The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22189 advisory.

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause     its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old     connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID`     frame. The attacker can prevent the receiver from sending out (the vast majority of) these     `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging     received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the     issue. No known workarounds are available. (CVE-2024-22189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
193706	CBL Mariner 2.0 Security Update: coredns (CVE-2024-22189)	Nessus	MarinerOS Local Security Checks	4/23/2024	4/23/2024	high
203015	openSUSE 15 Security Update : caddy (openSUSE-SU-2024:0211-1)	Nessus	SuSE Local Security Checks	7/23/2024	7/23/2024	high

Detections

Analytics

Plugins Search

high

high