The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7457 advisory.
golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)
runc: incorrect handling of inheritable capabilities (CVE-2022-29162)
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. (CVE-2022-2990)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2022:7457. The text
# itself is copyright (C) Red Hat, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(167128);
script_version("1.5");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/10/05");
script_cve_id(
"CVE-2021-36221",
"CVE-2021-41190",
"CVE-2022-1708",
"CVE-2022-2990",
"CVE-2022-27191",
"CVE-2022-29162"
);
script_xref(name:"RHSA", value:"2022:7457");
script_name(english:"RHEL 8 : container-tools:rhel8 (RHSA-2022:7457)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2022:7457 advisory.
- golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
- opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
- cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
- The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to
crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)
- runc: incorrect handling of inheritable capabilities (CVE-2022-29162)
- An incorrect handling of the supplementary groups in the Buildah container engine might lead to the
sensitive information disclosure or possible data modification if an attacker has direct access to the
affected container where supplementary groups are used to set access permissions and is able to execute a
binary code in that container. (CVE-2022-2990)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2021-36221");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2021-41190");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2022-1708");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2022-2990");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2022-27191");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2022-29162");
script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2022:7457");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1995656");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/2024938");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/2085361");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/2086398");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-29162");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_cwe_id(276, 327, 362, 400, 770, 842, 843);
script_set_attribute(attribute:"vuln_publication_date", value:"2021/08/08");
script_set_attribute(attribute:"patch_publication_date", value:"2022/11/08");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/11/08");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:aardvark-dns");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cockpit-podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:conmon");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:container-selinux");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containers-common");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:crit");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu-libs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:crun");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libslirp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libslirp-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:netavark");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-catatonit");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-gvproxy");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-plugins");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-remote");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-criu");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:toolbox");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:toolbox-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:udica");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var appstreams = {
'container-tools:rhel8': [
{
'repo_relative_urls': [
'content/dist/rhel8/8/aarch64/appstream/debug',
'content/dist/rhel8/8/aarch64/appstream/os',
'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',
'content/dist/rhel8/8/aarch64/baseos/debug',
'content/dist/rhel8/8/aarch64/baseos/os',
'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',
'content/dist/rhel8/8/aarch64/codeready-builder/debug',
'content/dist/rhel8/8/aarch64/codeready-builder/os',
'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',
'content/dist/rhel8/8/aarch64/highavailability/debug',
'content/dist/rhel8/8/aarch64/highavailability/os',
'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',
'content/dist/rhel8/8/aarch64/supplementary/debug',
'content/dist/rhel8/8/aarch64/supplementary/os',
'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',
'content/dist/rhel8/8/ppc64le/appstream/debug',
'content/dist/rhel8/8/ppc64le/appstream/os',
'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',
'content/dist/rhel8/8/ppc64le/baseos/debug',
'content/dist/rhel8/8/ppc64le/baseos/os',
'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',
'content/dist/rhel8/8/ppc64le/codeready-builder/debug',
'content/dist/rhel8/8/ppc64le/codeready-builder/os',
'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',
'content/dist/rhel8/8/ppc64le/highavailability/debug',
'content/dist/rhel8/8/ppc64le/highavailability/os',
'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',
'content/dist/rhel8/8/ppc64le/resilientstorage/debug',
'content/dist/rhel8/8/ppc64le/resilientstorage/os',
'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',
'content/dist/rhel8/8/ppc64le/sap-solutions/debug',
'content/dist/rhel8/8/ppc64le/sap-solutions/os',
'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',
'content/dist/rhel8/8/ppc64le/sap/debug',
'content/dist/rhel8/8/ppc64le/sap/os',
'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',
'content/dist/rhel8/8/ppc64le/supplementary/debug',
'content/dist/rhel8/8/ppc64le/supplementary/os',
'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',
'content/dist/rhel8/8/s390x/appstream/debug',
'content/dist/rhel8/8/s390x/appstream/os',
'content/dist/rhel8/8/s390x/appstream/source/SRPMS',
'content/dist/rhel8/8/s390x/baseos/debug',
'content/dist/rhel8/8/s390x/baseos/os',
'content/dist/rhel8/8/s390x/baseos/source/SRPMS',
'content/dist/rhel8/8/s390x/codeready-builder/debug',
'content/dist/rhel8/8/s390x/codeready-builder/os',
'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',
'content/dist/rhel8/8/s390x/highavailability/debug',
'content/dist/rhel8/8/s390x/highavailability/os',
'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',
'content/dist/rhel8/8/s390x/resilientstorage/debug',
'content/dist/rhel8/8/s390x/resilientstorage/os',
'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',
'content/dist/rhel8/8/s390x/sap/debug',
'content/dist/rhel8/8/s390x/sap/os',
'content/dist/rhel8/8/s390x/sap/source/SRPMS',
'content/dist/rhel8/8/s390x/supplementary/debug',
'content/dist/rhel8/8/s390x/supplementary/os',
'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',
'content/dist/rhel8/8/x86_64/appstream/debug',
'content/dist/rhel8/8/x86_64/appstream/os',
'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',
'content/dist/rhel8/8/x86_64/baseos/debug',
'content/dist/rhel8/8/x86_64/baseos/os',
'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',
'content/dist/rhel8/8/x86_64/codeready-builder/debug',
'content/dist/rhel8/8/x86_64/codeready-builder/os',
'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',
'content/dist/rhel8/8/x86_64/highavailability/debug',
'content/dist/rhel8/8/x86_64/highavailability/os',
'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',
'content/dist/rhel8/8/x86_64/nfv/debug',
'content/dist/rhel8/8/x86_64/nfv/os',
'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',
'content/dist/rhel8/8/x86_64/resilientstorage/debug',
'content/dist/rhel8/8/x86_64/resilientstorage/os',
'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',
'content/dist/rhel8/8/x86_64/rt/debug',
'content/dist/rhel8/8/x86_64/rt/os',
'content/dist/rhel8/8/x86_64/rt/source/SRPMS',
'content/dist/rhel8/8/x86_64/sap-solutions/debug',
'content/dist/rhel8/8/x86_64/sap-solutions/os',
'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',
'content/dist/rhel8/8/x86_64/sap/debug',
'content/dist/rhel8/8/x86_64/sap/os',
'content/dist/rhel8/8/x86_64/sap/source/SRPMS',
'content/dist/rhel8/8/x86_64/supplementary/debug',
'content/dist/rhel8/8/x86_64/supplementary/os',
'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'
],
'pkgs': [
{'reference':'aardvark-dns-1.1.0-4.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'buildah-1.27.0-2.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'buildah-tests-1.27.0-2.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'cockpit-podman-53-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
{'reference':'conmon-2.1.4-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'container-selinux-2.189.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'containernetworking-plugins-1.1.1-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'containers-common-1-40.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2', 'allowmaj':TRUE},
{'reference':'crit-3.15-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-3.15-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-devel-3.15-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-libs-3.15-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'crun-1.5-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fuse-overlayfs-1.9-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-4.4.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-devel-4.4.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'netavark-1.1.0-6.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'oci-seccomp-bpf-hook-1.2.6-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'podman-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-catatonit-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-docker-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-gvproxy-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-plugins-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-remote-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-tests-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'python3-criu-3.15-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'python3-podman-4.2.0-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'runc-1.1.4-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'skopeo-1.9.2-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'skopeo-tests-1.9.2-1.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'slirp4netns-1.2.0-2.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'toolbox-0.0.99.3-0.6.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'toolbox-tests-0.0.99.3-0.6.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'udica-0.2.6-3.module+el8.7.0+16772+33343656', 'release':'8', 'rpm_spec_vers_cmp':TRUE}
]
}
]
};
var applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:appstreams, appstreams:TRUE);
if(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);
var module_ver = get_kb_item('Host/RedHat/appstream/container-tools');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);
var flag = 0;
var appstreams_found = 0;
foreach var module (keys(appstreams)) {
var appstream = NULL;
var appstream_name = NULL;
var appstream_version = NULL;
var appstream_split = split(module, sep:':', keep:FALSE);
if (!empty_or_null(appstream_split)) {
appstream_name = appstream_split[0];
appstream_version = appstream_split[1];
if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);
}
if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
appstreams_found++;
foreach var module_array ( appstreams[module] ) {
var repo_relative_urls = NULL;
if (!empty_or_null(module_array['repo_relative_urls'])) repo_relative_urls = module_array['repo_relative_urls'];
foreach var package_array ( module_array['pkgs'] ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
var exists_check = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'RHEL' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (reference &&
_release &&
rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&
(applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&
rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
}
}
if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if (flag)
{
var extra = NULL;
if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();
else extra = rpm_report_get();
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : extra
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'aardvark-dns / buildah / buildah-tests / cockpit-podman / conmon / etc');
}
Vendor | Product | Version | CPE |
---|---|---|---|
redhat | enterprise_linux | 8 | cpe:/o:redhat:enterprise_linux:8 |
redhat | enterprise_linux | aardvark-dns | p-cpe:/a:redhat:enterprise_linux:aardvark-dns |
redhat | enterprise_linux | buildah | p-cpe:/a:redhat:enterprise_linux:buildah |
redhat | enterprise_linux | buildah-tests | p-cpe:/a:redhat:enterprise_linux:buildah-tests |
redhat | enterprise_linux | cockpit-podman | p-cpe:/a:redhat:enterprise_linux:cockpit-podman |
redhat | enterprise_linux | conmon | p-cpe:/a:redhat:enterprise_linux:conmon |
redhat | enterprise_linux | container-selinux | p-cpe:/a:redhat:enterprise_linux:container-selinux |
redhat | enterprise_linux | containernetworking-plugins | p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins |
redhat | enterprise_linux | containers-common | p-cpe:/a:redhat:enterprise_linux:containers-common |
redhat | enterprise_linux | crit | p-cpe:/a:redhat:enterprise_linux:crit |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36221
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41190
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1708
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27191
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29162
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2990
access.redhat.com/errata/RHSA-2022:7457
access.redhat.com/security/cve/CVE-2021-36221
access.redhat.com/security/cve/CVE-2021-41190
access.redhat.com/security/cve/CVE-2022-1708
access.redhat.com/security/cve/CVE-2022-27191
access.redhat.com/security/cve/CVE-2022-29162
access.redhat.com/security/cve/CVE-2022-2990
bugzilla.redhat.com/1995656
bugzilla.redhat.com/2024938
bugzilla.redhat.com/2085361
bugzilla.redhat.com/2086398