The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has containerd.io packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both. (CVE-2019-9514)

  - Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of     service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer     reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in     behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory,     or both. (CVE-2019-9515)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0705 advisory.

    - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image     build process'
    - rebuild because of CVE-2019-9512 and CVE-2019-9514
    - fix 'podman can not create user inside of container' regression introduced by       patch for CVE-2021-20188
    - fix CVE-2021-20188
    - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image     build process'
    - rebuild because of CVE-2019-9512 and CVE-2019-9514
    - rebuild because of CVE-2019-9512 and CVE-2019-9514
    - Resolves: CVE-2019-5736
    - Resolves: #1412239 - *CVE-2016-9962* - set init processes as non-dumpable,     runc patch from Michael Crosby <crosbymichael@gmail.com>
    - rebuild because of CVE-2019-9512 and CVE-2019-9514
    - backport fix for CVE-2020-7039
    - actually add CVE-2019-14378 patch to dist-git
    - Fix CVE-2019-14378 (#1768394).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues :

Security issues fixed :

CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).

CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).

CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).

CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).

CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes: Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).

Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).

Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).

docker-test: Improvements to test packaging (bsc#1128746).

Move daemon.json file to /etc/docker directory (bsc#1114832).

Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).

Fix go build failures (bsc#1121397).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the telegraf package has been released.

遠端 CentOS Linux 7 主機上安裝的套件受到 RHSA-2020:2653 公告中提及的多個弱點影響。

  - Docker Engine 1.12.2 啟用具有設定錯誤功能原則的環境功能。這允許惡意影像繞過使用者權限，以存取容器檔案系統或已掛載的磁碟區中的檔案。 (CVE-2016-8867)

  - 透過 RHBA-2020:0053 公告，針對 Red Hat Enterprise Linux 7 Extras 發布的 docker 版本包含錯誤的 runc 版本，缺少 CVE-2019-5736的修正，其先前已透過 RHSA-2019:0304修正。此問題可允許惡意或遭入侵的容器入侵容器主機和在相同主機上執行的其他容器。此問題只會影響 Red Hat Enterprise Linux 7 Extras 中隨附的 docker 1.13.1-108.git4ef4b30.el7 版。較舊和較新的版本均不會受到影響。 (CVE-2020-14298)

  - 透過 RHBA-2020:0053 針對 Red Hat Enterprise Linux 7 Extras 發布的 docker 套件版本 docker-1.13.1-108.git4ef4b30.el7 (https://access.redhat.com/errata/RHBA-2020:0053) 包含遺漏多個錯誤和安全性修正的錯誤 runc 版本。在該更新中回歸的修正之一是 CVE-2016-9962的修正，其先前已透過 RHSA-2017:0116 在 Red Hat Enterprise Linux 7 Extras 的 docker 套件中更正 (https://access.redhat.com/errata/RHSA-2017:0116)。 CVE-2020-14300 已指派給此安全性回歸，且其為 Red Hat 產生的 docker 套件專屬。
    原始問題 - CVE-2016-9962 - 可能允許容器內的處理程序入侵進入容器命名空間的處理程序，並在容器外執行任意程式碼。這可導致容器主機或相同容器主機上執行的其他容器遭到入侵。此問題只會影響 Red Hat Enterprise Linux 7 中隨附的單一 Docker 版本，即 1.13.1-108.git4ef4b30。
    較舊和較新的版本均不會受到影響。 (CVE-2020-14300)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

リモートの CentOS Linux 7 ホストに、RHSA-2020:2653 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  - Docker Engine 1.12.2 が、誤って構成された機能ポリシーでアンビエント機能を有効にしました。これにより、悪意のあるイメージがユーザー権限をバイパスして、コンテナファイルシステム内のファイルまたはマウントされたボリュームにアクセスすることが可能でした。 （CVE-2016-8867）

  - RHBA-2020:0053 アドバイザリで Red Hat Enterprise Linux 7 Extras 用にリリースされた docker のバージョンには、以前 CVE-2019-5736で修正された [ RHSA-2019:0304の修正がない不適切なバージョンの runc が含まれていました。この問題により、悪意のある、または危険にさらされているコンテナが、コンテナホストや同じホストで実行されている他のコンテナを侵害する可能性があります。この問題の影響を受けるのは、Red Hat Enterprise Linux 7 Extras で出荷された docker バージョン 1.13.1-108.git4ef4b30.el7 のみです。以前のバージョンと以降のバージョンの両方が影響を受けることはありません。 （CVE-2020-14298）

  - RHBA-2020:0053（https://access.redhat.com/errata/RHBA-2020:0053）を介して Red Hat Enterprise Linux 7 Extras 用にリリースされた docker パッケージバージョン docker-1.13.1-108.git4ef4b30.el7 に、複数のバグおよびセキュリティ修正がない不適切なバージョンの runc が含まれていました。その更新で回帰した修正の 1 つは CVE-2016-9962の修正で、これは以前 RHSA-2017:0116 を介して Red Hat Enterprise Linux 7 Extras の docker パッケージで修正されました（https://access.redhat.com/errata/RHSA-2017:0116）。このセキュリティリグレッションには CVE-2020-14300 が割り当てられました。これは、Red Hat が作成した docker パッケージに固有のものです。
    元の問題 - CVE-2016-9962 - により、コンテナ内のプロセスが、コンテナの名前空間に入るプロセスを侵害し、コンテナの外で任意のコードを実行する可能性があります。これにより、コンテナホストまたは同じコンテナホストで実行されている他のコンテナが侵害される可能性があります。この問題の影響を受けるのは、Red Hat Enterprise Linux 7 で出荷された 1 つのバージョンの Docker 1.13.1-108.git4ef4b30 のみです。
    以前のバージョンと以降のバージョンの両方が影響を受けることはありません。 （CVE-2020-14300）

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2653 advisory.

  - Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed     malicious images to bypass user permissions to access files within the container filesystem or mounted     volumes. (CVE-2016-8867)

  - The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory     included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via     RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container     host and other containers running on the same host. This issue only affects docker version     1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions     are not affected. (CVE-2020-14298)

  - The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7     Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version     of runc that was missing multiple bug and security fixes. One of the fixes regressed in that update was     the fix for CVE-2016-9962, that was previously corrected in the docker packages in Red Hat Enterprise     Linux 7 Extras via RHSA-2017:0116 (https://access.redhat.com/errata/RHSA-2017:0116). The CVE-2020-14300     was assigned to this security regression and it is specific to the docker packages produced by Red Hat.
    The original issue - CVE-2016-9962 - could possibly allow a process inside container to compromise a     process entering container namespace and execute arbitrary code outside of the container. This could lead     to compromise of the container host or other containers running on the same container host. This issue     only affects a single version of Docker, 1.13.1-108.git4ef4b30, shipped in Red Hat Enterprise Linux 7.
    Both earlier and later versions are not affected. (CVE-2020-14300)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程 CentOS Linux 7 主机上安装的程序包受到 RHSA-2020:2653 公告中提及的多个漏洞影响。

  - Docker Engine 1.12.2 启用了通过错误配置的功能策略的环境功能。这允许恶意图像绕过用户权限，以访问容器文件系统或挂载卷内的文件。 (CVE-2016-8867)

  - 通过 RHBA-2020:0053 公告针对 Red Hat Enterprise Linux 7 Extras 发布的 docker 版本包含错误的 runc 版本，缺少 CVE-2019-5736的修复，该漏洞之前已通过 RHSA-2019:0304修复。此问题可允许恶意或遭到入侵的容器入侵容器主机以及在同一主机上运行的其他容器。此问题仅影响 Red Hat Enterprise Linux 7 Extras 中随附的 docker 版本 1.13.1-108.git4ef4b30.el7。较早和较新的版本均不受影响。 (CVE-2020-14298)

  - 通过 RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) 针对 Red Hat Enterprise Linux 7 Extras 发布的 docker 程序包版本 docker-1.13.1-108.git4ef4b30.el7 包含错误版本的 runc，其缺少多个缺陷和安全修复。 CVE-2016-9962的修复是该更新中回归的补丁之一，该问题之前已在 Red Hat Enterprise Linux 7 Extras 中通过 RHSA-2017:0116 的 docker 程序包中修正 (https://access.redhat.com/errata/RHSA-2017:0116)。已为此安全回归分配了 CVE-2020-14300 ，它特定于 Red Hat 生成的 docker 程序包。
    原始问题 - CVE-2016-9962 - 可允许容器内的进程破坏进入容器命名空间的进程，并在容器外执行任意代码。这可导致容器主机或同一容器主机上运行的其他容器受损。此问题仅影响 Red Hat Enterprise Linux 7 中随附的一个 Docker 版本 1.13.1-108.git4ef4b30。
    较早和较新的版本均不受影响。 (CVE-2020-14300)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

ID	名稱	產品	系列	已發布	已更新	嚴重性
143962	NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2020-0082)	Nessus	NewStart CGSL Local Security Checks	2020/12/9	2021/7/1	high
147293	NewStart CGSL CORE 5.04 / MAIN 5.04 : containerd.io Multiple Vulnerabilities (NS-SA-2021-0006)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/12/5	high
154519	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2021-0138)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2021/10/28	high
147166	Oracle Linux 8 : container-tools:1.0 (ELSA-2021-0705)	Nessus	Oracle Linux Local Security Checks	2021/3/5	2024/11/1	high
125920	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork (SUSE-SU-2019:1234-2)	Nessus	SuSE Local Security Checks	2019/6/14	2022/1/26	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	high
208519	CentOS 7：docker (RHSA-2020:2653)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high
208519	CentOS 7：docker（RHSA-2020:2653）	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high
208519	CentOS 7 : docker (RHSA-2020:2653)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high
208519	CentOS 7：docker (RHSA-2020:2653)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high