Detections
Analytics
openSUSE Security Update : docker (openSUSE-2019-189)
high Nessus Plugin ID 122293
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues :Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork :
- CVE-2018-16873: cmd/go: remote command execution during 'go get -u' (bsc#1118897)
- CVE-2018-16874: cmd/go: directory traversal in 'go get' via curly braces in import paths (bsc#1118898)
- CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899)
Non-security issues fixed for docker :
- Disable leap based builds for kubic flavor (bsc#1121412)
- Allow users to explicitly specify the NIS domainname of a container (bsc#1001161)
- Update docker.service to match upstream and avoid rlimit problems (bsc#1112980)
- Allow docker images larger then 23GB (bsc#1118990)
- Docker version update to version 18.09.0-ce (bsc#1115464)
This update was imported from the SUSE:SLE-15:Update update project.
Solution
Update the affected docker packages.See Also
https://bugzilla.opensuse.org/show_bug.cgi?id=1001161
https://bugzilla.opensuse.org/show_bug.cgi?id=1112980
https://bugzilla.opensuse.org/show_bug.cgi?id=1115464
https://bugzilla.opensuse.org/show_bug.cgi?id=1118897
https://bugzilla.opensuse.org/show_bug.cgi?id=1118898
https://bugzilla.opensuse.org/show_bug.cgi?id=1118899
Plugin Details
Severity: High
ID: 122293
File Name: openSUSE-2019-189.nasl
Version: 1.4
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 2/19/2019
Updated: 1/19/2021
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-16874
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:docker-runc-debuginfo, p-cpe:/a:novell:opensuse:containerd-ctr, p-cpe:/a:novell:opensuse:golang-github-docker-libnetwork, cpe:/o:novell:opensuse:15.0, p-cpe:/a:novell:opensuse:docker-libnetwork-debuginfo, p-cpe:/a:novell:opensuse:docker-debuginfo, p-cpe:/a:novell:opensuse:docker-runc, p-cpe:/a:novell:opensuse:docker-test, p-cpe:/a:novell:opensuse:docker-bash-completion, p-cpe:/a:novell:opensuse:docker-libnetwork, p-cpe:/a:novell:opensuse:docker-runc-test, p-cpe:/a:novell:opensuse:docker-test-debuginfo, p-cpe:/a:novell:opensuse:containerd-test, p-cpe:/a:novell:opensuse:containerd, p-cpe:/a:novell:opensuse:docker, p-cpe:/a:novell:opensuse:docker-zsh-completion, p-cpe:/a:novell:opensuse:docker-debugsource
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 3/23/2019
Vulnerability Publication Date: 12/14/2018