リモートの SUSE Linux SLES15 / SLES_SAP15 ホストには、SUSE-SU-2023:0130-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Certifi は、TLS ホストの ID を検証する際に、SSL 証明書の信頼性を検証するための、ルート証明書のキュレーションされたコレクションです。Certifi 2022.12.07は、TrustCor のルート証明書をルートストアから削除します。これらを Mozilla のトラストストアから削除中です。
    TrustCor のルート証明書は、TrustCor の所有権もスパイウェアを生み出す事業を行っていたとメディアが報告している調査に基づき、削除中です。Mozilla の調査の結論については、リンクされた Google グループのディスカッションをご覧ください。(CVE-2022-23491)

  nss で脆弱性が見つかりました。このセキュリティの脆弱性により、データベースにユーザー証明書がない場合の nss クライアント認証のクラッシュが、セグメンテーション違反またはクラッシュを引き起こす可能性があります。(CVE-2022-3479)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートホストにインストールされている WebLogic Server のバージョン 12.2.1.4.0、14.1.1.0.0 は、2024 年 4 月の CPU のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Oracle Fusion Middleware の Oracle WebLogic Server 製品の脆弱性 (コンポーネント: サンプル (handlebars))。サポートされているバージョンで影響を受けるのは、12.2.1.4.0 および 14.1.1.0.0です。容易に悪用可能な脆弱性により、認証されていない攻撃者が HTTP を介してネットワークにアクセスし、Oracle WebLogic Server を侵害する可能性があります。この脆弱性への攻撃が成功した場合、Oracle WebLogic サーバーの乗っ取りが発生する可能性があります。(CVE-2021-23369)

  - Oracle Fusion Middleware の Oracle WebLogic Server 製品の脆弱性 (コンポーネント: 一元化されたサードパーティ Jars (Bouncy Castle Java Library))。サポートされているバージョンで影響を受けるのは、12.2.1.4.0 および 14.1.1.0.0です。容易に悪用可能な脆弱性があり、認証されていない攻撃者が複数のプロトコルを介してネットワークにアクセスし、Oracle WebLogic サーバーを侵害する可能性があります。この脆弱性に対する攻撃が成功すると、Oracle WebLogic Server がアクセスできるデータのサブセットが、権限なしで読み取りアクセスされる可能性があります。（CVE-2023-2976）

  - Oracle Fusion Middleware の Oracle WebLogic Server 製品の脆弱性 (コンポーネント: Web コンテナ)。サポートされているバージョンで影響を受けるのは 14.1.1.0.0です。容易に悪用可能な脆弱性により、認証されていない攻撃者が HTTP/2 を介してネットワークにアクセスし、Oracle WebLogic Server を侵害する可能性があります。この脆弱性に対する攻撃が成功すると、権限なく Oracle WebLogic Server をハングさせたり、頻繁にクラッシュを繰り返させたりする (完全な DOS) 可能性があります。(CVE-2023-44487)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

An update of the python3 package has been released.

An update of the python package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0139-1 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of ca-certificates installed on the remote host is prior to 2021.2.50-72. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-1957 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-062 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-061 advisory.

    Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0130-1 advisory.

  - Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL     certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from     TrustCor from the root store. These are in the process of being removed from Mozilla's trust store.
    TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting     that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's     investigation can be found in the linked google group discussion. (CVE-2022-23491)

  - A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user     certificate in the database and this can lead us to a segmentation fault or crash. (CVE-2022-3479)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0 and 14.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory:

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Samples (handlebars)).     Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows \     unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of     this vulnerability can result in takeover of Oracle WebLogic Server. (CVE-2021-23369)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Bouncy Castle Java Library)). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily     exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset     of Oracle WebLogic Server accessible data. (CVE-2023-2976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). The     supported version that is affected is 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP/2 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic     Server. (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
170616	SUSE SLES15 セキュリティ更新プログラム: mozilla-nss (SUSE-SU-2023:0130-1 )	Nessus	SuSE Local Security Checks	1/25/2023	7/13/2023	high
193425	Oracle WebLogic Server (2024 年 4 月 CPU)	Nessus	Misc.	4/17/2024	10/18/2024	critical
204200	Photon OS 4.0: Python3 PHSA-2023-4.0-0534	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
237629	Photon OS 3.0: Python PHSA-2023-3.0-0704	Nessus	PhotonOS Local Security Checks	6/1/2025	6/1/2025	medium
230048	Linux Distros Unpatched Vulnerability : CVE-2022-23491	Nessus	Misc.	3/5/2025	8/30/2025	high
170663	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-certifi (SUSE-SU-2023:0139-1)	Nessus	SuSE Local Security Checks	1/26/2023	7/13/2023	high
171824	Amazon Linux 2 : ca-certificates (ALAS-2023-1957)	Nessus	Amazon Linux Local Security Checks	2/23/2023	12/11/2024	high
173097	Amazon Linux 2023 : python3-certifi (ALAS2023-2023-062)	Nessus	Amazon Linux Local Security Checks	3/21/2023	12/11/2024	high
173132	Amazon Linux 2023 : ca-certificates (ALAS2023-2023-061)	Nessus	Amazon Linux Local Security Checks	3/21/2023	12/11/2024	high
170616	SUSE SLES15 Security Update : mozilla-nss (SUSE-SU-2023:0130-1)	Nessus	SuSE Local Security Checks	1/25/2023	7/13/2023	high
193425	Oracle WebLogic Server (April 2024 CPU)	Nessus	Misc.	4/17/2024	10/18/2024	critical

Detections

Analytics

Plugins Search

high

critical

critical

medium

high

high

high

high

high

high

critical