A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8112 advisory.

    * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a     panic/stack exhaustion (CVE-2024-34155)
    * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can     cause a panic due to stack exhaustion (CVE-2024-34156)
    * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
    * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (CVE-2024-9341)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8112 advisory.

    - rebuild to address CVE-2024-34155 CVE-2024-34156 CVE-2024-34158

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:7925 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.1. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7922

    Security Fix(es):

    * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in     containers/common Go Library (CVE-2024-9341)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8112 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a     panic/stack exhaustion (CVE-2024-34155)

    * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can     cause a panic due to stack exhaustion (CVE-2024-34156)

    * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

    * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (CVE-2024-9341)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:8039 advisory.

    * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a     panic/stack exhaustion (CVE-2024-34155)
    * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can     cause a panic due to stack exhaustion (CVE-2024-34156)
    * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
    * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (CVE-2024-9341)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8039 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a     panic/stack exhaustion (CVE-2024-34155)

    * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can     cause a panic due to stack exhaustion (CVE-2024-34156)

    * go/build/constraint: golang: Calling Parse on a // +build build tag line with deeply nested     expressions can cause a panic due to stack exhaustion (CVE-2024-34158)

    * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (CVE-2024-9341)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-8039 advisory.

    - rebuild to address CVE-2024-34155 CVE-2024-34156 CVE-2024-34158

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3546-1 advisory.

    - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (bsc#1231230)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3545-1 advisory.

    - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount     Instruction (bsc#1231208).
    - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library in     cri-o (nsc#1231230).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209106	AlmaLinux 9 : buildah (ALSA-2024:8112)	Nessus	Alma Linux Local Security Checks	medium
209068	Oracle Linux 9 : buildah (ELSA-2024-8112)	Nessus	Oracle Linux Local Security Checks	medium
209059	RHEL 8 / 9 : OpenShift Container Platform 4.17.1 (RHSA-2024:7925)	Nessus	Red Hat Local Security Checks	medium
209039	RHEL 9 : buildah (RHSA-2024:8112)	Nessus	Red Hat Local Security Checks	medium
209035	AlmaLinux 9 : podman (ALSA-2024:8039)	Nessus	Alma Linux Local Security Checks	medium
208988	RHEL 9 : podman (RHSA-2024:8039)	Nessus	Red Hat Local Security Checks	medium
208954	Oracle Linux 9 : podman (ELSA-2024-8039)	Nessus	Oracle Linux Local Security Checks	medium
208418	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2024:3546-1)	Nessus	SuSE Local Security Checks	medium
208417	SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2024:3545-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-9341

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium