The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5068 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * ignition: configs are accessible from unprivileged containers in VMs running on VMware products     (CVE-2022-1706)
    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
    * golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)
    * golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)
    * golang: crypto/elliptic: IsOnCurve returns true for invalid field elements (CVE-2022-23806)
    * golang: encoding/pem: fix stack overflow in Decode (CVE-2022-24675)
    * golang: regexp: stack exhaustion via a deeply nested expression (CVE-2022-24921)
    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
    * golang: crypto/elliptic: panic caused by oversized scalar (CVE-2022-28327)
    * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1762 advisory.

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1762 advisory.

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-21aa9bae12 advisory.

    Automatic update for golang-github-docker-distribution-2.8.1-2.20220821gitbc6b745.fc37.

    ##### **Changelog**

    ```
    * Sun Aug 21 2022 Robert-Andr Mauchin <zebob.m@gmail.com> 2.8.1-2
    - Update to 2.8.1, commit bc6b7455cb168d3000c18714ee1c57d2cd03b953 - Close:
      rhbz#2043861 rhbz#2067428 rhbz#2067396 rhbz#2045498
    * Sun Aug 21 2022 Robert-Andr Mauchin <zebob.m@gmail.com> 2.8.1-1
    - Update to 2.8.1, commit bc6b7455cb168d3000c18714ee1c57d2cd03b953 - Close:
      rhbz#2043861 rhbz#2067428 rhbz#2067396 rhbz#2045498
    * Wed Aug 10 2022 Maxwell G <gotmax@e.email> - 2.7.1-12
    - Rebuild to fix FTBFS
    * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-11
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Tue Jul 19 2022 Maxwell G <gotmax@e.email> - 2.7.1-10
    - Rebuild for CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in       golang
    * Sat Jun 18 2022 Robert-Andr Mauchin <zebob.m@gmail.com> - 2.7.1-9
    - Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,       CVE-2022-29526, CVE-2022-30629
    * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-8
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4363:06 advisory.

    * sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
      * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
      * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
      * grafana: XSS vulnerability in data source handling (CVE-2022-21702)
      * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
      * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
      * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
      * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
      * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
      * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working     (CVE-2022-32148)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:6061 advisory.

    The etcd packages provide a highly available key-value store for shared configuration.

    Security Fix(es):

    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:7519 advisory.

  - sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - grafana: XSS vulnerability in data source handling (CVE-2022-21702)

  - grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

  - grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7529 advisory.

  - golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

  - cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

  - golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

  - golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

  - golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

  - golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

  - golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

  - golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2839-1 advisory.

    Updated to version 3.4.7:
    - CVE-2022-1227: Fixed an issue that could allow an attacker to publish       a malicious image to a public registry and run arbitrary code in the       victim's context via the 'podman top' command (bsc#1182428).
    - CVE-2022-27191: Fixed a potential crash via SSH under specific       configurations (bsc#1197284).
    - CVE-2022-21698: Fixed a potential denial of service that affected       servers that used Prometheus instrumentation (bsc#1196338).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0425 advisory.

    This advisory aggregates security fixes for the grafana SRPM in CIQ LTS 9.2. It addresses 30 CVEs:
    CVE-2020-12459, CVE-2022-21698, CVE-2022-21673, CVE-2023-3128, CVE-2020-12458, and 25 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
164846	RHEL 8 : OpenShift Container Platform 4.11.0 (RHSA-2022:5068)	Nessus	Red Hat Local Security Checks	9/8/2022	11/8/2024	critical
161143	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:1762)	Nessus	Alma Linux Local Security Checks	5/12/2022	1/13/2025	high
358578	Rocky Linux 8 [CIQ] Security Update: aardvark-dns / buildah / buildah-debuginfo / buildah-debugsource / etc Multiple Vulnerabilities (crlsa-2022_1762)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
211424	Fedora 37 : golang-github-docker-distribution (2022-21aa9bae12)	Nessus	Fedora Local Security Checks	11/15/2024	11/15/2024	critical
293531	MiracleLinux 8 : grafana-7.5.15-3.el8 (AXSA:2022-4363:06)	Nessus	Miracle Linux Local Security Checks	1/20/2026	2/24/2026	high
164130	RHEL 8 : Red Hat OpenStack Platform 16.2 (etcd) (RHSA-2022:6061)	Nessus	Red Hat Local Security Checks	8/15/2022	11/7/2024	high
167149	CentOS 8 : grafana (CESA-2022:7519)	Nessus	CentOS Local Security Checks	11/9/2022	10/5/2023	high
167185	CentOS 8 : container-tools:3.0 (CESA-2022:7529)	Nessus	CentOS Local Security Checks	11/9/2022	10/5/2023	medium
164314	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2022:2839-1)	Nessus	SuSE Local Security Checks	8/20/2022	6/25/2026	high
354473	Rocky Linux 9.2 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (ciqsa-2026_0425)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	high

Detections

Analytics

Plugins Search

critical

high

high

critical

high

high

high

medium

high

high