An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

An update of the podman package has been released.

The version of buildah installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2990 advisory.

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - buildah: possible information disclosure and modification (CVE-2022-2990)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - buildah: possible information disclosure and modification (CVE-2022-2990)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1325 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:1326

    Security Fix(es):

    * python-werkzeug: high resource usage when parsing multipart form data with many fields (CVE-2023-25577)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * haproxy: segfault DoS (CVE-2023-0056)

    * openshift/apiserver-library-go: Bypass of SCC seccomp profile restrictions (CVE-2023-0229)

    * podman: symlink exchange attack in podman export volume (CVE-2023-0778)

    * haproxy: request smuggling attack in HTTP/1 header parsing (CVE-2023-25725)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    * OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1325 advisory.

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM)     attacks. (CVE-2022-3259)

  - An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server     connections contain a cache of HTTP header keys sent by the client. While the total number of entries in     this cache is capped, an attacker sending very large keys can cause the server to allocate approximately     64 MiB per open connection. (CVE-2022-41717)

  - A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean     function could transform an invalid path such as a/../c:/b into the valid path c:\b. This     transformation of a relative (if invalid) path into an absolute path could enable a directory traversal     attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid)     path .\c:\b. (CVE-2022-41722)

  - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests. (CVE-2022-41723)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader. (CVE-2022-41725)

  - An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the     service. This issue could allow an authenticated remote attacker to run a specially crafted malicious     server in an OpenShift cluster. The biggest impact is to availability. (CVE-2023-0056)

  - A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that     contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to     unconfined. By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC)     is runtime/default, allowing users to disable seccomp for pods they can create and modify.
    (CVE-2023-0229)

  - A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to     replace a normal file in a volume with a symlink while exporting the volume, allowing for access to     arbitrary files on the host file system. (CVE-2023-0778)

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart     form data parser will parse an unlimited number of parts, including file parts. Parts can be a small     amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request     can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or     `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an     attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it.
    The amount of CPU time required can block worker processes from handling legitimate requests. The amount     of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory     and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all     available workers. Version 2.2.3 contains a patch for this issue. (CVE-2023-25577)

  - HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in     some situations, aka request smuggling. The HTTP header parsers in HAProxy may accept empty header field     names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after     being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because     the headers disappear before being parsed and processed, as if they had not been sent by the client. The     fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. (CVE-2023-25725)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7822 advisory.

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4099-1 advisory.

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7457 advisory.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

  - A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with     access to the Kube API. The ExecSync request runs commands in a container and logs the output of the     command. This output is then read by CRI-O after command execution, and it is read in a manner where the     entire file corresponding to the output of the command is read in. Thus, if the output of the command is     large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of     the command. The highest threat from this vulnerability is system availability. (CVE-2022-1708)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4349-1 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4350-1 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8431 advisory.

    [4.2.0-7.0.1]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [2:4.2.0-7]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/35c0df3)
    - Resolves: #2120436

    [2:4.2.0-6]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/d520a5c)
    - Resolves: #2136845

    [2:4.2.0-5]
    - properly obsolete catatonit
    - Resolves: #2123319

    [2:4.2.0-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/4978898)
    - Resolves: #2124676

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7822 advisory.

    aardvark-dns     [2:1.1.0-5]
    - fix 'Two aardvark-dns instances trying to use the same port       on the same interface'
    - Resolves: #2130234

    buildah     [1:1.27.2-2]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.27       (https://github.com/containers/buildah/commit/c43a389)
    - Resolves: #2136438

    [1:1.27.2-1]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.27       (https://github.com/containers/buildah/commit/13622b1)
    - Resolves: #2129767

    cockpit-podman     conmon     containernetworking-plugins     containers-common     [1-43.0.1]
    - Updated removed references [Orabug: 33473101] (Alex Burmashev)
    - Adjust registries.conf (Nikita Gerasimov)
    - remove references to RedHat registry (Nikita Gerasimov)

    [2:1-43]
    - update vendored components and configuration files
    - Resolves: #2136438

    [2:1-42]
    - add beta GPG key
    - Resolves: #2125686

    [2:1-41]
    - update vendored components and configuration files
    - Resolves: #2125241

    container-selinux     criu     crun     fuse-overlayfs     libslirp     netavark     [2:1.1.0-7]
    - fix 'Two aardvark-dns instances trying to use the same port       on the same interface'
    - Resolves: #2130234

    oci-seccomp-bpf-hook     podman     [3:4.2.0-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/35c0df3)
    - Resolves: #2125645

    [3:4.2.0-3]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/d520a5c)
    - Resolves: #2136433

    [3:4.2.0-2]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/4978898)
    - Resolves: #2125241

    python-podman     [4.2.1-1]
    - update to 4.2.1 release
    - Resolves: #2132360

    [4.2.0-2]
    - fix '[RFE] python-podman: Podman support to perform custom actions on unhealthy containers'
    - Resolves: #2132360

    runc     skopeo     [2:1.9.3-1]
    - update to https://github.com/containers/skopeo/releases/tag/v1.9.3
    - Related: #2135973

    slirp4netns     udica

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8008 advisory.

    - fix CVE-2022-2990

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8008 advisory.

  - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a     container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid     `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits     for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a     malicious image, which when downloaded and stored by an application using containers/storage, would then     cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8431 advisory.

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8008 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * containers/storage: DoS via malicious image (CVE-2021-20291)

    * golang: net: lookup functions may return invalid host names (CVE-2021-33195)

    * golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty     (CVE-2021-33197)

    * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large     exponents (CVE-2021-33198)

    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8431 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * (podman image trust) does not support the new trust type sigstoreSigned  (BZ#2120436)

    * dnf-update broken for podman/catatonit (BZ#2123319)

    * podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905)

    * podman kill may deadlock [RHEL 9.1] (BZ#2124716)

    * containers config.json gets empty after sudden power loss (BZ#2136278)

    * PANIC podman API service endpoint handler panic (BZ#2136287)

    Enhancement(s):

    * Podman volume plugin timeout should be configurable [rhel-9.1.0 Z] (BZ#2124676)

    * [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7457 advisory.

    - fix CVE-2022-2990

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7822 advisory.

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7457 advisory.

  - Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil     ReverseProxy panic upon an ErrAbortHandler abort. (CVE-2021-36221)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution     of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone     was used to determine the type of document during push and pull operations. Documents that contain both     manifests and layers fields could be interpreted as either a manifest or an index in the absence of an     accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a     client may interpret the resulting content differently. The OCI Distribution Specification has been     updated to require that a mediaType value present in a manifest or index match the Content-Type header     used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type     header and reject an ambiguous document that contains both manifests and layers fields or manifests     and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

  - A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with     access to the Kube API. The ExecSync request runs commands in a container and logs the output of the     command. This output is then read by CRI-O after command execution, and it is read in a manner where the     entire file corresponding to the output of the command is read in. Thus, if the output of the command is     large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of     the command. The highest threat from this vulnerability is system availability. (CVE-2022-1708)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug     was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty     inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with     inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This     bug did not affect the container security sandbox as the inheritable set never contained more capabilities     than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix     changes `runc exec --cap` behavior such that the additional capabilities granted to the process being     executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc     spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`)     file. (CVE-2022-29162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7822 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2125644)

    * (podman image trust) does not support the new trust type sigstoreSigned  (BZ#2125645)

    * podman kill may deadlock (BZ#2125647)

    * Error: runc: exec failed: unable to start container process: open /dev/pts/0: operation not permitted:
    OCI permission denied [RHEL 8.7] (BZ#2125648)

    * containers-common-1-44 is missing RPM-GPG-KEY-redhat-beta [RHEL 8.7] (BZ#2125686)

    * ADD Dockerfile reference is not validating HTTP status code [rhel8-8.7.0] (BZ#2129767)

    * Two aardvark-dns instances trying to use the same port on the same interface. [rhel-8.7.0.z] (netavark)     (BZ#2130234)

    * containers config.json gets empty after sudden power loss (BZ#2130236)

    * PANIC podman API service endpoint handler panic (BZ#2132412)

    * Podman container got global IPv6 address unexpectedly even when macvlan network is created for pure IPv4     network (BZ#2133390)

    * Skopeo push image to redhat quay with sigstore was failed (BZ#2136406)

    * Podman push image to redhat quay with sigstore was failed (BZ#2136433)

    * Buildah push image to redhat quay with sigstore was failed (BZ#2136438)

    * Two aardvark-dns instances trying to use the same port on the same interface. [rhel-8.8] (aardvark-dns)     (BZ#2137295)

    Enhancement(s):

    * [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2130911)

    * [RFE] python-podman: Podman support to perform custom actions on unhealthy containers (BZ#2132360)

    * Podman volume plugin timeout should be configurable (BZ#2132992)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7457 advisory.

  - golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

  - opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

  - cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

  - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

  - runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

  - buildah: possible information disclosure and modification (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7457 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

    * cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

    * opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7822 advisory.

  - podman: possible information disclosure and modification (CVE-2022-2989)

  - buildah: possible information disclosure and modification (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3766-1 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.
    When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use     special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows     an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-20206)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3655-1 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.
    When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use     special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows     an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-20206)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203522	Photon OS 4.0: Podman PHSA-2023-4.0-0429	Nessus	PhotonOS Local Security Checks	high
201580	CBL Mariner 2.0 Security Update: buildah (CVE-2022-2990)	Nessus	MarinerOS Local Security Checks	high
199914	RHEL 7 : buildah (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199907	RHEL 8 : buildah (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194235	RHEL 8 / 9 : OpenShift Container Platform 4.13.0 (RHSA-2023:1325)	Nessus	Red Hat Local Security Checks	critical
189426	RHCOS 4 : OpenShift Container Platform 4.13.0 (RHSA-2023:1325)	Nessus	Red Hat Local Security Checks	critical
185050	Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:7822)	Nessus	Rocky Linux Local Security Checks	high
183286	SUSE SLES15 Security Update : buildah (SUSE-SU-2023:4099-1)	Nessus	SuSE Local Security Checks	high
171546	Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:7457)	Nessus	Rocky Linux Local Security Checks	high
168490	SUSE SLES15 Security Update : buildah (SUSE-SU-2022:4349-1)	Nessus	SuSE Local Security Checks	high
168486	SUSE SLES15 Security Update : buildah (SUSE-SU-2022:4350-1)	Nessus	SuSE Local Security Checks	high
168170	Oracle Linux 9 : podman (ELSA-2022-8431)	Nessus	Oracle Linux Local Security Checks	high
168133	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-7822)	Nessus	Oracle Linux Local Security Checks	high
168110	Oracle Linux 9 : buildah (ELSA-2022-8008)	Nessus	Oracle Linux Local Security Checks	high
167960	AlmaLinux 9 : buildah (ALSA-2022:8008)	Nessus	Alma Linux Local Security Checks	high
167843	AlmaLinux 9 : podman (ALSA-2022:8431)	Nessus	Alma Linux Local Security Checks	high
167618	RHEL 9 : buildah (RHSA-2022:8008)	Nessus	Red Hat Local Security Checks	high
167608	RHEL 9 : podman (RHSA-2022:8431)	Nessus	Red Hat Local Security Checks	high
167574	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-7457)	Nessus	Oracle Linux Local Security Checks	high
167441	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7822)	Nessus	Alma Linux Local Security Checks	high
167293	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7457)	Nessus	Alma Linux Local Security Checks	high
167179	RHEL 8 : container-tools:rhel8 (RHSA-2022:7822)	Nessus	Red Hat Local Security Checks	high
167135	CentOS 8 : container-tools:rhel8 (CESA-2022:7457)	Nessus	CentOS Local Security Checks	high
167128	RHEL 8 : container-tools:rhel8 (RHSA-2022:7457)	Nessus	Red Hat Local Security Checks	high
167094	CentOS 8 : container-tools:rhel8 (CESA-2022:7822)	Nessus	CentOS Local Security Checks	high
166586	SUSE SLED15 / SLES15 Security Update : buildah (SUSE-SU-2022:3766-1)	Nessus	SuSE Local Security Checks	high
166296	SUSE SLES15 Security Update : buildah (SUSE-SU-2022:3655-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-2990

high

Tenable Plugins

high

high

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high