A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2681 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

  - An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host. (CVE-2019-18466)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1650 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2681 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Proposed registries.conf for RHEL 7.8 (BZ#1810052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2218 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * containers/image: Container images were reading the entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * buildah: Crafted input tar file may lead to local file overwrite during image build process     (CVE-2020-10696)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * buildah is not expanding env vars in file paths (BZ#1822031)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1937 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1650 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    * podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

    Docker is an open-source engine that automates the deployment of any application as a lightweight,     portable, self-sufficient container that runs virtually anywhere.

    Security Fix(es):

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Whitelist statx(2) in docker (BZ#1784228)

    * Upgrading docker resulting into increase Systemd logs (BZ#1791870)

    * docker should be linked against gpgme-pthread (BZ#1792243)

    * docker cannot be updated to 108 on rhos13 as a container fails to start with pivot_root invalid     argument error. (BZ#1795376)

    * OVS pods are unable to stop when running under docker version 1.13.1-108 (BZ#1796451)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [extras-rhel-7] conmon binary stripped but debuginfo not generated (BZ#1650395)

    * Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix (BZ#1758509)

    * Podman does not enforce registries.block in the registries.conf file (BZ#1787666)

    * podman and podman-manpages needs merging (BZ#1788549)

    * podman should be linked against gpgme-pthread (BZ#1793083)

    * podman cannot support load tarball which the name with colon but docker can support this (BZ#1797599)

    * podman (1.6.4) rhel 8.1 no route to host from inside container [extras-rhel-7.8/podman] (BZ#1806895)

    * Podman can't reuse a container name, even if the container that was using it is no longer around     [extras-rhel-7.8/podman] (BZ#1807437)

    * podman exec does not reads from stdin [extras-rhel-7.8/podman] (BZ#1807586)

    * [FJ8.2 Bug]: [REG]The --group-add option of podman create doesn't function. [extras-rhel-7.8/podman]     (BZ#1808702)

    Enhancement(s):

    * [RFE] sctp support for podman (BZ#1664218)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208566	CentOS 7 : skopeo (RHSA-2020:2681)	Nessus	CentOS Local Security Checks	low
208529	CentOS 7 : buildah (RHSA-2020:2116)	Nessus	CentOS Local Security Checks	high
208511	CentOS 7 : podman (RHSA-2020:1227)	Nessus	CentOS Local Security Checks	medium
208507	CentOS 7 : docker (RHSA-2020:1234)	Nessus	CentOS Local Security Checks	high
199108	RHEL 8 : 1.0_podman (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
196868	RHEL 8 : containers_image (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	low
185067	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)	Nessus	Rocky Linux Local Security Checks	high
180939	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)	Nessus	Oracle Linux Local Security Checks	high
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	Nessus	CentOS Local Security Checks	high
137750	RHEL 7 : skopeo (RHSA-2020:2681)	Nessus	Red Hat Local Security Checks	low
136977	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2218)	Nessus	Red Hat Local Security Checks	low
136521	RHEL 7 : buildah (RHSA-2020:2116)	Nessus	Red Hat Local Security Checks	high
136320	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 cri-o (RHSA-2020:1937)	Nessus	Red Hat Local Security Checks	high
136053	RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)	Nessus	Red Hat Local Security Checks	high
135084	RHEL 7 : docker (RHSA-2020:1234)	Nessus	Red Hat Local Security Checks	high
135081	RHEL 7 : podman (RHSA-2020:1227)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-1702

low

Tenable Plugins

low

high

medium

high

low

low

high

high

high

low

low

high

high

high

high

medium