The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2549 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when     unmarshaling certain forms of invalid JSON (CVE-2024-24786)

    Bug Fix(es):

    * TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop     in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - RHEL 9.4 0day     (JIRA:RHEL-28235)

    * skopeo: jose-go: improper handling of highly compressed data [rhel-9] (JIRA:RHEL-28736)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerd installed on the remote host is prior to 1.7.20-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-042 advisory.

    2024-08-27: CVE-2024-24790 was added to this advisory.

    2024-08-09: CVE-2023-47108 was removed from this advisory.

    2024-08-09: The severity of this advisory has been changed from Important to Medium.

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6     addresses, returning false for addresses which would return true in their traditional IPv4 forms.
    (CVE-2024-24790)

    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-529fe8a802 advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-831bad8f8f advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3827 advisory.

    [1.33.7-2.0.1]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]

    [2:1.33.7-2]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.33       (https://github.com/containers/buildah/commit/997beea)
    - Resolves: RHEL-28731

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-560a7aca85 advisory.

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2669 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.12. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:2664

    Security Fix(es):

    * buildah: full container escape at build time (CVE-2024-1753)
    * cri-o: Arbitrary command injection via pod annotation (CVE-2024-3154)
    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 6.8.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.8.1.5 advisory.

  - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache     Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers     correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect     infinite timeout which allowed connections to remain open which should have been closed. This issue     affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1     through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the     issue. (CVE-2024-34750)

  - Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of     service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of     Service (ReDoS) in package_index.py. (CVE-2022-40897)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In     affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol,     but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated,     thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an     exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8.
    (CVE-2023-23931)

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

  - urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header     special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user.
    However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP     redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been     patched in urllib3 version 1.26.17 or 2.0.5. (CVE-2023-43804)

  - Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys     containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each     would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to     only values) as user input, and renders these in pages that other users see as well, an attacker could use     this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not     other characters. Accepting keys as user input is now explicitly considered an unintended use case of the     `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as     insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This     vulnerability is fixed in 3.1.4. (CVE-2024-34064)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function,     affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can     lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is     triggered by a crafted input that causes the `idna.encode()` function to process the input with     considerable computational load, significantly increasing the processing time in a quadratic manner     relative to the input size. (CVE-2024-3651)

  - nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size     cache is exhausted by client requests then a subsequent client request for netgroup data may result in a     stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This     vulnerability is only present in the nscd binary. (CVE-2024-33599)

  - nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails     to add a not-found netgroup response to the cache, the client request can result in a null pointer     dereference. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability     is only present in the nscd binary. (CVE-2024-33600)

  - nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's     (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a     memory allocation failure resulting in a denial of service to the clients. The flaw was introduced in     glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
    (CVE-2024-33601)

  - nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd)     netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer.
    The flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present     in the nscd binary. (CVE-2024-33602)

  - A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local     network, allowing remote command execution with the privileges of the Redis user. This issue can only be     exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually.
    The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This     flaw affects PCP versions 4.3.4 and newer. (CVE-2024-3019)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

  - A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary     locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image     with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the     host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write     access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753)

  - The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

  - Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of     standards. An attacker could send a JWE containing compressed data that used large amounts of memory and     CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed     data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been     patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180)

  - Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar     to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template,     potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject     arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to     XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
    (CVE-2024-22195)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is     then used by unsquashfs to create the new file during the unsquash. The filename is not validated for     traversal outside of the destination directory, and thus allows writing to locations outside of the     destination. (CVE-2021-40153)

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader     interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to     an xmlValidatePopElement use-after-free. (CVE-2024-25062)

  - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker     to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some     circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code     execution and secure boot protection bypass may be achieved. (CVE-2023-4692)

  - An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically     present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations.
    A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting     a high Confidentiality risk. (CVE-2023-4693)

  - A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set-     bootflag will create a temporary file with the new grubenv content and rename it to the original grubenv     file. If the program is killed before the rename operation, the temporary file will not be removed and may     fill the filesystem when invoked multiple times, resulting in a filesystem out of free inodes or blocks.
    (CVE-2024-1048)

  - jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens     (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),     and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,     specifically related to the support for decompressing plaintext after its decryption. Under certain     conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory     during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    (CVE-2024-28176)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3186-1 advisory.

    Update to version 1.35.4:

    * CVE-2024-3727 updates (bsc#1224117)
    * Bump go-jose CVE-2024-28180
    * Bump ocicrypt and go-jose CVE-2024-28180

    Update to version 1.35.3:

    * correctly configure /etc/hosts and resolv.conf
    * buildah: refactor resolv/hosts setup.
    * rename the hostFile var to reflect
    * CVE-2024-24786 protobuf to 1.33


    Update to version 1.35.1:

    * CVE-2024-1753 container escape fix (bsc#1221677)

    - Buildah dropped cni support, require netavark instead (bsc#1221243)

    - Remove obsolete requires libcontainers-image & libcontainers-storage

    - Require passt for rootless networking (poo#156955)       Buildah moved to passt/pasta for rootless networking from slirp4netns       (https://github.com/containers/common/pull/1846)

    Update to version 1.35.0:

    * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
    * conformance tests: don't break on trailing zeroes in layer blobs
    * Add a conformance test for copying to a mounted prior stage
    * cgroups: reuse version check from c/common
    * Update vendor of containers/(common,image)
    * manifest add: complain if we get artifact flags without --artifact
    * Use retry logic from containers/common
    * Vendor in containers/(storage,image,common)
    * Update module golang.org/x/crypto to v0.20.0
    * Add comment re: Total Success task name
    * tests: skip_if_no_unshare(): check for --setuid
    * Properly handle build --pull=false
    * Update module go.etcd.io/bbolt to v1.3.9
    * Update module github.com/opencontainers/image-spec to v1.1.0
    * build --all-platforms: skip some base 'image' platforms
    * Bump main to v1.35.0-dev
    * Vendor in latest containers/(storage,image,common)
    * Split up error messages for missing --sbom related flags
    * `buildah manifest`: add artifact-related options
    * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
    * cmd/buildah/manifest.go: don't make struct declarations aliases
    * Use golang.org/x/exp/slices.Contains
    * Try Cirrus with a newer VM version
    * Set CONTAINERS_CONF in the chroot-mount-flags integration test
    * Update to match dependency API update
    * Update github.com/openshift/imagebuilder and containers/common
    * docs: correct default authfile path
    * tests: retrofit test for heredoc summary
    * build, heredoc: show heredoc summary in build output
    * manifest, push: add support for --retry and --retry-delay
    * imagebuildah: fix crash with empty RUN
    * Make buildah match podman for handling of ulimits
    * docs: move footnotes to where they're applicable
    * Allow users to specify no-dereference
    * docs: use reversed logo for dark theme in README
    * build,commit: add --sbom to scan and produce SBOMs when committing
    * commit: force omitHistory if the parent has layers but no history
    * docs: fix a couple of typos
    * internal/mkcw.Archive(): handle extra image content
    * stage_executor,heredoc: honor interpreter in heredoc
    * stage_executor,layers: burst cache if heredoc content is changed
    * Replace map[K]bool with map[K]struct{} where it makes sense
    * Bump CI VMs
    * Replace strings.SplitN with strings.Cut
    * Document use of containers-transports values in buildah
    * manifest: addCompression use default from containers.conf
    * commit: add a --add-file flag
    * mkcw: populate the rootfs using an overlay
    * [skip-ci] Update actions/stale action to v9
    * Ignore errors if label.Relabel returns ENOSUP

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
194831	RHEL 9 : skopeo (RHSA-2024:2549)	Nessus	Red Hat Local Security Checks	4/30/2024	6/4/2024	medium
205704	Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2024-042)	Nessus	Amazon Linux Local Security Checks	8/17/2024	8/28/2024	critical
192715	Fedora 38 : podman-tui (2024-529fe8a802)	Nessus	Fedora Local Security Checks	3/30/2024	3/30/2024	medium
194609	Fedora 40 : podman-tui (2024-831bad8f8f)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	medium
200390	Oracle Linux 9 : buildah (ELSA-2024-3827)	Nessus	Oracle Linux Local Security Checks	6/12/2024	6/12/2024	medium
194565	Fedora 40 : apptainer (2024-560a7aca85)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	medium
195213	RHEL 8 / 9 : OpenShift Container Platform 4.15.12 (RHSA-2024:2669)	Nessus	Red Hat Local Security Checks	5/9/2024	6/4/2024	high
206720	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.8.1.5)	Nessus	Misc.	9/6/2024	9/6/2024	high
206956	SUSE SLES15 Security Update : buildah (SUSE-SU-2024:3186-1)	Nessus	SuSE Local Security Checks	9/11/2024	9/11/2024	high

Detections

Analytics

Plugins Search

medium

critical

medium

medium

medium

medium

high

high

high