The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2779 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)

    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)

    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:2780 advisory.

    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)
    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)
    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)
    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:2778 advisory.

    * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629)
    * nghttp2: CONTINUATION frames DoS (CVE-2024-28182)
    * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service     (CVE-2024-22025)
    * nodejs: CONTINUATION frames DoS (CVE-2024-27983)
    * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2910 advisory.

    [1:16.20.2-8.0.1]
    - Fix CVE-2024-28182, CVE-2024-22025, CVE-2024-25629, CVE-2024-27982, CVE-2024-27983

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the c-ares package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    c-ares is a C library for asynchronous DNS requests.`ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/ nsswitch.conf`, the `HOSTALIASES` file, and if     using a c-ares version prior to 1.27.0, the `/etc/hosts` file.If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash.This issue is fixed in c-ares 1.27.0.No     known workarounds exist.(CVE-2024-25629)

Tenable has extracted the preceding description block directly from the EulerOS c-ares security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the c-ares packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist.(CVE-2024-25629)

Tenable has extracted the preceding description block directly from the EulerOS c-ares security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist.(CVE-2024-25629)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization c-ares security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3842 advisory.

    [1.19.1-2]
    - Resolves: RHEL-26529 - Out of bounds read in ares__read_line() [rhel-9]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of c-ares / fluent-bit / grpc / nodejs / nodejs18 / python-gevent installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-25629 advisory.

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which May result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9963d77dcb advisory.

    1.28.1 fixes a significant bug in 1.28.0.

    ----

    Update to 1.28.0. Also fixes CVE-2024-25629.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has c-ares packages installed that are affected by a vulnerability:

  - c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local     configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using     a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an     embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory     prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0.
    No known workarounds exist. (CVE-2024-25629)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
195196	RHEL 9 : nodejs:18 (RHSA-2024:2779)	Nessus	Red Hat Local Security Checks	5/9/2024	4/30/2025	medium
195204	AlmaLinux 8 : nodejs:18 (ALSA-2024:2780)	Nessus	Alma Linux Local Security Checks	5/9/2024	2/6/2025	medium
195207	AlmaLinux 8 : nodejs:20 (ALSA-2024:2778)	Nessus	Alma Linux Local Security Checks	5/9/2024	2/6/2025	medium
197734	Oracle Linux 9 : nodejs (ELSA-2024-2910)	Nessus	Oracle Linux Local Security Checks	5/23/2024	2/6/2025	medium
227983	Linux Distros Unpatched Vulnerability : CVE-2024-25629	Nessus	Misc.	3/5/2025	3/5/2025	medium
210661	EulerOS 2.0 SP10 : c-ares (EulerOS-SA-2024-2900)	Nessus	Huawei Local Security Checks	11/8/2024	2/6/2025	medium
207627	EulerOS 2.0 SP8 : c-ares (EulerOS-SA-2024-2458)	Nessus	Huawei Local Security Checks	9/24/2024	2/6/2025	medium
209774	EulerOS Virtualization 2.12.1 : c-ares (EulerOS-SA-2024-2748)	Nessus	Huawei Local Security Checks	10/27/2024	2/6/2025	medium
200392	Oracle Linux 9 : c-ares (ELSA-2024-3842)	Nessus	Oracle Linux Local Security Checks	6/12/2024	2/6/2025	medium
201838	CBL Mariner 2.0 Security Update: c-ares / fluent-bit / grpc / nodejs / nodejs18 / python-gevent (CVE-2024-25629)	Nessus	MarinerOS Local Security Checks	7/3/2024	2/22/2025	medium
194549	Fedora 40 : c-ares (2024-9963d77dcb)	Nessus	Fedora Local Security Checks	4/29/2024	2/6/2025	medium
202945	EulerOS 2.0 SP8 : c-ares (EulerOS-SA-2024-2020)	Nessus	Huawei Local Security Checks	7/22/2024	2/6/2025	medium
242804	NewStart CGSL MAIN 7.02 : c-ares Vulnerability (NS-SA-2025-0167)	Nessus	NewStart CGSL Local Security Checks	7/25/2025	7/25/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium