The version of coredns installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-22189 advisory.

  - quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.42.0, an attacker can cause     its peer to run out of memory sending a large number of `NEW_CONNECTION_ID` frames that retire old     connection IDs. The receiver is supposed to respond to each retirement frame with a `RETIRE_CONNECTION_ID`     frame. The attacker can prevent the receiver from sending out (the vast majority of) these     `RETIRE_CONNECTION_ID` frames by collapsing the peers congestion window (by selectively acknowledging     received packets) and by manipulating the peer's RTT estimate. Version 0.42.0 contains a patch for the     issue. No known workarounds are available. (CVE-2024-22189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
193706	CBL Mariner 2.0 Security Update: coredns (CVE-2024-22189)	Nessus	MarinerOS Local Security Checks	2024/4/23	2024/4/23	high
203015	openSUSE 15 Security Update : caddy (openSUSE-SU-2024:0211-1)	Nessus	SuSE Local Security Checks	2024/7/23	2024/7/23	high

検出

プラグインの検索

high

high