The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2117 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1230 advisory.

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1231 advisory.

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1396 advisory.

    The podman tool manages Pods, container images, and containers. It is part of the libpod library, which is     for applications that use container Pods. Container Pods is a concept in Kubernetes.

    Security Fix(es):

    * buildah: a crafted input tar file could overwrite local files during the image build process     (CVE-2020-10696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * cri-o: A flaw was found in cri-o that can result in container management (conmon) processes being killed     if a workload process triggers an out-of-memory (OOM) condition for the cgroup. (CVE-2019-14891)

    * nodejs-minimist: Prototype pollution allows adding or modifying properties of Object.prototype using a     `constructor` or `__proto__` payload. (CVE-2020-7598)

    * kubernetes: Use of unbounded 'client' label in apiserver_request_total allows repeated, crafted HTTP     requests to exhaust available memory and cause a crash. (CVE-2020-8552)

    * kubernetes: A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services     exposed on localhost ports and gain privileges or access confidential information for any services     listening on localhost ports that are not protected by authentication. (CVE-2020-8558)

    * proglottis/gpgme: A use-after-free vulnerability was found in the Go GPGME wrapper library,     github.com/proglottis/gpgme. (CVE-2020-8945)

    * openshift/console: A flaw allowed text injection on error pages with a crafted URL. (CVE-2020-10715)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Security fix for CVE-2020-8551, CVE-2020-8552,     CVE-2020-8555, CVE-2020-8945

  - Rebase to head of usptream 3.11 branch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2927 advisory.

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2413 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * kubernetes: Denial of service in API server via crafted YAML payloads by authorized users     (CVE-2019-11254)

    * kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2027 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2117 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

  - buildah: Crafted input tar file may lead to local file overwrite during image build process     (CVE-2020-10696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1937 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0928 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1231 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to:
    * Create a working container, either from scratch or using an image as a starting point.
    * Create an image, either from a working container or using the instructions in a Dockerfile.
    * Build both Docker and OCI images.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rootless buildah does not work with UID in /etc/subuid (BZ#1765469)

    * Extras RHEL-7.8 update - buildah (BZ#1791286)

    * buildah should be linked against gpgme-pthread (BZ#1793074)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1230 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Skopeo doesn't handle HTTP 429 errors properly (BZ#1752775)

    * skopeo does not show manifest manifest.list.v2 for special cases (BZ#1754905)

    * skopeo inspect results in panic: runtime error: invalid memory address or nil pointer dereference     (BZ#1769575)

    * skopeo should be linked against gpgme-pthread (BZ#1793080)

    * docker won't start because registries service won't start (BZ#1812505)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the iSulad-kit package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The proglottis Go wrapper before 0.1.1 for the GPGME     library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This     leads to a crash or potential code execution during GPG     signature verification.(CVE-2020-8945)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0697 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0689 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0679 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

use crun only for f31+

----

Suggests: crun for f30

----

bump to v1.8.0, Security fix for CVE-2020-8945

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Resolves: #1795838, #1802904 - Security fix for CVE-2020-8945

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
208637	CentOS 7 : podman (RHSA-2020:2117)	Nessus	CentOS Local Security Checks	high
208573	CentOS 7 : skopeo (RHSA-2020:1230)	Nessus	CentOS Local Security Checks	high
208531	CentOS 7 : buildah (RHSA-2020:1231)	Nessus	CentOS Local Security Checks	high
208507	CentOS 7 : docker (RHSA-2020:1234)	Nessus	CentOS Local Security Checks	high
199982	RHEL 8 : cri-o (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
170288	RHEL 8 : OpenShift Container Platform 4.3.12 podman (RHSA-2020:1396)	Nessus	Red Hat Local Security Checks	high
139006	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	high
138918	Fedora 32 : origin (2020-aeea04cd13)	Nessus	Fedora Local Security Checks	high
138765	RHEL 7 / 8 : OpenShift Container Platform 4.4.13 machine-config-daemon and openshift (RHSA-2020:2927)	Nessus	Red Hat Local Security Checks	high
138387	RHEL 7 / 8 : OpenShift Container Platform 4.5 (RHSA-2020:2413)	Nessus	Red Hat Local Security Checks	high
136585	RHEL 8 : OpenShift Container Platform 4.2.33 openshift-clients (RHSA-2020:2027)	Nessus	Red Hat Local Security Checks	high
136522	RHEL 7 : podman (RHSA-2020:2117)	Nessus	Red Hat Local Security Checks	high
136320	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 cri-o (RHSA-2020:1937)	Nessus	Red Hat Local Security Checks	high
135230	RHEL 7 / 8 : OpenShift Container Platform 4.3.8 openshift-clients (RHSA-2020:0928)	Nessus	Red Hat Local Security Checks	high
135085	RHEL 7 : buildah (RHSA-2020:1231)	Nessus	Red Hat Local Security Checks	high
135084	RHEL 7 : docker (RHSA-2020:1234)	Nessus	Red Hat Local Security Checks	high
135082	RHEL 7 : skopeo (RHSA-2020:1230)	Nessus	Red Hat Local Security Checks	high
134782	EulerOS 2.0 SP8 : iSulad-kit (EulerOS-SA-2020-1290)	Nessus	Huawei Local Security Checks	high
134558	RHEL 8 : OpenShift Container Platform 4.1.38 skopeo (RHSA-2020:0697)	Nessus	Red Hat Local Security Checks	high
134392	RHEL 8 : OpenShift Container Platform 4.2.22 skopeo (RHSA-2020:0689)	Nessus	Red Hat Local Security Checks	high
134389	RHEL 8 : OpenShift Container Platform 4.3.5 skopeo (RHSA-2020:0679)	Nessus	Red Hat Local Security Checks	high
134355	Fedora 30 : 2:podman (2020-ccc3e64ea5)	Nessus	Fedora Local Security Checks	high
133891	Fedora 31 : 1:skopeo (2020-f317e13ecf)	Nessus	Fedora Local Security Checks	high
133883	Fedora 30 : 1:skopeo (2020-2a0aac3502)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-8945

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high