An update of the nerdctl package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6938 advisory.

    - rebuild for CVE-2023-29406
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539     CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539     CVE-2023-24540 CVE-2023-29400
    - rebuild for CVE-2023-29406
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723     CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2022-41724
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723     CVE-2023-24539 CVE-2023-24540 CVE-2023-29400

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12578 advisory.

    - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
    - rootfs: prohibit symlinks that conflicts with readonlyPaths               and/or maskedPaths to prevent CVE-2023-27561
    - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1726-1 advisory.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2023-024 advisory.

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of runc installed on the remote host is prior to 1.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-025 advisory.

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:4093 advisory.

  - An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote,     authenticated attacker who has been given permissions update, patch the pods/ephemeralcontainers     subresource beyond what the default is. They would then need to create a new pod or patch one that they     already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of     a privileged pod. (CVE-2023-1260)

  - HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.
    (CVE-2023-24534)

  - Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=. (CVE-2023-24536)

  - Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow. (CVE-2023-24537)

  - Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution. (CVE-2023-24538)

  - Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input. (CVE-2023-24539)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags. (CVE-2023-29400)

  - A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when     FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. (CVE-2023-3089)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. (CVE-2023-25809)

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the podman package has been released.

An update of the docker package has been released.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3369 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3369-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     March 27, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : runc     Version        : 1.0.0~rc6+dfsg1-3+deb10u2     CVE ID         : CVE-2019-16884 CVE-2019-19921 CVE-2021-30465 CVE-2022-29162                      CVE-2023-27561     Debian Bug     : 942026 988768

    Multiple vulnerabilities were discovered in runc, the Open Container     Project runtime, which is often used with virtualization environments     such as Docker. Malicious Docker images or OCI bundles could breach     isolation.

    CVE-2019-16884

        runc, as used in Docker and other products, allows AppArmor and         SELinux restriction bypass because libcontainer/rootfs_linux.go         incorrectly checks mount targets, and thus a malicious Docker         image can mount over a /proc directory.

    CVE-2019-19921

        runc has Incorrect Access Control leading to Escalation of         Privileges, related to libcontainer/rootfs_linux.go. To exploit         this, an attacker must be able to spawn two containers with custom         volume-mount configurations, and be able to run custom         images. (This vulnerability does not affect Docker due to an         implementation detail that happens to block the attack.)

    CVE-2021-30465

        runc allows a Container Filesystem Breakout via Directory         Traversal. To exploit the vulnerability, an attacker must be able         to create multiple containers with a fairly specific mount         configuration. The problem occurs via a symlink-exchange attack         that relies on a race condition.

    CVE-2022-29162

        `runc exec --cap` created processes with non-empty inheritable         Linux process capabilities, creating an atypical Linux environment         and enabling programs with inheritable file capabilities to         elevate those capabilities to the permitted set during         execve(2). This bug did not affect the container security sandbox         as the inheritable set never contained more capabilities than were         included in the container's bounding set.

    CVE-2023-27561

        CVE-2019-19921 was re-introduced by the fix for CVE-2021-30465.

    For Debian 10 buster, this problem has been fixed in version     1.0.0~rc6+dfsg1-3+deb10u2.

    We recommend that you upgrade your runc packages.

    For the detailed security status of runc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/runc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6939 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * containerd: Supplementary groups are not set up properly (CVE-2023-25173)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

ID	名稱	產品	系列	已發布	已更新	嚴重性
203892	Photon OS 3.0: Nerdctl PHSA-2023-3.0-0608	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
186113	Oracle Linux 8 : container-tools:4.0 (ELSA-2023-6938)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	critical
175323	EulerOS 2.0 SP10 : docker-runc (EulerOS-SA-2023-1818)	Nessus	Huawei Local Security Checks	2023/5/9	2023/5/9	high
178580	Oracle Linux 8 : buildah (ELSA-2023-12578)	Nessus	Oracle Linux Local Security Checks	2023/7/20	2025/9/9	high
173902	SUSE SLES12 Security Update : runc (SUSE-SU-2023:1726-1)	Nessus	SuSE Local Security Checks	2023/4/5	2023/7/14	high
176752	Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2023-024)	Nessus	Amazon Linux Local Security Checks	2023/6/6	2024/12/11	high
176771	Amazon Linux 2 : runc (ALASDOCKER-2023-025)	Nessus	Amazon Linux Local Security Checks	2023/6/6	2024/12/11	high
189410	RHCOS 4 : OpenShift Container Platform 4.13.5 (RHSA-2023:4093)	Nessus	Red Hat Local Security Checks	2024/1/24	2024/1/24	critical
191195	CentOS 9 : runc-1.1.7-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
203522	Photon OS 4.0: Podman PHSA-2023-4.0-0429	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
204567	Photon OS 4.0: Docker PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
173457	Debian dla-3369 : golang-github-opencontainers-runc-dev - security update	Nessus	Debian Local Security Checks	2023/3/28	2025/1/22	high
185675	RHEL 8 : container-tools:rhel8 (RHSA-2023:6939)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/3/6	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical

偵測

搜尋 Plugin

high

critical

high

high

high

high

high

critical

high

high

high

high

critical

critical