The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0267-1 advisory.

    - CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the     containers/storage library can cause Denial of Service (DoS) (bsc#1231698)

    - Load ip_tables and ip6_tables kernel module (bsc#1214612)
      * Required for rootless mode as a regular user has no permission         to load kernel modules

    - CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)
    - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount     Instruction in buildah (bsc#1231208)
    - CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (bsc#1231230)
    - CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)
    - CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a     malicious Containerfile. (bsc#1236270)

    - Refactor network backend dependencies:
      * podman requires either netavark or cni-plugins. On ALP, require         netavark, otherwise prefer netavark but don't force it.
      * This fixes missing cni-plugins in some scenarios
      * Default to netavark everywhere where it's available

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.5 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.0 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202407-12 (podman: Multiple Vulnerabilities)

    Please review the referenced CVE identifiers for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
214742	SUSE SLES15 Security Update : podman (SUSE-SU-2025:0267-1)	Nessus	SuSE Local Security Checks	1/29/2025	2/4/2025	high
206720	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.5)	Nessus	Misc.	9/6/2024	2/17/2025	high
212124	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.0)	Nessus	Misc.	12/6/2024	2/5/2025	medium
201915	GLSA-202407-12 : podman: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	7/5/2024	7/5/2024	critical

Detections

Analytics

Plugins Search

high

high

medium

critical