	10/13/2025	medium
201837	CBL Mariner 2.0 Security Update: telegraf (CVE-2024-27289)	Nessus	MarinerOS Local Security Checks	7/3/2024	7/3/2024	high
227782	Linux Distros Unpatched Vulnerability : CVE-2024-27289	Nessus	Misc.	3/5/2025	7/18/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

medium

high

high