A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any     user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host     system.(CVE-2024-3154)

Tenable has extracted the preceding description block directly from the EulerOS docker-runc security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of cri-o installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-3154 advisory.

  - A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any     user who can create a pod with an arbitrary annotation May perform an arbitrary action on the host system.
    (CVE-2024-3154)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:3496 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.43. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:3494

    Security Fix(es):

    * cri-o: Arbitrary command injection via pod annotation (CVE-2024-3154)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2784 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.57. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:2782

    Security Fix(es):

    * buildah: full container escape at build time (CVE-2024-1753)
    * cri-o: Arbitrary command injection via pod annotation (CVE-2024-3154)
    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2669 advisory.

  - A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

  - A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any     user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
    (CVE-2024-3154)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory.

  - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection. (CVE-2023-45288)

  - A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

  - A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any     user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.
    (CVE-2024-3154)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2672 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.24. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:2668

    Security Fix(es):

    * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames     causes DoS (CVE-2023-45288)
    * buildah: full container escape at build time (CVE-2024-1753)
    * cri-o: Arbitrary command injection via pod annotation (CVE-2024-3154)
    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2669 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.12. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:2664

    Security Fix(es):

    * buildah: full container escape at build time (CVE-2024-1753)
    * cri-o: Arbitrary command injection via pod annotation (CVE-2024-3154)
    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
208405	EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2024-2501)	Nessus	Huawei Local Security Checks	high
208370	EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2024-2525)	Nessus	Huawei Local Security Checks	high
201784	CBL Mariner 2.0 Security Update: cri-o (CVE-2024-3154)	Nessus	MarinerOS Local Security Checks	high
200122	RHEL 8 / 9 : OpenShift Container Platform 4.13.43 (RHSA-2024:3496)	Nessus	Red Hat Local Security Checks	high
197206	RHEL 8 / 9 : OpenShift Container Platform 4.12.57 (RHSA-2024:2784)	Nessus	Red Hat Local Security Checks	high
195299	RHCOS 4 : OpenShift Container Platform 4.15.12 (RHSA-2024:2669)	Nessus	Red Hat Local Security Checks	high
195298	RHCOS 4 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)	Nessus	Red Hat Local Security Checks	high
195225	RHEL 8 / 9 : OpenShift Container Platform 4.14.24 (RHSA-2024:2672)	Nessus	Red Hat Local Security Checks	high
195213	RHEL 8 / 9 : OpenShift Container Platform 4.15.12 (RHSA-2024:2669)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2024-3154

high

Tenable Plugins

high

high

high

high

high

high

high

high

high