According to the versions of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Zsh before 5.8, attackers able to execute commands     can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the     original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module     that calls setuid().(CVE-2019-20044)

  - In zsh before 5.3, an off-by-one error resulted in     undersized buffers that were intended to support     PATH_MAX characters.(CVE-2016-10714)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0735-1 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:0903 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:0903 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0853 advisory.

    The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command     processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports     command-line editing, built-in spelling correction, programmable command completion, shell functions (with     autoloading), a history mechanism, and more.

    Security Fix(es):

    * zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0892 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-55 (Zsh: Privilege escalation)

    It was discovered that Zsh was insecure dropping privileges when       unsetting PRIVILEGED option.
  Impact :

    An attacker could escalate privileges.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0978 advisory.

    The zsh shell is a command interpreter usable as an interactive login shell and as a shell script command     processor. Zsh resembles the ksh shell (the Korn shell), but includes many enhancements. Zsh supports     command-line editing, built-in spelling correction, programmable command completion, shell functions (with     autoloading), a history mechanism, and more.

    Security Fix(es):

    * zsh: insecure dropping of privileges when unsetting PRIVILEGED option (CVE-2019-20044)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the zsh package has been released.

According to the version of the zsh package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Zsh before 5.8, attackers able to execute commands     can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the     original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module     that calls setuid().(CVE-2019-20044)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has zsh packages installed that are affected by a vulnerability:

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0732-1 advisory.

  - In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED     option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing     MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). (CVE-2019-20044)

  - In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the     prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
    (CVE-2021-45444)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
137478	EulerOS 2.0 SP2 : zsh (EulerOS-SA-2020-1636)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/7	critical
158643	openSUSE 15 Security Update : zsh (openSUSE-SU-2022:0735-1)	Nessus	SuSE Local Security Checks	2022/3/5	2022/5/6	high
185061	Rocky Linux 8 : zsh (RLSA-2020:0903)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	high
157578	AlmaLinux 8 : zsh (ALSA-2020:0903)	Nessus	Alma Linux Local Security Checks	2022/2/9	2022/2/14	high
134672	RHEL 7 : zsh (RHSA-2020:0853)	Nessus	Red Hat Local Security Checks	2020/3/18	2024/11/7	high
134907	CentOS 6 : zsh (RHSA-2020:0892)	Nessus	CentOS Local Security Checks	2020/3/26	2024/10/9	high
134930	GLSA-202003-55 : Zsh: Privilege escalation	Nessus	Gentoo Local Security Checks	2020/3/26	2024/3/20	high
134939	RHEL 8 : zsh (RHSA-2020:0978)	Nessus	Red Hat Local Security Checks	2020/3/26	2024/11/7	high
135406	Photon OS 3.0: Zsh PHSA-2020-3.0-0073	Nessus	PhotonOS Local Security Checks	2020/4/12	2025/8/22	high
135870	Photon OS 2.0: Zsh PHSA-2020-2.0-0229	Nessus	PhotonOS Local Security Checks	2020/4/22	2024/7/22	high
140842	EulerOS 2.0 SP3 : zsh (EulerOS-SA-2020-2075)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	high
141407	NewStart CGSL MAIN 4.05 : zsh Vulnerability (NS-SA-2020-0051)	Nessus	NewStart CGSL Local Security Checks	2020/10/13	2021/1/14	high
158605	SUSE SLES15 Security Update : zsh (SUSE-SU-2022:0732-1)	Nessus	SuSE Local Security Checks	2022/3/5	2023/7/14	high

検出

プラグインの検索

critical

high

high

high

high

high

high

high

high

high

high

high

high