The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0634 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-6104:
    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8754:08 advisory.

    * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
      * go-retryable[http:](http:) url might write sensitive information to log file (CVE-2024-6104)
      * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization     (CVE-2024-37298)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3722 advisory.

  - go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

  - golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5258 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

    * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

    * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)

    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

    * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

    * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5446 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.48. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:5444

    Security Fix(es):

    * golang: net/http: memory exhaustion in Request.ParseMultipartForm     (CVE-2023-45290)
    * go-retryablehttp: url might write sensitive information to log file     (CVE-2024-6104)
    * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped     IPv6 addresses (CVE-2024-24790)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5258 advisory.

    * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
    * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
    * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
    * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)
    * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
    * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
    * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-708 advisory.

    Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability     (CVE-2024-35255)

    The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export     telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the     collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also     fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1. (CVE-2024-36129)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300044.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2630 advisory.

    Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability     (CVE-2024-35255)

    The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export     telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the     collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue.  It is also     fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1. (CVE-2024-36129)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
276013	TencentOS Server 4: skopeo (TSSA-2025:0634)	Nessus	Tencent Local Security Checks	11/20/2025	11/20/2025	medium
292009	MiracleLinux 9 : podman-4.9.4-10.el9_4 (AXSA:2024-8754:08)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
311934	RHCOS 4 : OpenShift Container Platform 4.17.0 (RHSA-2024:3722)	Nessus	Red Hat Local Security Checks	5/4/2026	5/4/2026	medium
210509	RHEL 8 : container-tools:rhel8 (RHSA-2024:5258)	Nessus	Red Hat Local Security Checks	11/7/2024	3/6/2025	medium
206116	RHEL 8 / 9 : OpenShift Container Platform 4.13.48 (RHSA-2024:5446)	Nessus	Red Hat Local Security Checks	8/22/2024	11/7/2024	critical
205545	AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:5258)	Nessus	Alma Linux Local Security Checks	8/14/2024	1/13/2025	medium
231256	Linux Distros Unpatched Vulnerability : CVE-2024-6104	Nessus	Misc.	3/6/2025	7/18/2026	medium
206817	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2024-708)	Nessus	Amazon Linux Local Security Checks	9/9/2024	12/11/2024	medium
206820	Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2024-2630)	Nessus	Amazon Linux Local Security Checks	9/9/2024	12/11/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

critical

medium

medium

medium

medium