An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

  - An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host. (CVE-2019-18466)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2019:4269 advisory.

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host. (CVE-2019-18466)

  - Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The     attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of     responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
    (CVE-2019-9512)

  - Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both. (CVE-2019-9514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4269 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

  - podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [extras-rhel-7] conmon binary stripped but debuginfo not generated (BZ#1650395)

    * Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix (BZ#1758509)

    * Podman does not enforce registries.block in the registries.conf file (BZ#1787666)

    * podman and podman-manpages needs merging (BZ#1788549)

    * podman should be linked against gpgme-pthread (BZ#1793083)

    * podman cannot support load tarball which the name with colon but docker can support this (BZ#1797599)

    * podman (1.6.4) rhel 8.1 no route to host from inside container [extras-rhel-7.8/podman] (BZ#1806895)

    * Podman can't reuse a container name, even if the container that was using it is no longer around     [extras-rhel-7.8/podman] (BZ#1807437)

    * podman exec does not reads from stdin [extras-rhel-7.8/podman] (BZ#1807586)

    * [FJ8.2 Bug]: [REG]The --group-add option of podman create doesn't function. [extras-rhel-7.8/podman]     (BZ#1808702)

    Enhancement(s):

    * [RFE] sctp support for podman (BZ#1664218)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4269 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

    * backport json-file logging support to 1.4.2 (BZ#1770176)

    * Selinux won't allow SCTP inter pod communication (BZ#1774382)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208511	CentOS 7 : podman (RHSA-2020:1227)	Nessus	CentOS Local Security Checks	medium
184994	Rocky Linux 8 : container-tools:rhel8 (RLSA-2019:4269)	Nessus	Rocky Linux Local Security Checks	high
145671	CentOS 8 : container-tools:rhel8 (CESA-2019:4269)	Nessus	CentOS Local Security Checks	high
135081	RHEL 7 : podman (RHSA-2020:1227)	Nessus	Red Hat Local Security Checks	medium
135004	openSUSE Security Update : cni / cni-plugins / conmon / etc (openSUSE-2020-398)	Nessus	SuSE Local Security Checks	medium
134653	SUSE SLES15 Security Update : cni, cni-plugins, conmon, fuse-overlayfs, podman (SUSE-SU-2020:0697-1)	Nessus	SuSE Local Security Checks	medium
132234	RHEL 8 : container-tools:rhel8 (RHSA-2019:4269)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-18466

medium

Tenable Plugins

medium

high

high

medium

medium

medium

high