MiracleLinux 8 : container-tools:rhel8 bug fix and enhancement update (AXSA:2024-8497:03)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2024-8497:03.
##

include('compat.inc');

if (description)
{
  script_id(292294);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/20");

  script_cve_id("CVE-2024-28176", "CVE-2024-28180");

  script_name(english:"MiracleLinux 8 : container-tools:rhel8 bug fix and enhancement update (AXSA:2024-8497:03)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2024-8497:03 advisory.

    * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
      * buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
      * podman: jose-go: resource exhaustion (CVE-2024-28176)
      * buildah: jose-go: resource exhaustion (CVE-2024-28176)
      * skopeo: jose-go: resource exhaustion (CVE-2024-28176)
    Additional Changes:
    For detailed information on changes in this release, see the Asianux Server 8 Release Notes linked from
    the References section.
    CVE-2024-28176
    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens
    (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS),
    and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces,
    specifically related to the support for decompressing plaintext after its decryption. Under certain
    conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory
    during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.
    CVE-2024-28180
    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of
    standards. An attacker could send a JWE containing compressed data that used large amounts of memory and
    CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed
    data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been
    patched in versions 4.0.1, 3.0.3 and 2.6.3.
    Modularity name: container-tools
    Stream name: rhel8

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/19681");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-28176");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_set_attribute(attribute:"vendor_severity", value:"Moderate");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:aardvark-dns");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:buildah");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:buildah-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:buildah-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:cockpit-podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:conmon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:conmon-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:container-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:containernetworking-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:containernetworking-plugins-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:containers-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:crit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:criu-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:criu-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:criu-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:crun");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:crun-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:fuse-overlayfs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:fuse-overlayfs-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libslirp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libslirp-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:libslirp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:netavark");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:oci-seccomp-bpf-hook");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:oci-seccomp-bpf-hook-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-catatonit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-gvproxy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-remote");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:podman-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:python3-podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:runc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:runc-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:skopeo-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:slirp4netns");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:slirp4netns-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:toolbox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:toolbox-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:toolbox-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:udica");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:8");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^8([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 8.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var module_ver = get_kb_item('Host/MiracleLinux/appstream/container-tools');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);

var constraints = {
  'container-tools:rhel8': [
    {
      'release': '8',
      'pkgs': [
        {'reference':'aardvark-dns-1.10.0-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'buildah-1.33.7-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'buildah-debugsource-1.33.7-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'buildah-tests-1.33.7-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'cockpit-podman-84.1-1.module+el8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0', 'allowmaj':TRUE},
        {'reference':'conmon-2.1.10-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'conmon-debugsource-2.1.10-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'container-selinux-2.229.0-2.module+el8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'containernetworking-plugins-1.4.0-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'containernetworking-plugins-debugsource-1.4.0-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'containers-common-1-81.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'crit-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'criu-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'criu-debugsource-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'criu-devel-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'criu-libs-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'crun-1.14.3-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'crun-debugsource-1.14.3-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'fuse-overlayfs-1.13-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'fuse-overlayfs-debugsource-1.13-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'libslirp-4.4.0-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'libslirp-debugsource-4.4.0-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'libslirp-devel-4.4.0-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'netavark-1.10.3-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'oci-seccomp-bpf-hook-1.2.10-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'oci-seccomp-bpf-hook-debugsource-1.2.10-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-catatonit-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-debugsource-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-docker-4.9.4-3.module+el8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-gvproxy-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-plugins-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-remote-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'podman-tests-4.9.4-3.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'python3-criu-3.18-5.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'python3-podman-4.9.0-1.module+el8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'runc-1.1.12-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'runc-debugsource-1.1.12-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'skopeo-1.14.3-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'skopeo-tests-1.14.3-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'slirp4netns-1.2.3-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'slirp4netns-debugsource-1.2.3-1.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'toolbox-0.0.99.5-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'toolbox-debugsource-0.0.99.5-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'toolbox-tests-0.0.99.5-2.module+el8', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
        {'reference':'udica-0.2.6-21.module+el8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
      ]
    }
  ]
};

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
var appstreams_found = 0;
var appstream;
var appstream_name;
var appstream_version;
foreach var module (keys(constraints)) {
  appstream = NULL;
  appstream_name = NULL;
  appstream_version = NULL;
  appstream_split = split(module, sep:':', keep:FALSE);
  if (!empty_or_null(appstream_split)) {
    appstream_name = appstream_split[0];
    appstream_version = appstream_split[1];
    if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/MiracleLinux/appstream/' + appstream_name);
  }
  if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
    appstreams_found++;
    foreach var module_array ( constraints[module] ) {
      # Check that the target release is equal to the affected release
      if (!empty_or_null(module_array['release'])){
        if (module_array['release'] != os_release) continue;
      }
      if (!empty_or_null(module_array['sp'])){
        if (module_array['sp'] != os_sp) continue;
      }
      foreach var package_array ( module_array['pkgs'] ) {
        reference = NULL;
        sp = NULL;
        _cpu = NULL;
        el_string = NULL;
        rpm_spec_vers_cmp = NULL;
        epoch = NULL;
        allowmaj = NULL;
        exists_check = NULL;
        cves = NULL;
        if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
        if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
        if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
        if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
        if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
        if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
        if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
        if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
        if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
        if (reference &&
            (!exists_check || rpm_exists(rpm:exists_check)) &&
            rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
      }
    }
  }
}

if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'aardvark-dns / buildah / buildah-debugsource / buildah-tests / etc');
}