The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1989-1 advisory.

    - Bump github.com/containers/image/v5 (bsc#1224119, CVE-2024-3727)
    - Remove SLE15 SP4 from the distro check (end of general support)
    - Add LABEL with source URL

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2383-1 advisory.

    - CVE-2024-3727: Added missing image digest verification (bsc#1224123).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3120-1 advisory.

    Changes in docker:
    - CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
    - CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
    - CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit     (bsc#1219438)
    - CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed     (bsc#1228324)

    Other fixes:

    - Update to Docker 25.0.6-ce. See upstream changelog online at       <https://docs.docker.com/engine/release-notes/25.0/#2506>
    - Update to Docker 25.0.5-ce (bsc#1223409)

    - Fix BuildKit's symlink resolution logic to correctly handle non-lexical       symlinks. (bsc#1221916)
    - Write volume options atomically so sudden system crashes won't result in       future Docker starts failing due to empty files. (bsc#1214855)

    Changes in buildah:
    - Update to version 1.35.4:
      * [release-1.35] Bump to Buildah v1.35.4
      * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
      * integration test: handle new labels in 'bud and test --unsetlabel'
      * [release-1.35] Bump go-jose CVE-2024-28180
      * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180

    - Update to version 1.35.3:
      * [release-1.35] Bump to Buildah v1.35.3
      * [release-1.35] correctly configure /etc/hosts and resolv.conf
      * [release-1.35] buildah: refactor resolv/hosts setup.
      * [release-1.35] rename the hostFile var to reflect
      * [release-1.35] Bump c/common to v0.58.1
      * [release-1.35] Bump Buildah to v1.35.2
      * [release-1.35] CVE-2024-24786 protobuf to 1.33
      * [release-1.35] Bump to v1.35.2-dev

    - Update to version 1.35.1:
      * [release-1.35] Bump to v1.35.1
      * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)

    - Buildah dropped cni support, require netavark instead (bsc#1221243)

    - Remove obsolete requires libcontainers-image & libcontainers-storage

    - Require passt for rootless networking (poo#156955)       Buildah moved to passt/pasta for rootless networking from slirp4netns       (https://github.com/containers/common/pull/1846)

    - Update to version 1.35.0:
      * Bump v1.35.0
      * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
      * conformance tests: don't break on trailing zeroes in layer blobs
      * Add a conformance test for copying to a mounted prior stage
      * fix(deps): update module github.com/stretchr/testify to v1.9.0
      * cgroups: reuse version check from c/common
      * Update vendor of containers/(common,image)
      * fix(deps): update github.com/containers/storage digest to eadc620
      * fix(deps): update github.com/containers/luksy digest to ceb12d4
      * fix(deps): update github.com/containers/image/v5 digest to cdc6802
      * manifest add: complain if we get artifact flags without --artifact
      * Use retry logic from containers/common
      * Vendor in containers/(storage,image,common)
      * Update module golang.org/x/crypto to v0.20.0
      * Add comment re: Total Success task name
      * tests: skip_if_no_unshare(): check for --setuid
      * Properly handle build --pull=false
      * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
      * Update module go.etcd.io/bbolt to v1.3.9
      * Revert 'Reduce official image size'
      * Update module github.com/opencontainers/image-spec to v1.1.0
      * Reduce official image size
      * Build with CNI support on FreeBSD
      * build --all-platforms: skip some base 'image' platforms
      * Bump main to v1.35.0-dev
      * Vendor in latest containers/(storage,image,common)
      * Split up error messages for missing --sbom related flags
      * `buildah manifest`: add artifact-related options
      * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
      * cmd/buildah/manifest.go: don't make struct declarations aliases
      * Use golang.org/x/exp/slices.Contains
      * Disable loong64 again
      * Fix a couple of typos in one-line comments
      * egrep is obsolescent; use grep -E
      * Try Cirrus with a newer VM version
      * Set CONTAINERS_CONF in the chroot-mount-flags integration test
      * Update to match dependency API update
      * Update github.com/openshift/imagebuilder and containers/common
      * docs: correct default authfile path
      * fix(deps): update module github.com/containerd/containerd to v1.7.13
      * tests: retrofit test for heredoc summary
      * build, heredoc: show heredoc summary in build output
      * manifest, push: add support for --retry and --retry-delay
      * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
      * imagebuildah: fix crash with empty RUN
      * fix(deps): update github.com/containers/luksy digest to b62d551
      * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
      * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
      * Make buildah match podman for handling of ulimits
      * docs: move footnotes to where they're applicable
      * Allow users to specify no-dereference
      * Run codespell on code
      * Fix FreeBSD version parsing
      * Fix a build break on FreeBSD
      * Remove a bad FROM line
      * fix(deps): update module github.com/onsi/gomega to v1.31.1
      * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
      * docs: use reversed logo for dark theme in README
      * build,commit: add --sbom to scan and produce SBOMs when committing
      * commit: force omitHistory if the parent has layers but no history
      * docs: fix a couple of typos
      * internal/mkcw.Archive(): handle extra image content
      * stage_executor,heredoc: honor interpreter in heredoc
      * stage_executor,layers: burst cache if heredoc content is changed
      * fix(deps): update module golang.org/x/crypto to v0.18.0
      * Replace map[K]bool with map[K]struct{} where it makes sense
      * fix(deps): update module golang.org/x/sync to v0.6.0
      * fix(deps): update module golang.org/x/term to v0.16.0
      * Bump CI VMs
      * Replace strings.SplitN with strings.Cut
      * fix(deps): update github.com/containers/storage digest to ef81e9b
      * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
      * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
      * Document use of containers-transports values in buildah
      * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
      * chore(deps): update dependency containers/automation_images to v20231208
      * manifest: addCompression use default from containers.conf
      * commit: add a --add-file flag
      * mkcw: populate the rootfs using an overlay
      * chore(deps): update dependency containers/automation_images to v20230517
      * [skip-ci] Update actions/stale action to v9
      * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
      * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
      * Bump to v1.34.1-dev
      * Ignore errors if label.Relabel returns ENOSUP

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7941 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.52. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7939     Security Fix(es):

    * openstack-ironic: Specially crafted image may allow authenticated users     to gain access to potentially sensitive data (CVE-2024-44082)
    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9098 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)

    * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

    * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

    * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9390:11 advisory.

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)
      * net/[http:](http:) Denial of service due to improper 100-continue handling in net/http     (CVE-2024-24791)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7187 advisory.

  - containers/image: digest type does not guarantee valid type (CVE-2024-3727)

  - webob: WebOb's location header normalization during redirect leads to open redirect (CVE-2024-42353)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0942 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-28180:
    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger     unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local     path traversal, and other attacks.

    CVE-2024-3727:
    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3.

    CVE-2024-24786:
    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set.

    CVE-2024-9676:
    A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the     containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service     via OOM kill when running a malicious image using an automatically assigned user namespace     (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the     container, but does not properly validate if that file is a symlink, which can be used to cause the     library to read an arbitrary file on the host.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0313-1 advisory.

    - CVE-2023-45288: Fixed unclosed connections when receiving too many headers in golang.org/x/net/http2     (bsc#1236528)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0019 advisory.

    This advisory aggregates security fixes for the cockpit-podman SRPM in CIQ LTS 8.6. It addresses 33 CVEs:
    CVE-2018-25091, CVE-2024-34155, CVE-2021-33198, CVE-2024-34156, CVE-2024-34158, and 28 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0014 advisory.

    This advisory aggregates security fixes for the buildah SRPM in CIQ LTS 8.6. It addresses 37 CVEs:
    CVE-2019-10214, CVE-2023-48795, CVE-2024-24788, CVE-2021-4024, CVE-2024-24791, and 32 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
200407	SUSE SLES15: containerized-data-importer-api / etc (SUSE-SU-2024:1989-1)	Nessus	SuSE Local Security Checks	2024/6/12	2026/6/26	high
202179	SUSE SLES15 Security Update : skopeo (SUSE-SU-2024:2383-1)	Nessus	SuSE Local Security Checks	2024/7/11	2024/7/11	high
206581	SUSE SLES15: buildah / docker / docker-bash-completion / docker-fish-completion / etc (SUSE-SU-2024:3120-1)	Nessus	SuSE Local Security Checks	2024/9/4	2026/6/26	critical
209187	RHEL 8 / 9 : OpenShift Container Platform 4.13.z (RHSA-2024:7941)	Nessus	Red Hat Local Security Checks	2024/10/17	2024/10/17	medium
210826	RHEL 9 : skopeo (RHSA-2024:9098)	Nessus	Red Hat Local Security Checks	2024/11/12	2025/3/6	medium
293278	MiracleLinux 9 : buildah-1.37.2-1.el9 (AXSA:2024-9390:11)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
311860	RHCOS 4 / 9 : OpenShift Container Platform 4.14.38 (RHSA-2024:7187)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	medium
239235	TencentOS Server 4: skopeo (TSSA-2024:0942)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
214898	SUSE SLES15 / openSUSE 15 Security Update : apptainer (SUSE-SU-2025:0313-1)	Nessus	SuSE Local Security Checks	2025/2/3	2025/2/3	high
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	2026/5/16	2026/5/16	high
357876	Rocky Linux 8.6 [CIQ] Security Update: cockpit-podman Multiple Vulnerabilities (ciqsa-2026_0019)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
358310	Rocky Linux 8.6 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (ciqsa-2026_0014)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/11	medium

偵測

搜尋 Plugin

high

high

critical

medium

medium

high

medium

high

high

high

medium

medium