The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-f1d2ae375e advisory.

    release 1.5.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:3833 advisory.

    * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh     (CVE-2025-22869)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1333-1 advisory.

    - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file     (bsc#1227031)
    - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in     ParseWithClaims leading to potentially dangerous situations (bsc#1232985)
    - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Fixed denial of     service in Go JOSE's Parsing (bsc#1237682)
    - CVE-2025-22870: cosign: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238693)
    - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token     parsing (bsc#1239204)
    - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Fixed denial of service in the Key Exchange     (bsc#1239337)

    Other fixes:

    - Update to version 2.5.0 (jsc#SLE-23476):
      * Update sigstore-go to pick up bug fixes (#4150)
      * Update golangci-lint to v2, update golangci-lint-action (#4143)
      * Feat/non filename completions (#4115)
      * update builder to use go1.24.1 (#4116)
      * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
      * Remove cert log line (#4113)
      * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
      * bump to latest scaffolding release for testing (#4099)
      * increase 2e2_test docker compose tiemout to 180s (#4091)
      * Fix replace with compliant image mediatype (#4077)
      * Add TSA certificate related flags and fields for cosign attest (#4079)

    - Update to version 2.4.3 (jsc#SLE-23476):
      * Enable fetching signatures without remote get. (#4047)
      * Bump sigstore/sigstore to support KMS plugins (#4073)
      * sort properly Go imports (#4071)
      * sync comment with parameter name in function signature (#4063)
      * fix go imports order to be alphabetical (#4062)
      * fix comment typo and imports order (#4061)
      * Feat/file flag completion improvements (#4028)
      * Udpate builder to use go1.23.6 (#4052)
      * Refactor verifyNewBundle into library function (#4013)
      * fix parsing error in --only for cosign copy (#4049)
      * Fix codeowners syntax, add dep-maintainers (#4046)

    - Update to version 2.4.2 (jsc#SLE-23476):
      - Updated open-policy-agent to 1.1.0 library (#4036)
         -  Note that only Rego v0 policies are supported at this time
      - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
      - Add support for verifying root checksum in cosign initialize (#3953)
      - Detect if user supplied a valid protobuf bundle (#3931)
      - Add a log message if user doesn't provide --trusted-root (#3933)
      - Support mTLS towards container registry (#3922)
      - Add bundle create helper command (#3901)
      - Add trusted-root create helper command (#3876)       Bug Fixes:
      - fix: set tls config while retaining other fields from default http transport (#4007)
      - policy fuzzer: ignore known panics (#3993)
      - Fix for multiple WithRemote options (#3982)
      - Add nightly conformance test workflow (#3979)
      - Fix copy --only for signatures + update/align docs (#3904)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0770-1 advisory.

    - Update to version 0.0.20250226T025151 2025-02-26T02:51:51Z.
      (jsc#PED-11136)

      * GO-2025-3487 CVE-2025-22869
      * GO-2025-3488 CVE-2025-22868

    - Update to version 0.0.20250218T203201 2025-02-18T20:32:01Z.
      (jsc#PED-11136)

      * GO-2024-3321 CVE-2024-45337 GHSA-v778-237x-gjrc

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0094-1 advisory.

    - gitea-te: update newer dependencies to fix security issues (boo#1235367 boo#1239493 boo#1234598)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2025:02092-1 advisory.

    - Added patch to remove using rw as a default mount option (bsc#1239776)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7462 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh     (CVE-2025-22869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6241ca1662 advisory.

    Automatic update for restic-0.18.0-1.fc43.

    ##### **Changelog**

    ```
    * Fri Jul 11 2025 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.18.0-1
    - Update to 0.18.0 - Closes rhbz#2355627 rhbz#2354447 rhbz#2352331       rhbz#2350845 rhbz#2348839 rhbz#2331990

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-7462 advisory.

    - rebuild to resolve CVE-2025-22871

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-914 advisory.

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted. (CVE-2025-22869)

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,     including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)     standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go     JOSE could use excessive memory. The code used strings.Split(token, .) to split JWT tokens, which is     vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number     of `.` characters.  An attacker could exploit this by sending numerous malformed tokens, leading to memory     exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could     pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.
    (CVE-2025-27144)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7391 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

    * golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh     (CVE-2025-22869)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-056 advisory.

    An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during     parsing. (CVE-2025-22868)

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted. (CVE-2025-22869)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-053 advisory.

    An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during     parsing. (CVE-2025-22868)

    SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from     clients which complete the key exchange slowly, or not at all, causing pending content to be read into     memory, but never transmitted. (CVE-2025-22869)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
234465	Fedora 41 : podman-tui (2025-f1d2ae375e)	Nessus	Fedora Local Security Checks	4/16/2025	4/16/2025	medium
234489	AlmaLinux 9 : gvisor-tap-vsock (ALSA-2025:3833)	Nessus	Alma Linux Local Security Checks	4/16/2025	4/16/2025	high
234602	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2025:1333-1)	Nessus	SuSE Local Security Checks	4/18/2025	4/18/2025	high
218740	SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0770-1)	Nessus	SuSE Local Security Checks	3/4/2025	3/4/2025	critical
233173	openSUSE 15 Security Update : gitea-tea (openSUSE-SU-2025:0094-1)	Nessus	SuSE Local Security Checks	3/21/2025	3/21/2025	critical
240572	SUSE SLES15 : Recommended update for podman (SUSE-SU-SUSE-RU-2025:02092-1)	Nessus	SuSE Local Security Checks	6/26/2025	6/26/2025	high
237862	RHEL 10 : podman (RHSA-2025:7462)	Nessus	Red Hat Local Security Checks	6/5/2025	6/5/2025	high
241994	Fedora 43 : restic (2025-6241ca1662)	Nessus	Fedora Local Security Checks	7/11/2025	7/11/2025	high
241056	Oracle Linux 10 : podman (ELSA-2025-7462)	Nessus	Oracle Linux Local Security Checks	7/1/2025	7/1/2025	high
233687	Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-914)	Nessus	Amazon Linux Local Security Checks	4/1/2025	4/1/2025	high
235832	RHEL 9 : podman (RHSA-2025:7391)	Nessus	Red Hat Local Security Checks	5/13/2025	6/5/2025	high
234522	Amazon Linux 2 : docker (ALASDOCKER-2025-056)	Nessus	Amazon Linux Local Security Checks	4/17/2025	4/17/2025	high
234527	Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-053)	Nessus	Amazon Linux Local Security Checks	4/17/2025	4/17/2025	high

Detections

Analytics

Plugins Search

medium

high

high

critical

critical

high

high

high

high

high

high

high

high