A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible.

The version of kubevirt installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-1798 advisory.

  - A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user     able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable     or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. (CVE-2022-1798)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3333-1 advisory.

  - A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user     able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable     or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. (CVE-2022-1798)

  - Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
    (CVE-2022-1996)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3321-1 advisory.

  - A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user     able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable     or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. (CVE-2022-1798)

  - Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.
    (CVE-2022-1996)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
173492	CBL Mariner 2.0 Security Update: kubevirt (CVE-2022-1798)	Nessus	MarinerOS Local Security Checks	medium
165333	SUSE SLES15 Security Update : kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container (SUSE-SU-2022:3333-1)	Nessus	SuSE Local Security Checks	critical
165293	SUSE SLES15 Security Update : kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container (SUSE-SU-2022:3321-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2022-1798

medium

Tenable Plugins

medium

critical

critical