There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. (CVE-2023-31582)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - v0.9.3 之前的 jose4j 允許攻擊者設定 1000 或以下的低反覆數計數。 (CVE-2023-31582)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - v0.9.3 之前的 jose4j 允许攻击者设置 1000 或更少的低迭代计数。 (CVE-2023-31582)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Azure CycleCloud 產品缺少安全性更新。因此，該應用程式受到權限提高弱點影響。攻擊者若成功利用此弱點，即可在受影響的 Azure CycleCloud 執行個體中將權限提升為 SuperUser 角色的權限。
攻擊者必須擁有受指派的使用者角色帳戶才能利用此弱點。

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Azure CycleCloud 产品缺少安全更新。因此，该工具受到权限提升漏洞的影响。成功利用此漏洞的攻击者可以在受影响的 Azure CycleCloud 实例中将权限提升为 SuperUser 角色。
攻击者必须被分配拥有 User 角色的帐户，才能利用此漏洞。

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモートの SUSE Linux SLES15ホストには、SUSE-SU-2024:0485-1 のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - v0.9.3 より前の jose4j では、攻撃者が反復カウントを 1000 以下に設定することが可能です。(CVE-2023-31582)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - v0.9.3 より前の jose4j では、攻撃者が反復カウントを 1000 以下に設定することが可能です。(CVE-2023-31582)

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Azure CycleCloud 製品にセキュリティ更新がありません。このため、権限昇格の脆弱性による影響を受けます。この脆弱性の悪用に成功した攻撃者は、影響を受ける Azure CycleCloud インスタンスの SuperUser ロールに権限を昇格する可能性があります。
この脆弱性を悪用するには、攻撃者はユーザーロールが割り当てられたアカウントを持っている必要があります。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0485-1 advisory.

    cobbler:

    - Build the appendline correctly for RHEL-family <= 9 (bsc#1216437)
    - Notify to 'systemd' when cobblerd startup is finished (bsc#1215982)
    - Enable ppc64(le) buildiso support (bsc#1214077)

    grafana-formula:

    - Version 0.10.0
      * Replace legacy message queue metrics with Salt queue metrics
      * Grafana formula should not be supported in a Proxy/Retail

    inter-server-sync:

    - Version 0.3.2-1
      * Fix conflict in rhndistchannelmap (bsc#1216114)

    jose4j:

    - CVE-2023-31582: Insecure Password-Based Encryption Iteration Count (bsc#1216609)

    liberate-formula:

    - Version 0.1.0
      * Provide liberate-formula, a formula for converting a system to SUSE Liberty Linux

    patterns-suse-manager:

    - Add liberate-formula to the required packages for the server       to get it installed by default

    prometheus-formula:

    - Version 0.8.0
      * Fix federation endpoint
      * Add remote write configuration
      * Add group filtering for service discovery relabeling         configuration
    - Version 0.7.1
      * Fix PrometheusNotIngestingSamples false positive alerts         (bsc#1216550)

    prometheus-postgres_exporter:

    - Do not build debug if RHEL >= 8
    - Do not strip if SUSE Linux Enterprise 15 SP3
    - Build at least with with Go >= 1.18 on RHEL
    - Build with Go >= 1.20 elsewhere

    saltboot-formula:

    - Update to version 0.1.1701196218.b6b8ca1
      * Remove f-formating to be compatible with python < 3.6
      * Update packaging not to package salt directories
    - Update to version 0.1.1692188980.9aa0455

    spacecmd:

    - Version 4.3.26-1
      * Update translation strings

    spacewalk-backend:

    - Version 4.3.27-1
      * Fix issue in 'spacewalk-repo-sync' when RPM packages contains files with         size greater than 4GB (bsc#1219151)
    - Version 4.3.26-1
      * Fix decompressing and renaming bzip2 comps files in reposync
      * Update query to the new credentials structure
      * Remove normalize_orphan_vendor_packages and move it to taskomatic (bsc#1216781)
      * Skip syncing packages with incorrect metadata (bsc#1213738)
      * Update translation strings

    spacewalk-certs-tools:

    - version 4.3.22-1
      * Skip deploying the CA into the Salt directory on proxies (bsc#1219850)
    - Version 4.3.21-1
      * Deploy the CA certificate also into the Salt filesystem (bsc#1219577)
    - Version 4.3.20-1
      * Handle server keys in PKCS8 format in mgr-ssl-cert-setup (bsc#1218615)
      * Include reboot info beacon in the bootstrap script for transactional systems (bsc#1217588)

    spacewalk-client-tools:

    - Version 4.3.18-1
      * Update translation strings

    spacewalk-java:

    - Version 4.3.71-1
      * Generate server SSH key also when bootstrapping regular Minions (bsc#1219449)
    - Version 4.3.70-1
      * Fix the use of page size preference in systems and packages lists (bsc#1217209)
      * Fix issue with disabling token check not working (bsc#1218669)
      * Enforce snakeyaml version requirement (bsc#1215166)
      * Improve the performance of paginated queries when syncing the         reporting database (bsc#1211912, bsc#1213079)
      * Do not require entitlement for Pay-as-you-go SUSE Linux Enterprise Server for SAP (bsc#1217069)
      * Use the base product file to show the correct SUSE Manager         product in the subscription matching results page
      * Do not require entitlements if SUSE Manager is Pay-as-you-go
      * Exclude SUSE Manager from subscription matching if it's Pay-as-you-go
      * Refactor Credentials to a proper class hierarchy
      * Fix unit test about duplicated packages
      * Prevent installation of packages with same name         in a single action (bsc#1214791)
      * When canceling an action which has prerequisites, return hints to         get the first action id which can be canceled (bsc#1216988)
      * Fix exception when removing a Debian package (bsc#1216781)
      * Fix XSS in taskomatic XML RPC handler (bsc#1210911)
      * Improve logging for Product Migration (bsc#1218490)
      * Add only 1 IP for Cloud RMT Host in /etc/hosts
      * Change org for orphan vendor packages that an admin can delete (bsc#1216781)
      * Expose the monitoring data for the Salt queue handling the Salt results
      * Provide total number of CPUs for SUSE Linux Enterprise Micro systems to subscription matcher         when it is not used as hypervisor to match vCore subscriptions correctly         (bsc#1218074)
      * Try to download compressed Ubuntu USN database
      * Add user information to system organization transfer message (bsc#1216753)
      * CVE-2023-32189: Fix issue with Salt SSH keys for Salt SSH Minions (bsc#1170848)
      * Add notification in daily email in addition to in SUSE Manager home page when         SUSE Manager Pay-as-you-go is not compliant
      * Fix apidoc link from #top to $call.name (bsc#1213507)
      * Add config option to disable remote commands from web UI (bsc#1217869)
      * Address high rating Sonar issues
      * Refactor SUSE Customer Center registration flow
      * Avoid blocking Taskomatic thread when waiting for queued action (bsc#1211560)
      * Fix modify kickstart profile when using 'Always newest tree' option (bsc#1215813)
      * Configure reboot method for SUSE Linux Enterprise Micro when applying bootstrap state (bsc#1213981)
      * Handle not existing known_host file in permission check
      * Fix handling of proxy ssh public keys
      * Include reboot required indication for non-Suse distros

    spacewalk-setup:

    - Version 4.3.19-1
      * Update query to the new credentials structure
      * Fix setting SUSE Customer Center password during setup

    spacewalk-utils:

    - Version 4.3.19-1
      * Add SUSE Linux Enterprise Micro 5.4 and 5.5 to spacewalk-commons-channels

    spacewalk-web:

    - Version 4.3.37-1
      * Fix the use of page size preference in systems and packages lists (bsc#1217209)
      * Fix issue displaying Ansible playbook name (bsc#1216657)
      * Add support for `PaygNotCompliantWarning` notification
      * Bump web.version to 4.3.11

    subscription-matcher:

    - Version 0.35
      * Added missing part number
    - Version 0.34
      * Enabled support for Long Term Service Pack Support subscriptions (bsc#1218075)
      * Added SUSE Linux Enterprise Micro vCore handling (bsc#1218074)
      * Added new SKUs and new bundles

    supportutils-plugin-susemanager:

    - Version 4.3.10-1
      * Update query to the new credentials structure

    susemanager:

    - Version 4.3.34-1
      * Rename Open Enterprise Server label to OES23.4 (bsc#1215514)
      * Verify in Yast FQDN with name returned via DNS reverse lookup
      * CVE-2023-32189: Fix issue with Salt SSH keys for Salt SSH Minions (bsc#1170848)

    susemanager-build-keys:

    - Version 15.4.10
      * Add new Almalinux 8 GPG Key (bsc#1218849)
      * Refresh extended Uyuni GPG public key

    susemanager-docs_en:

    - Removed obsolete traditional to Salt migration documentation from       the System Types section of the Client Configuration Guide and       updated the Migrate traditional clients to Salt clients section
    - Fixed navigation bar of Client Configuration Guide (bsc#1218089)
    - Added openSUSE Leap to Supported Features navigation list in Client       Configuration Guide (bsc#1218094)
    - Described new monitoring metrics for Salt queue in Administration       Guide
    - Fixed xrefs for internal book references
    - Removed mentioning that CVE number for CVE auditing is optional       (bsc#1218019)
    - Corrected channel names for CentOS 7 Updates and Extras in CentOS       Client Configuration Guide
    - Documented bootstrap settings for SUSE Linux Enterprise Micro in       Client Configuration Guide (bsc#1216394)
    - Corrected command mgr-push to mgrpush in Administration Guide       (bsc#1215810)
    - Updated Red Hat OVAL data URL and file in CentOS Clients Registration       in Client Configution Guide
    - Added Pay-as-you-go for Azure documentation to the Specialized Guides       book
    - Added Pay-as-you-go limitations chapter to Pay-as-you-go Guide
    - Removed Ubuntu 18.04 from the list of supported clients
    - Fixed file location in Custom Salt Formulas section of Salt Guide
    - Documented using Virtualization Host formula in Client Configuration

    susemanager-schema:

    - Version 4.3.24-1
      * Refactor susecredentials to support the new hierarchy
      * Improve performance of System (bsc#1211254)
      * Change schedule of system-profile-refresh to run on the 2nd Saturday         of a month to not collide with normal working times (bsc#1215769)

    susemanager-sls:

    - version 4.3.40-1
      * Remove automatic reboot from transactional systems bootstrap (bsc#1218146)
    - Version 4.3.39-1
      * Change certs/RHN-ORG-TRUSTED-SSL-CERT from symlink into a real file (bsc#1219577)
    - Version 4.3.38-1
      * Improve Pay-as-you-go instance detection (bsc#1217784)
      * CVE-2023-32189: Fix issue with Salt SSH keys for Salt SSH Minions (bsc#1170848)
      * Configure reboot method for SUSE Linux Enterprise Micro when applying bootstrap state (bsc#1213981)
      * Include reboot required indication for non SUSE distros

    susemanager-sync-data:

    - Version 4.3.16-1
      * Fix OES 23.4 internal name (bsc#1218837)
    - Version 4.3.15-1
      * Update release status and repository description of Open Enterprise Server 23.4 (bsc#1215514)
      * Add new SUSE Liberty Linux 7 Long Term Service Pack Support channel families
      * Rename Red Hat Enterprise Linux and Liberty 8 Base product to remove EOL CentOS 8 from the name

    uyuni-reportdb-schema:

    - Version 4.3.9-1
      * Provide reportdb upgrade schema path structure

    How to apply this update:

    1. Log in as root user to the SUSE Manager Server.
    2. Stop the Spacewalk service:
    `spacewalk-service stop`     3. Apply the patch using either zypper patch or YaST Online Update.
    4. Start the Spacewalk service:
    `spacewalk-service start`

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. (CVE-2023-31582)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Azure CycleCloud product is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability. The attacker who successfully exploited this vulnerability could elevate privileges to the SuperUser role in the affected Azure CycleCloud instance.
To exploit this vulnerability an attacker must have an account with the User role assigned.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
412040	SCA: security update for org.bitbucket.b_c:jose4j (GHSA-7g24-qg88-p43q)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
412040	SCA: security update for org.bitbucket.b_c:jose4j (GHSA-7g24-qg88-p43q)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
255520	Linux Distros 未修補的弱點：CVE-2023-31582	Nessus	Misc.	8/26/2025	8/4/2026	high
255520	Linux Distros 未修补的漏洞：CVE-2023-31582	Nessus	Misc.	8/26/2025	8/4/2026	high
202026	Azure CycleCloud 的安全性更新 (2024 年 7 月)	Nessus	Web Servers	7/9/2024	7/10/2024	high
202026	Azure CycleCloud 的安全更新（2024 年 7 月）	Nessus	Web Servers	7/9/2024	7/10/2024	high
190654	SUSE SLES15 セキュリティ更新プログラム : SUSE Manager Server 4.3 (SUSE-SU-2024:0485-1)	Nessus	SuSE Local Security Checks	2/17/2024	6/25/2026	medium
255520	Linux Distros のパッチ未適用の脆弱性: CVE-2023-31582	Nessus	Misc.	8/26/2025	8/4/2026	high
202026	Azure CycleCloud のセキュリティ更新 (2024 年 7 月)	Nessus	Web Servers	7/9/2024	7/10/2024	high
190654	SUSE SLES15: cobbler / grafana-formula / inter-server-sync / jose4j / etc (SUSE-SU-2024:0485-1)	Nessus	SuSE Local Security Checks	2/17/2024	6/25/2026	medium
255520	Linux Distros Unpatched Vulnerability : CVE-2023-31582	Nessus	Misc.	8/26/2025	8/4/2026	high
202026	Security Updates for Azure CycleCloud (July 2024)	Nessus	Web Servers	7/9/2024	7/10/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

medium

high

high

medium

high

high