遠端主機上安裝的 runc 版本低於 1.3.2-2。因此，會受到 ALAS2NITRO-ENCLAVES-2025-072 公告中所提及的多個弱點影響。

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-31133)

    net/url未充分驗證括弧中的 IPv6 主機名稱

    Parse 函式允許將 IPv6 位址以外的值包含在 URL 主機元件的方括弧中。RFC 3986 允許將 IPv6 位址包含在主機元件內並用方括弧括起來。例如http://[::1]/。IPv4 位址和主機名稱不得出現在方括弧內。Parse 並未強制執行此需求。 (CVE-2025-47912)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52565)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52881)

    archive/tar剖析 GNU sparse 地圖時的無限製配置

    tar.Reader 並未在 GNU tar pax 1.0 sparse 檔案中的疏鬆區域資料區塊數上設定大小上限。包含大量疏鬆區域的惡意特製封存可造成 Reader 將無限量的資料從封存讀取到記憶體中。從壓縮來源讀取時小型的壓縮輸入可導致大型配置。 (CVE-2025-58183)

    編碼/asn1剖析 DER 承載時預先配置記憶體可造成記憶體耗盡

    剖析 DER 承載時會在完整驗證承載之前配置記憶體。這會允許攻擊者特製大型的空 DER 承載在 asn1.Unmarshal、x509.ParseCertificateRequest 和 ocsp.ParseResponse 等函式中造成記憶體耗盡。 (CVE-2025-58185)

    net/http剖析 cookie 時缺少限制會造成記憶體耗盡

    儘管 HTTP 標頭具有 1 MB 的預設限制可剖析的 cookie 數量沒有限制。攻擊者可傳送大量非常小的 cookie (例如 a=;)讓 HTTP 伺服器配置大量造成大量記憶體消耗。

    net/http 現已將接受的 Cookie 數量限制為 3000這可使用 httpcookiemaxnum GODEBUG 選項進行調整。 (CVE-2025-58186)

    crypto/x509檢查名稱限制時的二次方復雜度

    由於名稱限制檢查演算法的設計某些輸入的處理時間會隨著憑證大小而呈非線形增加。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58187)

    crypto/x509使用 DSA 公開金鑰驗證憑證時發生錯誤

    驗證包含 DSA 公開金鑰的憑證鏈可能導致程式發生錯誤這是因為介面轉換假設其實作 Equal 方法所致。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58188)

    crypto/tlsALPN 交涉錯誤可包含任意文字

    ALPN 交涉失敗時crypto/tls conn.Handshake 方法會在伺服器端傳回錯誤其中可能包含連線用戶端所提供且未逸出由攻擊者控制的任意資訊。

    這會影響在沒有任何其他形式清理的情況下記錄這些錯誤的程式且可能允許攻擊者將控制的資訊插入記錄中。 (CVE-2025-58189)

    編碼/pem剖析某些無效輸入時的二次方復雜度

    由於 PEM 剖析函式的設計某些輸入的處理時間會相對於輸入的大小呈非線性增長。

    這會影響剖析未受信任之 PEM 輸入的程式。 (CVE-2025-61723)

    net/textprotoReader.ReadResponse 中過度消耗 CPU

    Reader.ReadResponse 函式透過重複的字串串連建構回應字串。當回應中的行數很大時可造成過度消耗 CPU。
    (CVE-2025-61724)

    net/mailParseAddress 中 CPU 過度消耗

    ParseAddress 函式透過重複的字串串連建構網域常值位址元件。剖析大型 domain-literal 元件時可造成 CPU 過度消耗。
    (CVE-2025-61725)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The version of runc installed on the remote host is prior to 1.3.2-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-078 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:20957 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)

    * runc: container escape with malicious config due to /dev/console mount and related races     (CVE-2025-52565)

    * runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects     (CVE-2025-52881)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. Versions     1.0.0-rc3 through 1.2.7, 1.3.0-rc.1 through 1.3.2, and 1.4.0-rc.1 through 1.4.0-rc.2, due to insufficient     checks when bind-mounting `/dev/pts/$n` to `/dev/console` inside the container, an attacker can trick runc     into bind-mounting paths which would normally be made read-only or be masked onto a path that the attacker     can write to. This attack is very similar in concept and application to CVE-2025-31133, except that it     attacks a similar vulnerability in a different target (namely, the bind-mount of `/dev/pts/$n` to     `/dev/console` as configured for all containers that allocate a console). This happens after     `pivot_root(2)`, so this cannot be used to write to host files directly -- however, as with     CVE-2025-31133, this can load to denial of service of the host or a container breakout by providing the     attacker with a writable copy of `/proc/sysrq-trigger` or `/proc/sys/kernel/core_pattern` (respectively).
    This issue is fixed in versions 1.2.8, 1.3.3 and 1.4.0-rc.3. (CVE-2025-52565)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1286 advisory.

    Placeholder CVE. Details forthcoming (CVE-2025-31133)

    net/url: insufficient validation of bracketed IPv6 hostnames

    The Parse function permitted values other than IPv6 addresses to be included in square brackets within the     host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component,     enclosed within square brackets. For example: http://[::1]/. IPv4 addresses and hostnames must not     appear within square brackets. Parse did not enforce this requirement. (CVE-2025-47912)

    Placeholder CVE. Details forthcoming (CVE-2025-52565)

    Placeholder CVE. Details forthcoming (CVE-2025-52881)

    archive/tar: unbounded allocation when parsing GNU sparse map

    tar.Reader did not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse     files. A maliciously-crafted archive containing a large number of sparse regions could cause a Reader to     read an unbounded amount of data from the archive into memory. When reading from a compressed source, a     small compressed input could result in large allocations. (CVE-2025-58183)

    encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion

    When parsing DER payloads, memories were being allocated prior to fully validating the payloads.This     permits an attacker to craft a big empty DER payload to cause memory exhaustion in functions such as     asn1.Unmarshal, x509.ParseCertificateRequest, and ocsp.ParseResponse. (CVE-2025-58185)

    net/http: lack of limit when parsing cookies can cause memory exhaustion

    Despite HTTP headers having a default limit of 1 MB, the number of cookies that can be parsed did not have     a limit.By sending a lot of very small cookies such as a=;, an attacker can make an HTTP server allocate     a large amount of structs, causing large memory consumption.

    net/http now limits the number of cookies accepted to 3000, which can be adjusted using the     httpcookiemaxnum GODEBUG option. (CVE-2025-58186)

    crypto/x509: quadratic complexity when checking name constraints

    Due to the design of the name constraint checking algorithm, the processing timeof some inputs scales non-     linearly with respect to the size of the certificate.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58187)

    crypto/x509: panic when validating certificates with DSA public keys

    Validating certificate chains which contain DSA public keys can cause programsto panic, due to a interface     cast that assumes they implement the Equal method.

    This affects programs which validate arbitrary certificate chains. (CVE-2025-58188)

    crypto/tls: ALPN negotiation errors can contain arbitrary text

    The crypto/tls conn.Handshake method returns an error on the server-side when ALPN negotation fails which     can contain arbitrary attacker controlled information provided by the client-side of the connection which     is not escaped.

    This affects programs which log these errors without any additional form of sanitization, and may allow     injection of attacker controlled information into logs. (CVE-2025-58189)

    encoding/pem: quadratic complexity when parsing some invalid inputs

    Due to the design of the PEM parsing function, the processing time for someinputs scales non-linearly with     respect to the size of the input.

    This affects programs which parse untrusted PEM inputs. (CVE-2025-61723)

    net/textproto: excessive CPU consumption in Reader.ReadResponse

    The Reader.ReadResponse function constructed a response string throughrepeated string concatenation of     lines. When the number of lines in a response is large,this could cause excessive CPU consumption.
    (CVE-2025-61724)

    net/mail: excessive CPU consumption in ParseAddress

    The ParseAddress function constructed domain-literal address components through repeated string     concatenation. When parsing large domain-literal components, this could cause excessive CPU consumption.
    (CVE-2025-61725)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - runc 是一種 CLI 工具，用於根據 OCI 規範產生並執行容器。1.0.0-rc3 至 1.2.7、1.3.0-rc.1 至 1.3.2以及 1.4.0-rc.1 至 1.4.0-rc.2 版本這是因為在 bind 掛載 `/dev/ 時的不充分檢查所導致pts/$n`複製到容器內的 `/dev/console`則攻擊者可誘騙 runc 進入 bind-mounting 路徑該路徑通常會設為唯讀或遮罩到攻擊者可寫入的路徑上。此攻擊在概念和應用程式上與 CVE-2025-31133極為相似但是它會攻擊不同目標中的類似弱點 (即組態的 `/dev/console` 之 `/dev/pts/$n` 的 bind-mount適用於配置主控台的所有容器)。這會發生在 `pivot_root(2)` 之後因此這無法用來直接寫入主機檔案 -- 不過如同 CVE-2025-31133情況一樣這可以透過為攻擊者提供`/proc/sysrq-trigger` 或 `/proc/sys/kernel/core_pattern` (分別) 的可寫入複本。
    此問題已在 1.2.8、 1.3.3 和 1.4.0-rc.3 版本中修正。 (CVE-2025-52565)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

因此，會受到 ALAS2023-2025-1286 公告中所提及的多個弱點影響。

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-31133)

    net/url未充分驗證括弧中的 IPv6 主機名稱

    Parse 函式允許將 IPv6 位址以外的值包含在 URL 主機元件的方括弧中。RFC 3986 允許將 IPv6 位址包含在主機元件內並用方括弧括起來。例如http://[::1]/。IPv4 位址和主機名稱不得出現在方括弧內。Parse 並未強制執行此需求。 (CVE-2025-47912)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52565)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52881)

    archive/tar剖析 GNU sparse 地圖時的無限製配置

    tar.Reader 並未在 GNU tar pax 1.0 sparse 檔案中的疏鬆區域資料區塊數上設定大小上限。包含大量疏鬆區域的惡意特製封存可造成 Reader 將無限量的資料從封存讀取到記憶體中。從壓縮來源讀取時小型的壓縮輸入可導致大型配置。 (CVE-2025-58183)

    編碼/asn1剖析 DER 承載時預先配置記憶體可造成記憶體耗盡

    剖析 DER 承載時會在完整驗證承載之前配置記憶體。這會允許攻擊者特製大型的空 DER 承載在 asn1.Unmarshal、x509.ParseCertificateRequest 和 ocsp.ParseResponse 等函式中造成記憶體耗盡。 (CVE-2025-58185)

    net/http剖析 cookie 時缺少限制會造成記憶體耗盡

    儘管 HTTP 標頭具有 1 MB 的預設限制可剖析的 cookie 數量沒有限制。攻擊者可傳送大量非常小的 cookie (例如 a=;)讓 HTTP 伺服器配置大量造成大量記憶體消耗。

    net/http 現已將接受的 Cookie 數量限制為 3000這可使用 httpcookiemaxnum GODEBUG 選項進行調整。 (CVE-2025-58186)

    crypto/x509檢查名稱限制時的二次方復雜度

    由於名稱限制檢查演算法的設計某些輸入的處理時間會隨著憑證大小而呈非線形增加。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58187)

    crypto/x509使用 DSA 公開金鑰驗證憑證時發生錯誤

    驗證包含 DSA 公開金鑰的憑證鏈可能導致程式發生錯誤這是因為介面轉換假設其實作 Equal 方法所致。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58188)

    crypto/tlsALPN 交涉錯誤可包含任意文字

    ALPN 交涉失敗時crypto/tls conn.Handshake 方法會在伺服器端傳回錯誤其中可能包含連線用戶端所提供且未逸出由攻擊者控制的任意資訊。

    這會影響在沒有任何其他形式清理的情況下記錄這些錯誤的程式且可能允許攻擊者將控制的資訊插入記錄中。 (CVE-2025-58189)

    編碼/pem剖析某些無效輸入時的二次方復雜度

    由於 PEM 剖析函式的設計某些輸入的處理時間會相對於輸入的大小呈非線性增長。

    這會影響剖析未受信任之 PEM 輸入的程式。 (CVE-2025-61723)

    net/textprotoReader.ReadResponse 中過度消耗 CPU

    Reader.ReadResponse 函式透過重複的字串串連建構回應字串。當回應中的行數很大時可造成過度消耗 CPU。
    (CVE-2025-61724)

    net/mailParseAddress 中 CPU 過度消耗

    ParseAddress 函式透過重複的字串串連建構網域常值位址元件。剖析大型 domain-literal 元件時可造成 CPU 過度消耗。
    (CVE-2025-61725)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上安裝的 runc 版本低於 1.3.2-2。因此，會受到 ALAS2DOCKER-2025-078 公告中所提及的多個弱點影響。

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-31133)

    net/url未充分驗證括弧中的 IPv6 主機名稱

    Parse 函式允許將 IPv6 位址以外的值包含在 URL 主機元件的方括弧中。RFC 3986 允許將 IPv6 位址包含在主機元件內並用方括弧括起來。例如http://[::1]/。IPv4 位址和主機名稱不得出現在方括弧內。Parse 並未強制執行此需求。 (CVE-2025-47912)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52565)

    預留位置 CVE。詳細資訊即將發佈 (CVE-2025-52881)

    archive/tar剖析 GNU sparse 地圖時的無限製配置

    tar.Reader 並未在 GNU tar pax 1.0 sparse 檔案中的疏鬆區域資料區塊數上設定大小上限。包含大量疏鬆區域的惡意特製封存可造成 Reader 將無限量的資料從封存讀取到記憶體中。從壓縮來源讀取時小型的壓縮輸入可導致大型配置。 (CVE-2025-58183)

    編碼/asn1剖析 DER 承載時預先配置記憶體可造成記憶體耗盡

    剖析 DER 承載時會在完整驗證承載之前配置記憶體。這會允許攻擊者特製大型的空 DER 承載在 asn1.Unmarshal、x509.ParseCertificateRequest 和 ocsp.ParseResponse 等函式中造成記憶體耗盡。 (CVE-2025-58185)

    net/http剖析 cookie 時缺少限制會造成記憶體耗盡

    儘管 HTTP 標頭具有 1 MB 的預設限制可剖析的 cookie 數量沒有限制。攻擊者可傳送大量非常小的 cookie (例如 a=;)讓 HTTP 伺服器配置大量造成大量記憶體消耗。

    net/http 現已將接受的 Cookie 數量限制為 3000這可使用 httpcookiemaxnum GODEBUG 選項進行調整。 (CVE-2025-58186)

    crypto/x509檢查名稱限制時的二次方復雜度

    由於名稱限制檢查演算法的設計某些輸入的處理時間會隨著憑證大小而呈非線形增加。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58187)

    crypto/x509使用 DSA 公開金鑰驗證憑證時發生錯誤

    驗證包含 DSA 公開金鑰的憑證鏈可能導致程式發生錯誤這是因為介面轉換假設其實作 Equal 方法所致。

    這會影響驗證任意憑證鏈的程式。 (CVE-2025-58188)

    crypto/tlsALPN 交涉錯誤可包含任意文字

    ALPN 交涉失敗時crypto/tls conn.Handshake 方法會在伺服器端傳回錯誤其中可能包含連線用戶端所提供且未逸出由攻擊者控制的任意資訊。

    這會影響在沒有任何其他形式清理的情況下記錄這些錯誤的程式且可能允許攻擊者將控制的資訊插入記錄中。 (CVE-2025-58189)

    編碼/pem剖析某些無效輸入時的二次方復雜度

    由於 PEM 剖析函式的設計某些輸入的處理時間會相對於輸入的大小呈非線性增長。

    這會影響剖析未受信任之 PEM 輸入的程式。 (CVE-2025-61723)

    net/textprotoReader.ReadResponse 中過度消耗 CPU

    Reader.ReadResponse 函式透過重複的字串串連建構回應字串。當回應中的行數很大時可造成過度消耗 CPU。
    (CVE-2025-61724)

    net/mailParseAddress 中 CPU 過度消耗

    ParseAddress 函式透過重複的字串串連建構網域常值位址元件。剖析大型 domain-literal 元件時可造成 CPU 過度消耗。
    (CVE-2025-61725)

Tenable 已直接從所測試產品的安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
274467	Amazon Linux 2runc --advisory ALAS2NITRO-ENCLAVES-2025-072 (ALASNITRO-ENCLAVES-2025-072)	Nessus	Amazon Linux Local Security Checks	2025/11/7	2025/11/7	high
274502	Amazon Linux 2 : runc, --advisory ALAS2DOCKER-2025-078 (ALASDOCKER-2025-078)	Nessus	Amazon Linux Local Security Checks	2025/11/7	2025/11/7	high
274764	RHEL 9 : runc (RHSA-2025:20957)	Nessus	Red Hat Local Security Checks	2025/11/11	2025/11/11	high
272310	Linux Distros Unpatched Vulnerability : CVE-2025-52565	Nessus	Misc.	2025/11/5	2025/11/8	high
274691	Amazon Linux 2023 : runc (ALAS2023-2025-1286)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2025/11/11	high
272310	Linux Distros 未修補的弱點：CVE-2025-52565	Nessus	Misc.	2025/11/5	2025/11/8	high
274691	Amazon Linux 2023：runc (ALAS2023-2025-1286)	Nessus	Amazon Linux Local Security Checks	2025/11/11	2025/11/11	high
274502	Amazon Linux 2runc --advisory ALAS2DOCKER-2025-078 (ALASDOCKER-2025-078)	Nessus	Amazon Linux Local Security Checks	2025/11/7	2025/11/7	high

検出

プラグインの検索

high

high

high

high

high

high

high

high