A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1565 advisory.

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1762 advisory.

  - A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image     to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered     after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem,     leading to information disclosure or denial of service. (CVE-2022-1227)

  - client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods. (CVE-2022-21698)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A     vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty     inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27650)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1566 advisory.

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of podman installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-27649 advisory.

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0326-1 advisory.

  - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including     from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by     default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)

  - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.
    When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use     special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows     an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-20206)

  - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual     machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is     accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an     attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making     private services on the VM accessible to the network. This issue could be also used to interrupt the     host's services by forwarding all ports to the VM. (CVE-2021-4024)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0187-1 advisory.

  - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including     from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by     default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)

  - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.
    When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use     special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows     an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-20206)

  - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual     machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is     accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an     attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making     private services on the VM accessible to the network. This issue could be also used to interrupt the     host's services by forwarding all ports to the VM. (CVE-2021-4024)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4816 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4651 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1762 advisory.

    - switch to RHEL maintenance branch which fixes CVE-2022-27651
    - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    - fix CVE-2022-21698

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1762 advisory.

  - A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image     to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered     after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem,     leading to information disclosure or denial of service. (CVE-2022-1227)

  - client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods. (CVE-2022-21698)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A     vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty     inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27650)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1762 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1762 advisory.

  - psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

  - prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

  - podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

  - crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

  - buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1565 advisory.

    - fixes CVE-2022-27651
    - fixes CVE-2022-27649
    - rc95 fixes CVE-2021-30465

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1566 advisory.

    - fixes CVE-2022-27649

    podman
    - fixes CVE-2022-27651

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1566 advisory.

  - podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

  - buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1565 advisory.

  - podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

  - buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1566 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1565 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * 3.0 stable stream: podman run --pid=host command causes OCI permission error (BZ#2070961)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1407 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [8.2 EUS backport] podman cpu stats bug (BZ#2062400)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
185022	Rocky Linux 8 : container-tools:3.0 (RLSA-2022:1565)	Nessus	Rocky Linux Local Security Checks	high
184630	Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:1762)	Nessus	Rocky Linux Local Security Checks	high
184627	Rocky Linux 8 : container-tools:2.0 (RLSA-2022:1566)	Nessus	Rocky Linux Local Security Checks	high
172921	CBL Mariner 2.0 Security Update: podman (CVE-2022-27649)	Nessus	MarinerOS Local Security Checks	high
171408	SUSE SLES15 Security Update : podman (SUSE-SU-2023:0326-1)	Nessus	SuSE Local Security Checks	high
170750	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2023:0187-1)	Nessus	SuSE Local Security Checks	high
161719	RHEL 8 : container-tools:3.0 (RHSA-2022:4816)	Nessus	Red Hat Local Security Checks	high
161361	RHEL 8 : container-tools:2.0 (RHSA-2022:4651)	Nessus	Red Hat Local Security Checks	high
161275	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-1762)	Nessus	Oracle Linux Local Security Checks	high
161143	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:1762)	Nessus	Alma Linux Local Security Checks	high
161023	RHEL 8 : container-tools:rhel8 (RHSA-2022:1762)	Nessus	Red Hat Local Security Checks	high
160967	CentOS 8 : container-tools:rhel8 (CESA-2022:1762)	Nessus	CentOS Local Security Checks	high
160311	Oracle Linux 8 : container-tools:3.0 (ELSA-2022-1565)	Nessus	Oracle Linux Local Security Checks	high
160310	Oracle Linux 8 : container-tools:2.0 (ELSA-2022-1566)	Nessus	Oracle Linux Local Security Checks	high
160253	CentOS 8 : container-tools:2.0 (CESA-2022:1566)	Nessus	CentOS Local Security Checks	high
160252	CentOS 8 : container-tools:3.0 (CESA-2022:1565)	Nessus	CentOS Local Security Checks	high
160237	RHEL 8 : container-tools:2.0 (RHSA-2022:1566)	Nessus	Red Hat Local Security Checks	high
160225	RHEL 8 : container-tools:3.0 (RHSA-2022:1565)	Nessus	Red Hat Local Security Checks	high
159903	RHEL 8 : container-tools:2.0 (RHSA-2022:1407)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2022-27649

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high