因此，會受到 ALAS2023-2025-1078 公告中所提及的多個弱點影響。

    使用含有 ExtKeyUsageAny 的 VerifyOptions.KeyUsages 呼叫 Verify 時，意外停用了原則驗證。這只會影響包含原則圖形的憑證鏈，此情形相當罕見。
    (CVE-2025-22874)

    Proxy-Authorization 和 Proxy-Authenticate 標頭持續存在於跨來源重新導向上，可能會洩漏敏感資訊。 (CVE-2025-4673)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

因此，會受到 ALAS2023-2025-1077 公告中所提及的多個弱點影響。

    使用含有 ExtKeyUsageAny 的 VerifyOptions.KeyUsages 呼叫 Verify 時，意外停用了原則驗證。這只會影響包含原則圖形的憑證鏈，此情形相當罕見。
    (CVE-2025-22874)

    Proxy-Authorization 和 Proxy-Authenticate 標頭持續存在於跨來源重新導向上，可能會洩漏敏感資訊。 (CVE-2025-4673)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 ecs-init 版本低於 1.96.0-1。因此，會受到 ALAS2ECS-2025-074 公告中所提及的多個弱點影響。

    使用含有 ExtKeyUsageAny 的 VerifyOptions.KeyUsages 呼叫 Verify 時，意外停用了原則驗證。這只會影響包含原則圖形的憑證鏈，此情形相當罕見。
    (CVE-2025-22874)

    Proxy-Authorization 和 Proxy-Authenticate 標頭持續存在於跨來源重新導向上，可能會洩漏敏感資訊。 (CVE-2025-4673)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1109 advisory.

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy     validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
    (CVE-2025-22874)

    Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking     sensitive information. (CVE-2025-4673)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1029 advisory.

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    After analysis, we have determined that 2025-22872 do not pose a security risk to docker or containerd on     Amazon Linux 2 or Amazon Linux 2023. Source code analysis using govulncheck has confirmed that these     packages do not contain the vulnerable code. As a result, no security patches are required for these     specific packages on AL2 and AL2023. (CVE-2025-22872)

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy     validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
    (CVE-2025-22874)

    Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking     sensitive information. (CVE-2025-4673)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of amazon-cloudwatch-agent installed on the remote host is prior to 1.300055.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2904 advisory.

    The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character     (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked     as self-closing, and when using the Parse functions, this can result in content following such tags as     being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g.
    <math>, <svg>, etc contexts).

    After analysis, we have determined that 2025-22872 do not pose a security risk to docker or containerd on     Amazon Linux 2 or Amazon Linux 2023. Source code analysis using govulncheck has confirmed that these     packages do not contain the vulnerable code. As a result, no security patches are required for these     specific packages on AL2 and AL2023. (CVE-2025-22872)

    Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy     validation. This only affected certificate chains which contain policy graphs, which are rather uncommon.
    (CVE-2025-22874)

    Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking     sensitive information. (CVE-2025-4673)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01846-1 advisory.

    go1.24.4 (released 2025-06-05) includes security fixes to the     crypto/x509, net/http, and os packages, as well as bug fixes to     the linker, the go command, and the hash/maphash and os packages.
    ( bsc#1236217 go1.24 release tracking CVE-2025-22874 CVE-2025-0913 CVE-2025-4673)

    * CVE-2025-22874: crypto/x509: ExtKeyUsageAny bypasses policy validation (bsc#1244158)
    * CVE-2025-0913: os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows (bsc#1244157)
    * CVE-2025-4673: net/http: sensitive headers not cleared on cross-origin redirect (bsc#1244156)
    * os: Root.Mkdir creates directories with zero permissions on OpenBSD
    * hash/maphash: hashing channels with purego impl. of maphash.Comparable panics
    * runtime/debug: BuildSetting does not document DefaultGODEBUG
    * cmd/go: add fips140 module selection mechanism
    * cmd/link: Go 1.24.3 and 1.23.9 regression - duplicated definition of symbol dlopen
    * CVE-2025-22873: os: Root permits access to parent directory

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
241716	Amazon Linux 2023：runc (ALAS2023-2025-1078)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2025/7/14	high
241724	Amazon Linux 2023：containerd、containerd-stress (ALAS2023-2025-1077)	Nessus	Amazon Linux Local Security Checks	2025/7/10	2025/7/14	high
243199	Amazon Linux 2：ecs-init (ALASECS-2025-074)	Nessus	Amazon Linux Local Security Checks	2025/7/30	2025/7/30	high
243480	Amazon Linux 2023 : ecs-init (ALAS2023-2025-1109)	Nessus	Amazon Linux Local Security Checks	2025/8/4	2025/8/4	high
240325	Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1029)	Nessus	Amazon Linux Local Security Checks	2025/6/23	2025/6/23	medium
240451	Amazon Linux 2 : amazon-cloudwatch-agent (ALAS-2025-2904)	Nessus	Amazon Linux Local Security Checks	2025/6/25	2025/7/4	medium
238043	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:01846-1)	Nessus	SuSE Local Security Checks	2025/6/10	2025/7/4	high

検出

プラグインの検索

high

high

high

high

medium

medium

high