The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-17957 advisory.

  - Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause     an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes. (CVE-2022-30634)

  - Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom     application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the     case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI.
    In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application     images were found to have no authentication (in the form of firmware signing) and only relied on insecure     checksums for regular integrity checks. (CVE-2022-30269)

  - Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go     1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack. (CVE-2022-29804)

  - Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in     the working directory named either ..com or ..exe by calling Cmd.Run, Cmd.Start, Cmd.Output, or     Cmd.CombinedOutput when Cmd.Path is unset. (CVE-2022-30580)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : ol8addon (ELSA-2022-17957)

high Nessus Plugin ID 163027

Version 1.5