Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nessusThis script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.ROCKY_LINUX_RLSA-2020-1650.NASL
HistoryNov 07, 2023 - 12:00 a.m.

Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)

2023-11-0700:00:00
This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
7
rocky linux 8
vulnerabilities
container tools
rlsa-2020:1650
access control
escalation of privileges
memory consumption
podman flaw

6.7 Medium

AI Score

Confidence

High

JSON

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory.

  • runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  • A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  • A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Rocky Linux Security Advisory RLSA-2020:1650.
##

include('compat.inc');

if (description)
{
  script_id(185067);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/11/07");

  script_cve_id("CVE-2019-19921", "CVE-2020-1702", "CVE-2020-1726");
  script_xref(name:"RLSA", value:"2020:1650");

  script_name(english:"Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Rocky Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
RLSA-2020:1650 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to
    libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with
    custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect
    Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container
    runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker
    can use this flaw to trick a user, with privileges to pull container images, into crashing the process
    responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing
    files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a
    container based on a malicious image with an attached volume that is used for the first time, it is
    possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://errata.rockylinux.org/RLSA-2020:1650");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1703245");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1717357");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1731107");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1732704");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1732713");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1748519");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1749999");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1754744");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1754763");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1755119");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1756919");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1757693");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1757845");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1763454");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1766774");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1768930");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1769469");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1771990");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1774755");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1775307");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1776112");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1779834");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1783267");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1783268");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1783270");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1783272");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1783274");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1784267");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1784952");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1788539");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1792796");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1793084");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1793598");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1796107");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1801152");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1802907");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1803496");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1804849");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1805017");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1805212");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1806901");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1808707");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1810053");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1811514");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=1813295");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1726");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2019-19921");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:container-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:crit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:criu-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:criu-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:python-podman-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:python3-criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:runc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:runc-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:runc-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:slirp4netns");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:slirp4netns-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:slirp4netns-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:toolbox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:rocky:linux:udica");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rocky:linux:8");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Rocky Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RockyLinux/release", "Host/RockyLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RockyLinux/release');
if (isnull(os_release) || 'Rocky Linux' >!< os_release) audit(AUDIT_OS_NOT, 'Rocky Linux');
var os_ver = pregmatch(pattern: "Rocky(?: Linux)? release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Rocky Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Rocky Linux 8.x', 'Rocky Linux ' + os_ver);

if (!get_kb_item('Host/RockyLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Rocky Linux', cpu);

var pkgs = [
    {'reference':'container-selinux-2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
    {'reference':'crit-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'crit-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'crit-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'crit-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debuginfo-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debuginfo-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debuginfo-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debuginfo-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debugsource-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debugsource-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debugsource-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'criu-debugsource-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-criu-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-criu-3.12-9.module+el8.4.0+557+48ba8b2f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-criu-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'python3-criu-3.12-9.module+el8.5.0+681+c9a1951f', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-debugsource-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'runc-debugsource-1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+536+994a2182', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.5.0+708+6758137d', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'aarch64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861', 'cpu':'x86_64', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'toolbox-0.0.7-1.module+el8.4.0+559+c02fa3b2', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'toolbox-0.0.7-1.module+el8.5.0+708+6758137d', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'toolbox-0.0.7-1.module+el8.5.0+770+e2f49861', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'udica-0.2.1-2.module+el8.4.0+559+c02fa3b2', 'release':'8', 'el_string':'el8.4.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'udica-0.2.1-2.module+el8.5.0+708+6758137d', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'udica-0.2.1-2.module+el8.5.0+770+e2f49861', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = 'Rocky-' + package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'container-selinux / crit / criu / criu-debuginfo / criu-debugsource / etc');
}
VendorProductVersionCPE
rockylinuxcontainer-selinuxp-cpe:/a:rocky:linux:container-selinux
rockylinuxcritp-cpe:/a:rocky:linux:crit
rockylinuxcriup-cpe:/a:rocky:linux:criu
rockylinuxcriu-debuginfop-cpe:/a:rocky:linux:criu-debuginfo
rockylinuxcriu-debugsourcep-cpe:/a:rocky:linux:criu-debugsource
rockylinuxpython-podman-apip-cpe:/a:rocky:linux:python-podman-api
rockylinuxpython3-criup-cpe:/a:rocky:linux:python3-criu
rockylinuxruncp-cpe:/a:rocky:linux:runc
rockylinuxrunc-debuginfop-cpe:/a:rocky:linux:runc-debuginfo
rockylinuxrunc-debugsourcep-cpe:/a:rocky:linux:runc-debugsource
Rows per page:
1-10 of 161

References

Related

nessus 65
redhat 18
rocky 1
osv 15
almalinux 4
oraclelinux 4
redhatcve 4
alpinelinux 3
openvas 31
cve 4
photon 13
veracode 5
altlinux 1
prion 4
amazon 1
mageia 2
fedora 7
suse 3
ubuntucve 3
github 3
debiancve 3
ubuntu 2
rosalinux 1
gentoo 1
debian 1
nessus
nessus
Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)
2023-09-07 00:00:00
RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)
2020-04-28 00:00:00
CentOS 8 : container-tools:rhel8 (CESA-2020:1650)
2021-02-01 00:00:00
redhat
redhat
(RHSA-2020:1650) Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
(RHSA-2020:1485) Moderate: OpenShift Container Platform 4.3.13 runc security update
2020-04-20 17:07:18
(RHSA-2020:0942) Moderate: runc security update
2020-03-23 13:32:09
rocky
rocky
container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
osv
osv
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
Race condition in github.com/opencontainers/runc
2021-04-14 20:04:52
almalinux
almalinux
Moderate: container-tools:rhel8 security, bug fix, and enhancement update
2020-04-28 09:01:00
Moderate: runc security update
2023-11-07 00:00:00
Moderate: container-tools:4.0 security and bug fix update
2023-11-14 00:00:00
oraclelinux
oraclelinux
container-tools:ol8 security, bug fix, and enhancement update
2020-05-05 00:00:00
container-tools:ol8 security update
2020-05-12 00:00:00
container-tools:2.0 security update
2021-03-05 00:00:00
redhatcve
redhatcve
CVE-2019-19921
2020-01-29 16:31:25
CVE-2020-1702
2020-01-22 04:10:00
CVE-2020-1726
2020-04-07 11:38:35
alpinelinux
alpinelinux
CVE-2019-19921
2020-02-12 15:15:00
CVE-2020-1726
2020-02-11 20:15:00
CVE-2023-27561
2023-03-03 19:15:11
openvas
openvas
Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2022-1550)
2022-04-25 00:00:00
Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2023-1617)
2023-04-13 00:00:00
Mageia: Security Advisory (MGASA-2020-0103)
2022-01-28 00:00:00
cve
cve
CVE-2019-19921
2020-02-12 15:15:00
CVE-2020-1702
2021-05-27 20:15:00
CVE-2020-1726
2020-02-11 20:15:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0275
2020-08-22 00:00:00
Important Photon OS Security Update - PHSA-2020-0275
2020-08-22 00:00:00
Important Photon OS Security Update - PHSA-2020-0102
2020-06-09 00:00:00
veracode
veracode
Sandbox Restrictions Bypass
2020-01-16 05:48:35
Denial Of Service (DoS)
2020-02-18 09:40:33
Unauthorized File Overwrite
2020-02-12 09:24:57
altlinux
altlinux
Security fix for the ALT Linux 10 package runc version 1.0.0-alt12.rc10
2020-02-17 00:00:00
prion
prion
Improper access control
2020-02-12 15:15:00
Code injection
2020-02-11 20:15:00
Code injection
2021-05-27 20:15:00
amazon
amazon
Medium: runc
2020-04-20 18:58:00
mageia
mageia
Updated opencontainers-runc packages fix security vulnerability
2020-02-26 13:21:01
Updated opencontainers-runc packages fix security vulnerability
2023-04-07 00:20:12
fedora
fedora
[SECURITY] Fedora 31 Update: runc-1.0.0-102.dev.gitdc9208a.fc31
2020-02-08 02:05:47
[SECURITY] Fedora 30 Update: runc-1.0.0-102.dev.gitdc9208a.fc30
2020-02-08 01:40:01
[SECURITY] Fedora 37 Update: runc-1.1.6-1.fc37
2023-04-21 02:11:21
suse
suse
Security update for docker-runc (moderate)
2020-02-13 00:00:00
Security update for conmon, fuse-overlayfs, libcontainers-common, podman (moderate)
2020-09-27 00:00:00
Security update for conmon, fuse-overlayfs, libcontainers-common, podman (moderate)
2020-09-28 00:00:00
ubuntucve
ubuntucve
CVE-2019-19921
2020-02-12 00:00:00
CVE-2020-1726
2020-02-11 00:00:00
CVE-2023-27561
2023-03-03 00:00:00
github
github
opencontainers runc contains procfs race condition with a shared volume mount
2021-05-27 18:41:17
Podman has Files or Directories Accessible to External Parties
2022-05-24 17:08:34
Opencontainers runc Incorrect Authorization vulnerability
2023-03-03 21:30:19
debiancve
debiancve
CVE-2019-19921
2020-02-12 15:15:00
CVE-2020-1726
2020-02-11 20:15:00
CVE-2023-27561
2023-03-03 19:15:11
ubuntu
ubuntu
runC vulnerabilities
2020-03-09 00:00:00
runC vulnerabilities
2023-05-23 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2393
2024-04-11 07:16:35
gentoo
gentoo
runC: Multiple vulnerabilities
2020-03-15 00:00:00
debian
debian
[SECURITY] [DLA 3369-1] runc security update
2023-03-27 16:07:07

6.7 Medium

AI Score

Confidence

High

JSON
Related for ROCKY_LINUX_RLSA-2020-1650.NASL
nessus65redhat18rocky1osv15almalinux4oraclelinux4redhatcve4alpinelinux3openvas31cve4photon13veracode5altlinux1prion4amazon1mageia2fedora7suse3ubuntucve3github3debiancve3ubuntu2rosalinux1gentoo1debian1