According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of c-ares installed on the remote host is prior to 1.17.2-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1780 advisory.

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6291 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving     API.

    Security Fix(es):

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7116 advisory.

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:7116 advisory.

    The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving     API.

    Security Fix(es):

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-7116 advisory.

    - Resolves: rhbz#2209517 - CVE-2023-32067 c-ares: 0-byte UDP payload Denial of Service [rhel-8.9.0]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-1582 advisory.

    - Rebase to 16.19.1       Resolves: rhbz#2153713       Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920       Resolves: CVE-2022-25881 CVE-2022-4904

    nodejs-nodemon

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1744 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:2655 advisory.

  - This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via     malicious request header values sent to a server, when that server reads the cache policy from the request     using this library. (CVE-2022-25881)

  - A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

  - A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made     it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in     Node.js and access non authorized modules by using process.mainModule.require(). This only affects users     who had enabled the experimental permissions option with --experimental-policy. (CVE-2023-23918)

  - An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that     could allow an attacker to search and potentially load ICU data when running with elevated privileges.
    (CVE-2023-23920)

  - Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the     undici library does not protect `host` HTTP header from CRLF injection vulnerabilities. This issue is     patched in Undici v5.19.1. As a workaround, sanitize the `headers.host` string before passing to undici.
    (CVE-2023-23936)

  - Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and     `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when     untrusted values are passed into the functions. This is due to the inefficient regular expression used to     normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in     v5.19.1. No known workarounds are available. (CVE-2023-24807)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This Solaris system is missing necessary patches to address critical security updates :

The version of Dell Wyse Management Suite installed on the remote host is prior to 5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2025-135 advisory.

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information     Through Data Queries vulnerability. An unauthenticated attacker with remote access could potentially     exploit this vulnerability, leading to Information disclosure. (CVE-2025-29981)

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions     vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability,     leading to Unauthorized access. (CVE-2025-29982)

  - Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool     vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability,     leading to Denial of service. (CVE-2025-27694)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of c-ares installed on the remote host is prior to 1.10.0-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2399 advisory.

    A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS     (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain     Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as     system availability. (CVE-2021-3672)

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the     input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of     service or a limited impact on confidentiality and integrity. (CVE-2022-4904)

    ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular     0::00:00:00/2 was found to cause an issue. C-ares only uses this function internally for configuration     purposes which would require an administrator to configure such an address via ares_set_sortlist().

    However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more     severe issues. (CVE-2023-31130)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4035 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130)

    * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147)

    * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
176783	EulerOS Virtualization 2.11.0 : c-ares (EulerOS-SA-2023-2117)	Nessus	Huawei Local Security Checks	6/7/2023	6/7/2023	high
178499	Amazon Linux AMI : c-ares (ALAS-2023-1780)	Nessus	Amazon Linux Local Security Checks	7/20/2023	12/11/2024	high
184276	RHEL 9 : c-ares (RHSA-2023:6291)	Nessus	Red Hat Local Security Checks	11/2/2023	11/7/2024	high
185644	CentOS 8 : c-ares (CESA-2023:7116)	Nessus	CentOS Local Security Checks	11/14/2023	11/14/2023	high
185698	RHEL 8 : c-ares (RHSA-2023:7116)	Nessus	Red Hat Local Security Checks	11/14/2023	11/7/2024	high
186098	Oracle Linux 8 : c-ares (ELSA-2023-7116)	Nessus	Oracle Linux Local Security Checks	11/21/2023	10/22/2024	high
173895	Oracle Linux 8 : nodejs:16 (ELSA-2023-1582)	Nessus	Oracle Linux Local Security Checks	4/5/2023	11/1/2024	high
174180	RHEL 7 : rh-nodejs14-nodejs (RHSA-2023:1744)	Nessus	Red Hat Local Security Checks	4/12/2023	11/7/2024	high
176395	Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2023:2655)	Nessus	Rocky Linux Local Security Checks	5/25/2023	5/25/2023	high
178626	Oracle Solaris Critical Patch Update : jul2023_SRU11_4_58_144_3	Nessus	Solaris Local Security Checks	7/20/2023	7/26/2023	critical
233818	Dell Wyse Management Suite < 5.1 Multiple Vulnerabilities (DSA-2025-135)	Nessus	Windows	4/3/2025	6/12/2025	high
187841	Amazon Linux 2 : c-ares (ALAS-2024-2399)	Nessus	Amazon Linux Local Security Checks	1/9/2024	12/11/2024	high
178237	RHEL 8 : nodejs:18 (RHSA-2023:4035)	Nessus	Red Hat Local Security Checks	7/13/2023	3/11/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

critical

high

high

high