The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0231 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-45288:
    A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming     language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single     stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.

    CVE-2023-45289:
    A flaw was found in Go's net/http/cookiejar standard library package. When following an HTTP redirect to a     domain that is not a subdomain match or an exact match of the initial domain, an http.Client does not     forward sensitive headers such as Authorization or Cookie. For example, a redirect from foo.com to     www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously     crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.

    CVE-2023-45290:
    A flaw was discovered in Go's net/http standard library package. When parsing a multipart form (either     explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or     Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed     while reading a single form line. This issue permitted a maliciously crafted input containing very long     lines to cause allocation of arbitrarily large amounts of memory, potentially leading to a denial of     service.

    CVE-2024-24783:
    A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains     a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue     affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or     RequireAndVerifyClientCert.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0811-1 advisory.

    - Upgrade go to version 1.21.8
    - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on     HTTP redirect (bsc#1221000)
    - CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)
    - CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm     (bsc#1220999)
    - CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)
    - CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping     (bsc#1221003)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0800-1 advisory.

    - Upgrade go to version 1.21.8
    - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on     HTTP redirect (bsc#1221000)
    - CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm (bsc#1221001)
    - CVE-2024-24783: crypto/x509: Verify panics on certificates with an unknown public key algorithm     (bsc#1220999)
    - CVE-2024-24784: net/mail: comments in display names are incorrectly handled (bsc#1221002)
    - CVE-2024-24785: html/template: errors returned from MarshalJSON methods may break template escaping     (bsc#1221003)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5442 advisory.

  - golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in     Request.ParseMultipartForm (CVE-2023-45290)

  - golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8911:01 advisory.

    * golang: net/[http:](http:) golang: mime/multipart: golang: net/textproto: memory exhaustion in     Request.ParseMultipartForm (CVE-2023-45290)
      * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a     panic/stack exhaustion (CVE-2024-34155)
      * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can     cause a panic due to stack exhaustion (CVE-2024-34156)
      * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8286:05 advisory.

    * golang: net/[http:](http:) memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
      * jose-go: improper handling of highly compressed data (CVE-2024-28180)
      * buildah: jose: resource exhaustion (CVE-2024-28176)     CVE-2023-45290     When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with     Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed     form were not applied to the memory consumed while reading a single form line. This permits a maliciously     crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory,     potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits     the maximum size of form lines.
    CVE-2024-28176     jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    CVE-2024-28180     Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7759:01 advisory.

    golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)         golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)         golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect     (CVE-2023-45289)         golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm     (CVE-2024-24783)         golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)         golang: html/template: errors returned from MarshalJSON methods may break template escaping     (CVE-2024-24785)         golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
239557	TencentOS Server 3: git-lfs (TSSA-2024:0231)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	medium
191764	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21 (SUSE-SU-2024:0811-1)	Nessus	SuSE Local Security Checks	3/9/2024	6/25/2026	high
191774	SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:0800-1)	Nessus	SuSE Local Security Checks	3/9/2024	6/25/2026	high
311874	RHCOS 4 : OpenShift Container Platform 4.15.28 (RHSA-2024:5442)	Nessus	Red Hat Local Security Checks	5/4/2026	5/4/2026	critical
292620	MiracleLinux 8 : container-tools:rhel8 (AXSA:2024-8911:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
292954	MiracleLinux 9 : buildah-1.33.7-2.el9_4 (AXSA:2024-8286:05)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium
293152	MiracleLinux 9 : delve-1.21.2-2.el9, golang-1.21.9-2.el9 (AXSA:2024-7759:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high

Detections

Analytics

Plugins Search

medium

high

high

critical

high

medium

high