DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENSUSE-SU-2022:23018-1", "vendorId": null, "type": "suse", "bulletinFamily": "unix", "title": "Security update for conmon, libcontainers-common, libseccomp, podman (moderate)", "description": "An update that solves 7 vulnerabilities, contains one\n feature and has one errata is now available.\n\nDescription:\n\n This update for conmon, libcontainers-common, libseccomp, podman fixes the\n following issues:\n\n podman was updated to 3.4.4.\n\n Security issues fixed:\n\n\n - fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index\n parsing confusion\n - fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with\n port binded to all IPs\n - fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers\n is seen as orginating from localhost\n\n - Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer\n upgrade path from podman < 3.1.2\n\n Update to version 3.4.4:\n\n * Bugfixes\n\n - Fixed a bug where the podman exec command would, under some\n circumstances, print a warning message about failing to move conmon\n to the appropriate cgroup (#12535).\n - Fixed a bug where named volumes created as part of container\n creation (e.g. podman run --volume avolume:/a/mountpoint or similar)\n would be mounted with incorrect permissions (#12523).\n - Fixed a bug where the podman-remote create and podman-remote run\n commands did not properly handle the --entrypoint=\"\" option (to\n clear the container's entrypoint) (#12521).\n\n - Update to version 3.4.3:\n\n * Security\n\n - This release addresses CVE-2021-4024, where the podman machine\n command opened the gvproxy API (used to forward ports to podman\n machine VMs) to the public internet on port 7777.\n - This release addresses CVE-2021-41190, where incomplete\n specification of behavior regarding image manifests could lead to\n inconsistent decoding on different clients.\n\n * Features\n\n - The --secret type=mount option to podman create and podman run\n supports a new option, target=, which specifies where in the\n container the secret will be mounted (#12287).\n\n * Bugfixes\n\n - Fixed a bug where rootless Podman would occasionally print warning\n messages about failing to move the pause process to a new cgroup\n (#12065).\n - Fixed a bug where the podman run and podman create commands would,\n when pulling images, still require TLS even with registries set to\n Insecure via config file (#11933).\n - Fixed a bug where the podman generate systemd command generated\n units that depended on multi-user.target, which has been removed\n from some distributions (#12438).\n - Fixed a bug where Podman could not run containers with images that\n had /etc/ as a symlink (#12189).\n - Fixed a bug where the podman logs -f command would, when using the\n journald logs backend, exit immediately if the container had\n previously been restarted (#12263).\n - Fixed a bug where, in containers on VMs created by podman machine,\n the host.containers.internal name pointed to the VM, not the host\n system (#11642).\n - Fixed a bug where containers and pods created by the podman play\n kube command in VMs managed by podman machine would not\n automatically forward ports from the host machine (#12248).\n - Fixed a bug where podman machine init would fail on OS X when GNU\n Coreutils was installed (#12329).\n - Fixed a bug where podman machine start would exit before SSH on the\n started VM was accepting connections (#11532).\n - Fixed a bug where the podman run command with signal proxying\n (--sig-proxy) enabled could print an error if it attempted to send a\n signal to a container that had just exited (#8086).\n - Fixed a bug where the podman stats command would not return correct\n information for containers running Systemd as PID1 (#12400).\n - Fixed a bug where the podman image save command would fail on OS X\n when writing the image to STDOUT (#12402).\n - Fixed a bug where the podman ps command did not properly handle PS\n arguments which contained whitespace (#12452).\n - Fixed a bug where the podman-remote wait command could fail to\n detect that the container exited and return an error under some\n circumstances (#12457).\n - Fixed a bug where the Windows MSI installer for podman-remote would\n break the PATH environment variable by adding an extra \" (#11416).\n\n * API\n\n - The Libpod Play Kube endpoint now also accepts ConfigMap YAML as\n part of its payload, and will use provided any ConfigMap to\n configure provided pods and services.\n - Fixed a bug where the Compat Create endpoint for Containers would\n not always create the container's working directory if it did not\n exist (#11842).\n - Fixed a bug where the Compat Create endpoint for Containers returned\n an incorrect error message with 404 errors when the requested image\n was not found (#12315).\n - Fixed a bug where the Compat Create endpoint for Containers did not\n properly handle the HostConfig.Mounts field (#12419).\n - Fixed a bug where the Compat Archive endpoint for Containers did not\n properly report errors when the operation failed (#12420).\n - Fixed a bug where the Compat Build endpoint for Images ignored the\n layers query parameter (for caching intermediate layers from the\n build) (#12378).\n - Fixed a bug where the Compat Build endpoint for Images did not\n report errors in a manner compatible with Docker (#12392).\n - Fixed a bug where the Compat Build endpoint for Images would fail to\n build if the context directory was a symlink (#12409).\n - Fixed a bug where the Compat List endpoint for Images included\n manifest lists (and not just images) in returned results (#12453).\n\n - Update to version 3.4.2:\n\n * Fixed a bug where podman tag could not tag manifest lists (#12046).\n * Fixed a bug where built-in volumes specified by images would not be\n created correctly under some circumstances.\n * Fixed a bug where, when using Podman Machine on OS X, containers in\n pods did not have working port forwarding from the host (#12207).\n * Fixed a bug where the podman network reload command command on\n containers using the slirp4netns network mode and the rootlessport\n port forwarding driver would make an unnecessary attempt to restart\n rootlessport\n on containers that did not forward ports.\n * Fixed a bug where the podman generate kube command would generate YAML\n including some unnecessary (set to default) fields (e.g. empty SELinux\n and DNS configuration blocks, and the privileged flag when set to\n false) (#11995).\n * Fixed a bug where the podman pod rm command could, if interrupted at\n the right moment, leave a reference to an already-removed infra\n container behind (#12034).\n * Fixed a bug where the podman pod rm command would not remove pods with\n more than one container if all containers save for the infra container\n were stopped unless --force was specified (#11713).\n * Fixed a bug where the --memory flag to podman run and podman create\n did not accept a limit of 0 (which should specify unlimited memory)\n (#12002).\n * Fixed a bug where the remote Podman client's podman build command\n could attempt to build a Dockerfile in the working directory of the\n podman system service instance instead of the Dockerfile specified by\n the user (#12054).\n * Fixed a bug where the podman logs --tail command could function\n improperly (printing more output than requested) when the journald log\n driver was used.\n * Fixed a bug where containers run using the slirp4netns network mode\n with IPv6 enabled would not have IPv6 connectivity until several\n seconds after they started (#11062).\n * Fixed a bug where some Podman commands could cause an extra\n dbus-daemon process to be created (#9727).\n * Fixed a bug where rootless Podman would sometimes print warnings about\n a failure to move the pause process into a given CGroup (#12065).\n * Fixed a bug where the checkpointed field in podman inspect on a\n container was not set to false after a container was restored.\n * Fixed a bug where the podman system service command would print\n overly-verbose logs about request IDs (#12181).\n * Fixed a bug where Podman could, when creating a new container without\n a name explicitly specified by the user, sometimes use an\n auto-generated name already in use by another container if multiple\n containers were being created in parallel (#11735).\n\n Update to version 3.4.1:\n\n * Bugfixes\n\n - Fixed a bug where podman machine init could, under some\n circumstances, create invalid machine configurations which could not\n be started (#11824).\n - Fixed a bug where the podman machine list command would not properly\n populate some output fields.\n - Fixed a bug where podman machine rm could leave dangling sockets\n from the removed machine (#11393).\n - Fixed a bug where podman run --pids-limit=-1 was not supported (it\n now sets the PID limit in the container to unlimited) (#11782).\n - Fixed a bug where podman run and podman attach could throw errors\n about a closed network connection when STDIN was closed by the\n client (#11856).\n - Fixed a bug where the podman stop command could fail when run on a\n container that had another podman stop command run on it previously.\n - Fixed a bug where the --sync flag to podman ps was nonfunctional.\n - Fixed a bug where the Windows and OS X remote clients' podman stats\n command would fail (#11909).\n - Fixed a bug where the podman play kube command did not properly\n handle environment variables whose values contained an = (#11891).\n - Fixed a bug where the podman generate kube command could generate\n invalid annotations when run on containers with volumes that use\n SELinux relabelling (:z or :Z) (#11929).\n - Fixed a bug where the podman generate kube command would generate\n YAML including some unnecessary (set to default) fields (e.g. user\n and group, entrypoint, default protocol for forwarded ports)\n (#11914, #11915, and #11965).\n - Fixed a bug where the podman generate kube command could, under some\n circumstances, generate YAML including an invalid targetPort field\n for forwarded ports (#11930).\n - Fixed a bug where rootless Podman's podman info command could, under\n some circumstances, not read available CGroup controllers (#11931).\n - Fixed a bug where podman container checkpoint --export would fail to\n checkpoint any container created with --log-driver=none (#11974).\n\n * API\n\n - Fixed a bug where the Compat Create endpoint for Containers could\n panic when no options were passed to a bind mount of tmpfs (#11961).\n\n Update to version 3.4.0:\n\n * Features\n\n - Pods now support init containers! Init containers are containers\n which run before the rest of the pod starts. There are two types of\n init containers: \"always\", which always run before the pod is\n started, and \"once\", which only run the first time the pod starts\n and are subsequently removed. They can be added using the podman\n create command's --init-ctr option.\n - Support for init containers has also been added to podman play kube\n and podman generate kube - init containers contained in Kubernetes\n YAML will be created as Podman init containers, and YAML generated\n by Podman will include any init containers created.\n - The podman play kube command now supports building images. If the\n --build option is given and a directory with the name of the\n specified image exists in the current working directory and contains\n a valid Containerfile or Dockerfile, the image will be built and\n used for the container.\n - The podman play kube command now supports a new option, --teardown,\n which removes any pods and containers created by the given\n Kubernetes YAML.\n - The podman generate kube command now generates annotations for\n SELinux mount options on volume (:z and :Z) that are respected by\n the podman play kube command.\n - A new command has been added, podman pod logs, to return logs for\n all containers in a pod at the same time.\n - Two new commands have been added, podman volume export (to export a\n volume to a tar file) and podman volume import) (to populate a\n volume from a given tar file).\n - The podman auto-update command now supports simple rollbacks. If a\n container fails to start after an automatic update, it will be\n rolled back to the previous image and restarted again.\n - Pods now share their user namespace by default, and the podman pod\n create command now supports the --userns option. This allows\n rootless pods to be created with the --userns=keep-id option.\n - The podman pod ps command now supports a new filter with its\n --filter option, until, which returns pods created before a given\n timestamp.\n - The podman image scp command has been added. This command allows\n images to be transferred between different hosts.\n - The podman stats command supports a new option, --interval, to\n specify the amount of time before the information is refreshed.\n - The podman inspect command now includes ports exposed (but not\n published) by containers (e.g. ports from --expose when\n --publish-all is not specified).\n - The podman inspect command now has a new boolean value,\n Checkpointed, which indicates that a container was stopped as a\n result of a podman container checkpoint operation.\n - Volumes created by podman volume create now support setting quotas\n when run atop XFS. The size and inode options allow the maximum size\n and maximum number of inodes consumed by a volume to be limited.\n - The podman info command now outputs information on what log drivers,\n network drivers, and volume plugins are available for use (#11265).\n - The podman info command now outputs the current log driver in use,\n and the variant and codename of the distribution in use.\n - The parameters of the VM created by podman machine init (amount of\n disk space, memory, CPUs) can now be set in containers.conf.\n - The podman machine ls command now shows additional information\n (CPUs, memory, disk size) about VMs managed by podman machine.\n - The podman ps command now includes healthcheck status in container\n state for containers that have healthchecks (#11527).\n\n * Changes\n\n - The podman build command has a new alias, podman buildx, to improve\n compatibility with Docker. We have already added support for many\n docker buildx flags to podman build and aim to continue to do so.\n - Cases where Podman is run without a user session or a writable\n temporary files directory will now produce better error messages.\n - The default log driver has been changed from file to journald. The\n file driver did not properly support log rotation, so this should\n lead to a better experience. If journald is not available on the\n system, Podman will automatically revert to the file.\n - Podman no longer depends on ip for removing networks (#11403).\n - The deprecated --macvlan flag to podman network create now warns\n when it is used. It will be removed entirely in the Podman 4.0\n release.\n - The podman machine start command now prints a message when the VM is\n successfully started.\n - The podman stats command can now be used on containers that are\n paused.\n - The podman unshare command will now return the exit code of the\n command that was run in the user namespace (assuming the command was\n successfully run).\n - Successful healthchecks will no longer add a healthy line to the\n system log to reduce log spam.\n - As a temporary workaround for a lack of shortname prompts in the\n Podman remote client, VMs created by podman machine now default to\n only using the docker.io registry.\n\n * Bugfixes\n\n - Fixed a bug where whitespace in the definition of sysctls\n (particularly default sysctls specified in containers.conf) would\n cause them to be parsed incorrectly.\n - Fixed a bug where the Windows remote client improperly validated\n volume paths (#10900).\n - Fixed a bug where the first line of logs from a container run with\n the journald log driver could be skipped.\n - Fixed a bug where images created by podman commit did not include\n ports exposed by the container.\n - Fixed a bug where the podman auto-update command would ignore the\n io.containers.autoupdate.authfile label when pulling images (#11171).\n - Fixed a bug where the --workdir option to podman create and podman\n run could not be set to a directory where a volume was mounted\n (#11352).\n - Fixed a bug where systemd socket-activation did not properly work\n with systemd-managed Podman containers (#10443).\n - Fixed a bug where environment variable secrets added to a container\n were not available to exec sessions launched in the container.\n - Fixed a bug where rootless containers could fail to start the\n rootlessport port-forwarding service when XDG_RUNTIME_DIR was set to\n a long path.\n - Fixed a bug where arguments to the --systemd option to podman create\n and podman run were case-sensitive (#11387).\n - Fixed a bug where the podman manifest rm command would also remove\n images referenced by the manifest, not just the manifest itself\n (#11344).\n - Fixed a bug where the Podman remote client on OS X would not\n function properly if the TMPDIR environment variable was not set\n (#11418).\n - Fixed a bug where the /etc/hosts file was not guaranteed to contain\n an entry for localhost (this is still not guaranteed if --net=host\n is used; such containers will exactly match the host's /etc/hosts)\n (#11411).\n - Fixed a bug where the podman machine start command could print\n warnings about unsupported CPU features (#11421).\n - Fixed a bug where the podman info command could segfault when\n accessing cgroup information.\n - Fixed a bug where the podman logs -f command could hang when a\n container exited (#11461).\n - Fixed a bug where the podman generate systemd command could not be\n used on containers that specified a restart policy (#11438).\n - Fixed a bug where the remote Podman client's podman build command\n would fail to build containers if the UID and GID on the client were\n higher than 65536 (#11474).\n - Fixed a bug where the remote Podman client's podman build command\n would fail to build containers if the context directory was a\n symlink (#11732).\n - Fixed a bug where the --network flag to podman play kube was not\n properly parsed when a non-bridge network configuration was\n specified.\n - Fixed a bug where the podman inspect command could error when the\n container being inspected was removed as it was being inspected\n (#11392).\n - Fixed a bug where the podman play kube command ignored the default\n pod infra image specified in containers.conf.\n - Fixed a bug where the --format option to podman inspect was\n nonfunctional under some circumstances (#8785).\n - Fixed a bug where the remote Podman client's podman run and podman\n exec commands could skip a byte of output every 8192 bytes (#11496).\n - Fixed a bug where the podman stats command would print nonsensical\n results if the container restarted while it was running (#11469).\n - Fixed a bug where the remote Podman client would error when STDOUT\n was redirected on a Windows client (#11444).\n - Fixed a bug where the podman run command could return 0 when the\n application in the container exited with 125 (#11540).\n - Fixed a bug where containers with --restart=always set using the\n rootlessport port-forwarding service could not be restarted\n automatically.\n - Fixed a bug where the --cgroups=split option to podman create and\n podman run was silently discarded if the container was part of a pod.\n - Fixed a bug where the podman container runlabel command could fail\n if the image name given included a tag.\n - Fixed a bug where Podman could add an extra 127.0.0.1 entry to\n /etc/hosts under some circumstances (#11596).\n - Fixed a bug where the remote Podman client's podman untag command\n did not properly handle tags including a digest (#11557).\n - Fixed a bug where the --format option to podman ps did not properly\n support the table argument for tabular output.\n - Fixed a bug where the --filter option to podman ps did not properly\n handle filtering by healthcheck status (#11687).\n - Fixed a bug where the podman run and podman start --attach commands\n could race when retrieving the exit code of a container that had\n already been removed resulting in an error (e.g. by an external\n podman rm -f) (#11633).\n - Fixed a bug where the podman generate kube command would add default\n environment variables to generated YAML.\n - Fixed a bug where the podman generate kube command would add the\n default CMD from the image to generated YAML (#11672).\n - Fixed a bug where the podman rm --storage command could fail to\n remove containers under some circumstances (#11207).\n - Fixed a bug where the podman machine ssh command could fail when run\n on Linux (#11731).\n - Fixed a bug where the podman stop command would error when used on a\n container that was already stopped (#11740).\n - Fixed a bug where renaming a container in a pod using the podman\n rename command, then removing the pod using podman pod rm, could\n cause Podman to believe the new name of the container was\n permanently in use, despite the container being removed (#11750).\n\n * API\n\n - The Libpod Pull endpoint for Images now has a new query parameter,\n quiet, which (when set to true) suppresses image pull progress\n reports (#10612).\n - The Compat Events endpoint now includes several deprecated fields\n from the Docker v1.21 API for improved compatibility with older\n clients.\n - The Compat List and Inspect endpoints for Images now prefix image\n IDs with sha256: for improved Docker compatibility (#11623).\n - The Compat Create endpoint for Containers now properly sets defaults\n for healthcheck-related fields (#11225).\n - The Compat Create endpoint for Containers now supports volume\n options provided by the Mounts field (#10831).\n - The Compat List endpoint for Secrets now supports a new query\n parameter, filter, which allows returned results to be filtered.\n - The Compat Auth endpoint now returns the correct response code (500\n instead of 400) when logging into a registry fails.\n - The Version endpoint now includes information about the OCI runtime\n and Conmon in use (#11227).\n - Fixed a bug where the X-Registry-Config header was not properly\n handled, leading to errors when pulling images (#11235).\n - Fixed a bug where invalid query parameters could cause a null\n pointer dereference when creating error messages.\n - Logging of API requests and responses at trace level has been\n greatly improved, including the addition of an X-Reference-Id header\n to correlate requests and responses (#10053).\n\n Update to version 3.3.1:\n\n * Bugfixes\n\n - Fixed a bug where unit files created by podman generate systemd\n could not cleanup shut down containers when stopped by systemctl\n stop (#11304).\n - Fixed a bug where podman machine commands would not properly locate\n the gvproxy binary in some circumstances.\n - Fixed a bug where containers created as part of a pod using the\n --pod-id-file option would not join the pod's network namespace\n (#11303).\n - Fixed a bug where Podman, when using the systemd cgroups driver,\n could sometimes leak dbus sessions.\n - Fixed a bug where the until filter to podman logs and podman events\n was improperly handled, requiring input to be negated (#11158).\n - Fixed a bug where rootless containers using CNI networking run on\n systems using systemd-resolved for DNS would fail to start if\n resolved symlinked /etc/resolv.conf to an absolute path (#11358).\n\n * API\n\n - A large number of potential file descriptor leaks from improperly\n closing client connections have been fixed.\n\n Update to version 3.3.0:\n\n * Fix network aliases with network id\n * machine: compute sha256 as we read the image file\n * machine: check for file exists instead of listing directory\n * pkg/bindings/images.nTar(): slashify hdr.Name values\n * Volumes: Only remove from DB if plugin removal succeeds\n * For compatibility, ignore Content-Type\n * [v3.3] Bump c/image 5.15.2, buildah v1.22.3\n * Implement SD-NOTIFY proxy in conmon\n * Fix rootless cni dns without systemd stub resolver\n * fix rootlessport flake\n * Skip stats test in CGv1 container environments\n * Fix AVC denials in tests of volume mounts\n * Restore buildah-bud test requiring new images\n * Revert \".cirrus.yml: use fresh images for all VMs\"\n * Fix device tests using ls test files\n * Enhance priv. dev. check\n * Workaround host availability of /dev/kvm\n * Skip cgroup-parent test due to frequent flakes\n * Cirrus: Fix not uploading logformatter html\n\n Switch to crun (bsc#1188914)\n\n Update to version 3.2.3:\n\n * Bump to v3.2.3\n * Update release notes for v3.2.3\n * vendor containers/common(a)v0.38.16\n * vendor containers/buildah(a)v1.21.3\n * Fix race conditions in rootless cni setup\n * CNI-in-slirp4netns: fix bind-mount for\n /run/systemd/resolve/stub-resolv.conf\n * Make rootless-cni setup more robust\n * Support uid,gid,mode options for secrets\n * vendor containers/common(a)v0.38.15\n * [CI:DOCS] podman search: clarify that results depend on implementation\n * vendor containers/common(a)v0.38.14\n * vendor containers/common(a)v0.38.13\n * [3.2] vendor containers/common(a)v0.38.12\n * Bump README to v3.2.2\n * Bump to v3.2.3-dev\n\n - Update to version 3.2.2:\n * Bump to v3.2.2\n * fix systemcontext to use correct TMPDIR\n * Scrub podman commands to use report package\n * Fix volumes with uid and gid options\n * Vendor in c/common v0.38.11\n * Initial release notes for v3.2.2\n * Fix restoring of privileged containers\n * Fix handling of podman-remote build --device\n * Add support for podman remote build -f - .\n * Fix panic condition in cgroups.getAvailableControllers\n * Fix permissions on initially created named volumes\n * Fix building static podman-remote\n * add correct slirp ip to /etc/hosts\n * disable tty-size exec checks in system tests\n * Fix resize race with podman exec -it\n * Fix documentation of the --format option of podman push\n * Fix systemd-resolved detection.\n * Health Check is not handled in the compat LibpodToContainerJSON\n * Do not use inotify for OCICNI\n * getContainerNetworkInfo: lock netNsCtr before sync\n * [NO TESTS NEEDED] Create /etc/mtab with the correct ownership\n * Create the /etc/mtab file if does not exists\n * [v3.2] cp: do not allow dir->file copying\n * create: support images with invalid platform\n * vendor containers/common(a)v0.38.10\n * logs: k8s-file: restore poll sleep\n * logs: k8s-file: fix spurious error logs\n * utils: move message from warning to debug\n * Bump to v3.2.2-dev\n\n - Update to version 3.2.1:\n * Bump to v3.2.1\n * Updated release notes for v3.2.1\n * Fix network connect race with docker-compose\n * Revert \"Ensure minimum API version is set correctly in tests\"\n * Fall back to string for dockerfile parameter\n * remote events: fix --stream=false\n * [CI:DOCS] fix incorrect network remove api doc\n * remote: always send resize before the container starts\n * remote events: support labels\n * remote pull: cancel pull when connection is closed\n * Fix network prune api docs\n * Improve systemd-resolved detection\n * logs: k8s-file: fix race\n * Fix image prune --filter cmd behavior\n * Several shell completion fixes\n * podman-remote build should handle -f option properly\n * System tests: deal with crun 0.20.1\n * Fix build tags for pkg/machine...\n * Fix pre-checkpointing\n * container: ignore named hierarchies\n * [v3.2] vendor containers/common(a)v0.38.9\n * rootless: fix fast join userns path\n * [v3.2] vendor containers/common(a)v0.38.7\n * [v3.2] vendor containers/common(a)v0.38.6\n * Correct qemu options for Intel macs\n * Ensure minimum API version is set correctly in tests\n * Bump to v3.2.1-dev\n\n - Update to version 3.2.0:\n * Bump to v3.2.0\n * Fix network create macvlan with subnet option\n * Final release notes updates for v3.2.0\n * add ipv6 nameservers only when the container has ipv6 enabled\n * Use request context instead of background\n * [v.3.2] events: support disjunctive filters\n * System tests: add :Z to volume mounts\n * generate systemd: make mounts portable\n * vendor containers/storage(a)v1.31.3\n * vendor containers/common(a)v0.38.5\n * Bump to v3.2.0-dev\n * Bump to v3.2.0-RC3\n * Update release notes for v3.2.0-RC3\n * Fix race on podman start --all\n * Fix race condition in running ls container in a pod\n * docs: --cert-dir: point to containers-certs.d(5)\n * Handle hard links in different directories\n * Improve OCI Runtime error\n * Handle hard links in remote builds\n * Podman info add support for status of cgroup controllers\n * Drop container does not exist on removal to debugf\n * Downgrade API service routing table logging\n * add libimage events\n * docs: generate systemd: XDG_RUNTIME_DIR\n * Fix problem copying files when container is in host pid namespace\n * Bump to v3.2.0-dev\n * Bump to v3.2.0-RC2\n * update c/common\n * Update Cirrus DEST_BRANCH to v3.2\n * Updated vendors of c/image, c/storage, Buildah\n * Initial release notes for v3.2.0-RC2\n * Add script for identifying commits in release branches\n * Add host.containers.internal entry into container's etc/hosts\n * image prune: remove unused images only with `--all`\n * podman network reload add rootless support\n * Use more recent `stale` release...\n * network tutorial: update with rootless cni changes\n * [CI:DOCS] Update first line in intro page\n * Use updated VM images + updated automation tooling\n * auto-update service: prune images\n * make vendor\n * fix system upgrade tests\n * Print \"extracting\" only on compressed file\n * podman image tree: restore previous behavior\n * fix network restart always test\n * fix incorrect log driver in podman container image\n * Add support for cli network prune --filter flag\n * Move filter parsing to common utils\n * Bump github.com/containers/storage from 1.30.2 to 1.30.3\n * Update nix pin with `make nixpkgs`\n * [CI:DOCS] hack/bats - new helper for running system tests\n * fix restart always with slirp4netns\n * Bump github.com/opencontainers/runc from 1.0.0-rc93 to 1.0.0-rc94\n * Bump github.com/coreos/go-systemd/v22 from 22.3.1 to 22.3.2\n * Add host.serviceIsRemote to podman info results\n * Add client disconnect to build handler loop\n * Remove obsolete skips\n * Fix podman-remote build --rm=false ...\n * fix: improved \"containers/{name}/wait\" endpoint\n * Bump github.com/containers/storage from 1.30.1 to 1.30.2\n * Add envars to the generated systemd unit\n * fix: use UTC Time Stamps in response JSON\n * fix container startup for empty pidfile\n * Kube like pods should share ipc,net,uts by default\n * fix: compat API \"images/get\" for multiple images\n * Revert escaped double dash man page flag syntax\n * Report Download complete in Compatibility mode\n * Add documentation on short-names\n * Bump github.com/docker/docker\n * Adds support to preserve auto update labels in generate and play kube\n * [CI:DOCS] Stop conversion of `--` into en dash\n * Revert Patch to relabel if selinux not enabled\n * fix per review request\n * Add support for environment variable secrets\n * fix pre review request\n * Fix infinite loop in isPathOnVolume\n * Add containers.conf information for changing defaults\n * CI: run rootless tests under ubuntu\n * Fix wrong macvlan PNG in networking doc.\n * Add restart-policy to container filters & --filter to podman start\n * Fixes docker-compose cannot set static ip when use ipam\n * channel: simplify implementation\n * build: improve regex for iidfile\n * Bump github.com/onsi/gomega from 1.11.0 to 1.12.0\n * cgroup: fix rootless --cgroup-parent with pods\n * fix: docker APIv2 `images/get`\n * codespell cleanup\n * Minor podmanimage docs updates.\n * Fix handling of runlabel IMAGE and NAME\n * Bump to v3.2.0-dev\n * Bump to v3.2.0-rc1\n * rootless: improve automatic range split\n * podman: set volatile storage flag for --rm containers\n * Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.2\n * Bump github.com/containers/image/v5 from 5.11.1 to 5.12.0\n * migrate Podman to containers/common/libimage\n * Add filepath glob support to --security-opt unmask\n * Force log_driver to k8s-file for containers in containers\n * add --mac-address to podman play kube\n * compat api: Networks must be empty instead of null\n * System tests: honor $OCI_RUNTIME (for CI)\n * is this a bug?\n * system test image: add arm64v8 image\n * Fix troubleshooting documentation on handling sublemental groups.\n * Add --all to podman start\n * Fix variable reference typo. in multi-arch image action\n * cgroup: always honor --cgroup-parent with cgroupfs\n * Bump github.com/uber/jaeger-client-go\n * Don't require tests for github-actions & metadata\n * Detect if in podman machine virtual vm\n * Fix multi-arch image workflow typo\n * [CI:DOCS] Add titles to remote docs (windows)\n * Remove unused VolumeList* structs\n * Cirrus: Update F34beta -> F34\n * Update container image docs + fix unstable execution\n * Bump github.com/containers/storage from 1.30.0 to 1.30.1\n * TODO complete\n * Docker returns 'die' status rather then 'died' status\n * Check if another VM is running on machine start\n * [CI:DOCS] Improve titles of command HTML pages\n * system tests: networking: fix another race condition\n * Use seccomp_profile as default profile if defined in containers.conf\n * Bump github.com/json-iterator/go from 1.1.10 to 1.1.11\n * Vendored\n * Autoupdate local label functional\n * System tests: fix two race conditions\n * Add more documentation on conmon\n * Allow docker volume create API to pass without name\n * Cirrus: Update Ubuntu images to 21.04\n * Skip blkio-weight test when no kernel BFQ support\n * rootless: Tell the user what was led to the error, not just what it is\n * Add troubleshooting advice about the --userns option.\n * Fix images prune filter until\n * Fix logic for pushing stable multi-arch images\n * Fixes generate kube incorrect when bind-mounting \"/\" and \"/root\"\n * libpod/image: unit tests: don't use system's registries.conf.d\n * runtime: create userns when CAP_SYS_ADMIN is not present\n * rootless: attempt to copy current mappings first\n * [CI:DOCS] Restore missing content to manpages\n * [CI:DOCS] Fix Markdown layout bugs\n * Fix podman ps --filter ancestor to match exact ImageName/ImageID\n * Add machine-enabled to containers.conf for machine\n * Several multi-arch image build/push fixes\n * Add podman run --timeout option\n * Parse slirp4netns net options with compat api\n * Fix rootlesskit port forwarder with custom slirp cidr\n * Fix removal race condition in ListContainers\n * Add github-action workflow to build/push multi-arch\n * rootless: if root is not sub?id raise a debug message\n * Bump github.com/containers/common from 0.36.0 to 0.37.0\n * Add go template shell completion for --format\n * Add --group-add keep-groups: suplimentary groups into container\n * Fixes from make codespell\n * Typo fix to usage text of --compress option\n * corrupt-image test: fix an oops\n * Add --noheading flag to all list commands\n * Bump github.com/containers/storage from 1.29.0 to 1.30.0\n * Bump github.com/containers/image/v5 from 5.11.0 to 5.11.1\n * [CI:DOCS] Fix Markdown table layout bugs\n * podman-remote should show podman.sock info\n * rmi: don't break when the image is missing a manifest\n * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and\n podman-run.1.md\n * Add support for CDI device configuration\n * [CI:DOCS] Add missing dash to verbose option\n * Bump github.com/uber/jaeger-client-go\n * Remove an advanced layer diff function\n * Ensure mount destination is clean, no trailing slash\n * add it for inspect pidfile\n * [CI:DOCS] Fix introduction page typo\n * support pidfile on container restore\n * fix start it\n * skip pidfile test on remote\n * improve document\n * set pidfile default value int containerconfig\n * add pidfile in inspection\n * add pidfile it for container start\n * skip pidfile it on remote\n * Modify according to comments\n * WIP: drop test requirement\n * runtime: bump required conmon version\n * runtime: return findConmon to libpod\n * oci: drop ExecContainerCleanup\n * oci: use `--full-path` option for conmon\n * use AttachSocketPath when removing conmon files\n * hide conmon-pidfile flag on remote mode\n * Fix possible panic in libpod/image/prune.go\n * add --ip to podman play kube\n * add flag autocomplete\n * add ut\n * add flag \"--pidfile\" for podman create/run\n * Add network bindings tests: remove and list\n * Fix build with GO111MODULE=off\n * system tests: build --pull-never: deal with flakes\n * compose test: diagnose flakes v3\n * podman play kube apply correct log driver\n * Fixes podman-remote save to directories does not work\n * Bump github.com/rootless-containers/rootlesskit from 0.14.1 to 0.14.2\n * Update documentation of podman-run to reflect volume \"U\" option\n * Fix flake on failed podman-remote build : try 2\n * compose test: ongoing efforts to diagnose flakes\n * Test that we don't error out on advertised --log-level values\n * At trace log level, print error text using %+v instead of %v\n * pkg/errorhandling.JoinErrors: don't throw away context for lone errors\n * Recognize --log-level=trace\n * Fix flake on failed podman-remote build\n * System tests: fix racy podman-inspect\n * Fixes invalid expression in save command\n * Bump github.com/containers/common from 0.35.4 to 0.36.0\n * Update nix pin with `make nixpkgs`\n * compose test: try to get useful data from flakes\n * Remove in-memory state implementation\n * Fix message about runtime to show only the actual runtime\n * System tests: setup: better cleanup of stray images\n * Bump github.com/containers/ocicrypt from 1.1.0 to 1.1.1\n * Reflect current state of prune implementation in docs\n * Do not delete container twice\n * [CI:DOCS] Correct status code for /pods/create\n * vendor in containers/storage v1.29.0\n * cgroup: do not set cgroup parent when rootless and cgroupfs\n * Overhaul Makefile binary and release worflows\n * Reorganize Makefile with sections and guide\n * Simplify Makefile help target\n * Don't shell to obtain current directory\n * Remove unnecessary/not-needed release.txt target\n * Fix incorrect version number output\n * Exclude .gitignore from test req.\n * Fix handling of $NAME and $IMAGE in runlabel\n * Update podman image Dockerfile to support Podman in container\n * Bump github.com/containers/image/v5 from 5.10.5 to 5.11.0\n * Fix slashes in socket URLs\n * Add network prune filters support to bindings\n * Add support for play/generate kube volumes\n * Update manifest API endpoints\n * Fix panic when not giving a machine name for ssh\n * cgroups: force 64 bits to ParseUint\n * Bump k8s.io/api from 0.20.5 to 0.21.0\n * [CI:DOCS] Fix formatting of podman-build man page\n * buildah-bud tests: simplify\n * Add missing return\n * Bump github.com/onsi/ginkgo from 1.16.0 to 1.16.1\n * speed up CI handling of images\n * Volumes prune endpoint should use only prune filters\n * Cirrus: Use Fedora 34beta images\n * Bump go.sum + Makefile for golang 1.16\n * Exempt Makefile changes from test requirements\n * Adjust libpod API Container Wait documentation to the code\n * [CI:DOCS] Update swagger definition of inspect manifest\n * use updated ubuntu images\n * podman unshare: add --rootless-cni to join the ns\n * Update swagger-check\n * swagger: remove name wildcards\n * Update buildah-bud diffs\n * Handle podman-remote --arch, --platform, --os\n * buildah-bud tests: handle go pseudoversions, plus...\n * Fix flaking rootless compose test\n * rootless cni add /usr/sbin to PATH if not present\n * System tests: special case for RHEL: require runc\n * Add --requires flag to podman run/create\n * [CI:DOCS] swagger-check: compare operations\n * [CI:DOCS] Polish swagger OpertionIDs\n * [NO TESTS NEEDED] Update nix pin with `make nixpkgs`\n * Ensure that `--userns=keep-id` sets user in config\n * [CI:DOCS] Set all operation id to be compatibile\n * Move operationIds to swagger:operation line\n * swagger: add operationIds that match with docker\n * Cirrus: Make use of shared get_ci_vm container\n * Don't relabel volumes if running in a privileged container\n * Allow users to override default storage opts with --storage-opt\n * Add support for podman --context default\n * Verify existence of auth file if specified\n * fix machine naming conventions\n * Initial network bindings tests\n * Update release notes to indicate CVE fix\n * Move socket activation check into init() and set global condition.\n * Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.0\n * Http api tests for network prune with until filter\n * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for\n --userns\n * Fix typos --uidmapping and --gidmapping\n * Add transport and destination info to manifest doc\n * Bump github.com/rootless-containers/rootlesskit from 0.14.0 to 0.14.1\n * Add default template functions\n * Fix missing podman-remote build options\n * Bump github.com/coreos/go-systemd/v22 from 22.3.0 to 22.3.1\n * Add ssh connection to root user\n * Add rootless docker-compose test to the CI\n * Use the slrip4netns dns in the rootless cni ns\n * Cleanup the rootless cni namespace\n * Add new docker-compose test for two networks\n * Make the docker-compose test work rootless\n * Remove unused rootless-cni-infra container files\n * Only use rootless RLK when the container has ports\n * Fix dnsname test\n * Enable rootless network connect/disconnect\n * Move slirp4netns functions into an extra file\n * Fix pod infra container cni network setup\n * Add rootless support for cni and --uidmap\n * rootless cni without infra container\n * Recreate until container prune tests for bindings\n * Remove --execute from podman machine ssh\n * Fixed podman-remote --network flag\n * Makefile: introduce install.docker-full\n * Makefile: ensure install.docker creates BINDIR\n * Fix unmount doc reference in image.rst\n * Should send the OCI runtime path not just the name to buildah\n * podman machine shell completion\n * Fix handling of remove --log-rusage param\n * Fix bindings prune containers flaky test\n * [CI:DOCS] Add local html build info to docs/README.md\n * Add podman machine list\n * Trim white space from /top endpoint results\n * Remove semantic version suffices from API calls\n * podman machine init --ignition-path\n * Document --volume from podman-remote run/create client\n * Update main branch to reflect the release of v3.1.0\n * Silence podman network reload errors with iptables-nft\n * Containers prune endpoint should use only prune filters\n * resolve proper aarch64 image names\n * APIv2 basic test: relax APIVersion check\n * Add machine support for qemu-system-aarch64\n * podman machine init user input\n * manpage xref: helpful diagnostic for unescaped dash-dash\n * Bump to v3.2.0-dev\n * swagger: update system version response body\n * buildah-bud tests: reenable pull-never test\n * [NO TESTS NEEDED] Shrink the size of podman-remote\n * Add powershell completions\n * [NO TESTS NEEDED] Drop Warning to Info, if cgroups not mounted\n * Fix long option format on docs.podman.io\n * system tests: friendier messages for 2-arg is()\n * service: use LISTEN_FDS\n * man pages: correct seccomp-policy label\n * rootless: use is_fd_inherited\n * podman generate systemd --new do not duplicate params\n * play kube: add support for env vars defined from secrets\n * play kube: support optional/mandatory env var from config map\n * play kube: prepare supporting other env source than config maps\n * Add machine support for more Linux distros\n * [NO TESTS NEEDED] Use same function podman-remote rmi as podman\n * Podman machine enhancements\n * Add problematic volume name to kube play error messages\n * Fix podman build --pull-never\n * [NO TESTS NEEDED] Fix for kernel without CONFIG_USER_NS\n * [NO TESTS NEEDED] Turn on podman-remote build --isolation\n * Fix list pods filter handling in libpod api\n * Remove resize race condition\n * [NO TESTS NEEDED] Vendor in containers/buildah v1.20.0\n * Use TMPDIR when commiting images\n * Add RequiresMountsFor= to systemd generate\n * Bump github.com/vbauerster/mpb/v6 from 6.0.2 to 6.0.3\n * Fix swapped dimensions from terminal.GetSize\n * Rename podman machine create to init and clean up\n * Correct json field name\n * system tests: new interactive tests\n * Improvements for machine\n * libpod/image: unit tests: use a `registries.conf` for aliases\n * libpod/image: unit tests: defer cleanup\n * libpod/image: unit tests: use `require.NoError`\n * Add --execute flag to podman machine ssh\n * introduce podman machine\n * Podman machine CLI and interface stub\n * Support multi doc yaml for generate/play kube\n * Fix filters in image http compat/libpod api endpoints\n * Bump github.com/containers/common from 0.35.3 to 0.35.4\n * Bump github.com/containers/storage from 1.28.0 to 1.28.1\n * Check if stdin is a term in --interactive --tty mode\n * [NO TESTS NEEDED] Remove /tmp/containers-users-* files on reboot\n * [NO TESTS NEEDED] Fix rootless volume plugins\n * Ensure manually-created volumes have correct ownership\n * Bump github.com/rootless-containers/rootlesskit\n * Unification of until filter across list/prune endpoints\n * Unification of label filter across list/prune endpoints\n * fixup\n * fix: build endpoint for compat API\n * [CI:DOCS] Add note to mappings for user/group userns in build\n * Bump k8s.io/api from 0.20.1 to 0.20.5\n * Validate passed in timezone from tz option\n * WIP: run buildah bud tests using podman\n * Fix containers list/prune http api filter behaviour\n * Generate Kubernetes PersistentVolumeClaims from named volumes\n\n - Update to version 3.1.2:\n * Bump to v3.1.2\n * Update release notes for v3.1.2\n * Ensure mount destination is clean, no trailing slash\n * Fixes podman-remote save to directories does not work\n * [CI:DOCS] Add missing dash to verbose option\n * [CI:DOCS] Fix Markdown table layout bugs\n * [CI:DOCS] Rewrite --uidmap doc in podman-create.1.md and\n podman-run.1.md\n * rmi: don't break when the image is missing a manifest\n * Bump containers/image to v5.11.1\n * Bump github.com/coreos/go-systemd from 22.2.0 to 22.3.1\n * Fix lint\n * Bump to v3.1.2-dev\n - Split podman-remote into a subpackage\n - Add missing scriptlets for systemd units\n - Escape macros in comments\n - Drop some obsolete workarounds, including %{go_nostrip}\n\n - Update to version 3.1.1:\n * Bump to v3.1.1\n * Update release notes for v3.1.1\n * podman play kube apply correct log driver\n * Fix build with GO111MODULE=off\n * [CI:DOCS] Set all operation id to be compatibile\n * Move operationIds to swagger:operation line\n * swagger: add operationIds that match with docker\n * Fix missing podman-remote build options\n * [NO TESTS NEEDED] Shrink the size of podman-remote\n * Move socket activation check into init() and set global condition.\n * rootless: use is_fd_inherited\n * Recreate until container prune tests for bindings\n * System tests: special case for RHEL: require runc\n * Document --volume from podman-remote run/create client\n * Containers prune endpoint should use only prune filters\n * Trim white space from /top endpoint results\n * Fix unmount doc reference in image.rst\n * Fix handling of remove --log-rusage param\n * Makefile: introduce install.docker-full\n * Makefile: ensure install.docker creates BINDIR\n * Should send the OCI runtime path not just the name to buildah\n * Fixed podman-remote --network flag\n * podman-run.1.md, podman-create.1.md : Adjust Markdown layout for\n --userns\n * Fix typos --uidmapping and --gidmapping\n * Add default template functions\n * Don't relabel volumes if running in a privileged container\n * Allow users to override default storage opts with --storage-opt\n * Add transport and destination info to manifest doc\n * Verify existence of auth file if specified\n * Ensure that `--userns=keep-id` sets user in config\n * [CI:DOCS] Update swagger definition of inspect manifest\n * Volumes prune endpoint should use only prune filters\n * Adjust libpod API Container Wait documentation to the code\n * Add missing return\n * [CI:DOCS] Fix formatting of podman-build man page\n * cgroups: force 64 bits to ParseUint\n * Fix slashes in socket URLs\n * [CI:DOCS] Correct status code for /pods/create\n * cgroup: do not set cgroup parent when rootless and cgroupfs\n * Reflect current state of prune implementation in docs\n * Do not delete container twice\n * Test that we don't error out on advertised --log-level values\n * At trace log level, print error text using %+v instead of %v\n * pkg/errorhandling.JoinErrors: don't throw away context for lone errors\n * Recognize --log-level=trace\n * Fix message about runtime to show only the actual runtime\n * Fix handling of $NAME and $IMAGE in runlabel\n * Fix flake on failed podman-remote build : try 2\n * Fix flake on failed podman-remote build\n * Update documentation of podman-run to reflect volume \"U\" option\n * Fixes invalid expression in save command\n * Fix possible panic in libpod/image/prune.go\n * Update all containers/ project vendors\n * Fix tests\n * Bump to v3.1.1-dev\n\n - Update to version 3.1.0:\n * Bump to v3.1.0\n * Fix test failure\n * Update release notes for v3.1.0 final release\n * [NO TESTS NEEDED] Turn on podman-remote build --isolation\n * Fix long option format on docs.podman.io\n * Fix containers list/prune http api filter behaviour\n * [CI:DOCS] Add note to mappings for user/group userns in build\n * Validate passed in timezone from tz option\n * Generate Kubernetes PersistentVolumeClaims from named volumes\n * libpod/image: unit tests: use a `registries.conf` for aliases\n - Require systemd 241 or newer due to podman dependency go-systemd v22,\n otherwise build will fail with unknown C name errors\n\n - Create docker subpackage to allow replacing docker with corresponding\n aliases to podman.\n\n - Update to v3.0.1\n * Changes\n - Several frequently-occurring WARN level log messages have been\n downgraded to INFO or DEBUG to not clutter terminal output. Bugfixes\n - Fixed a bug where the Created field of podman ps --format=json was\n formatted as a string instead of an Unix timestamp (integer) (#9315).\n - Fixed a bug where failing lookups of individual layers during the\n podman images command would cause the whole command to fail without\n printing output.\n - Fixed a bug where --cgroups=split did not function properly on\n cgroups v1 systems.\n - Fixed a bug where mounting a volume over an directory in the\n container that existed, but was empty, could fail (#9393).\n - Fixed a bug where mounting a volume over a directory in the\n container that existed could copy the entirety of the container's\n rootfs, instead of just the directory mounted over, into the volume\n (#9415).\n - Fixed a bug where Podman would treat the --entrypoint=[\"\"] option to\n podman run and podman create as a literal empty string in the\n entrypoint, when instead it should have been ignored (#9377).\n - Fixed a bug where Podman would set the HOME environment variable to\n \"\" when the container ran as a user without an assigned home\n directory (#9378).\n - Fixed a bug where specifying a pod infra image that had no tags (by\n using its ID) would cause podman pod create to panic (#9374).\n - Fixed a bug where the --runtime option was not properly handled by\n the podman build command (#9365).\n - Fixed a bug where Podman would incorrectly print an error message\n related to the remote API when the remote API was not in use and\n starting Podman failed.\n - Fixed a bug where Podman would change ownership of a container's\n working directory, even if it already existed (#9387).\n - Fixed a bug where the podman generate systemd --new command would\n incorrectly escape %t when generating the path for the PID file\n (#9373).\n - Fixed a bug where Podman could, when run inside a Podman container\n with the host's containers/storage directory mounted into the\n container, erroneously detect a reboot and reset container state if\n the temporary directory was not also mounted in (#9191).\n - Fixed a bug where some options of the podman build command\n (including but not limited to --jobs) were nonfunctional (#9247).\n * API\n - Fixed a breaking change to the Libpod Wait API for Containers where\n the Conditions parameter changed type in Podman v3.0 (#9351).\n - Fixed a bug where the Compat Create endpoint for Containers did not\n properly handle forwarded ports that did not specify a host port.\n - Fixed a bug where the Libpod Wait endpoint for Containers could\n write duplicate headers after an error occurred.\n - Fixed a bug where the Compat Create endpoint for Images would not\n pull images that already had a matching tag present locally, even if\n a more recent version was available at the registry (#9232).\n - The Compat Create endpoint for Images has had its compatibility with\n Docker improved, allowing its use with the docker-java library.\n * Misc\n - Updated Buildah to v1.19.4\n - Updated the containers/storage library to v1.24.6\n - Changes from v3.0.0\n * Features\n - Podman now features initial support for Docker Compose.\n - Added the podman rename command, which allows containers to be\n renamed after they are created (#1925).\n - The Podman remote client now supports the podman copy command.\n - A new command, podman network reload, has been added. This command\n will re-configure the network of all running containers, and can be\n used to recreate firewall rules lost when the system firewall was\n reloaded (e.g. via firewall-cmd --reload).\n - Podman networks now have IDs. They can be seen in podman network ls\n and can be used when removing and inspecting networks. Existing\n networks receive IDs automatically.\n - Podman networks now also support labels. They can be added via the\n --label option to network create, and podman network ls can filter\n labels based on them.\n - The podman network create command now supports setting bridge MTU\n and VLAN through the --opt option (#8454).\n - The podman container checkpoint and podman container restore\n commands can now checkpoint and restore containers that include\n volumes.\n - The podman container checkpoint command now supports the\n --with-previous and --pre-checkpoint options, and the podman\n container restore command now support the --import-previous option.\n These add support for two-step checkpointing with lowered dump times.\n - The podman push command can now push manifest lists. Podman will\n first attempt to push as an image, then fall back to pushing as a\n manifest list if that fails.\n - The podman generate kube command can now be run on multiple\n containers at once, and will generate a single pod containing all of\n them.\n - The podman generate kube and podman play kube commands now support\n Kubernetes DNS configuration, and will preserve custom DNS\n configuration when exporting or importing YAML (#9132).\n - The podman generate kube command now properly supports generating\n YAML for containers and pods creating using host networking\n (--net=host) (#9077).\n - The podman kill command now supports a --cidfile option to kill\n containers given a file containing the container's ID (#8443).\n - The podman pod create command now supports the --net=none option\n (#9165).\n - The podman volume create command can now specify volume UID and GID\n as options with the UID and GID fields passed to the the --opt\n option.\n - Initial support has been added for Docker Volume Plugins. Podman can\n now define available plugins in containers.conf and use them to\n create volumes with podman volume create --driver.\n - The podman run and podman create commands now support a new option,\n --platform, to specify the platform of the image to be used when\n creating the container.\n - The --security-opt option to podman run and podman create now\n supports the systempaths=unconfined option to unrestrict access to\n all paths in the container, as well as mask and unmask options to\n allow more granular restriction of container paths.\n - The podman stats --format command now supports a new format\n specified, MemUsageBytes, which prints the raw bytes of memory\n consumed by a container without human-readable formatting #8945.\n - The podman ps command can now filter containers based on what pod\n they are joined to via the pod filter (#8512).\n - The podman pod ps command can now filter pods based on what networks\n they are joined to via the network filter. The podman pod ps command\n can now print information on what networks a pod is joined to via\n the .Networks specifier to the --format option.\n - The podman system prune command now supports filtering what\n containers, pods, images, and volumes will be pruned.\n - The podman volume prune commands now supports filtering what volumes\n will be pruned.\n - The podman system prune command now includes information on space\n reclaimed (#8658).\n - The podman info command will now properly print information about\n packages in use on Gentoo and Arch systems.\n - The containers.conf file now contains an option for disabling\n creation of a new kernel keyring on container creation (#8384).\n - The podman image sign command can now sign multi-arch images by\n producing a signature for each image in a given manifest list.\n - The podman image sign command, when run as rootless, now supports\n per-user registry configuration files in\n $HOME/.config/containers/registries.d.\n - Configuration options for slirp4netns can now be set system-wide via\n the NetworkCmdOptions configuration option in containers.conf.\n - The MTU of slirp4netns can now be configured via the mtu= network\n command option (e.g. podman run --net slirp4netns:mtu=9000).\n * Security\n - A fix for CVE-2021-20199 is included. Podman between v1.8.0 and\n v2.2.1 used 127.0.0.1 as the source address for all traffic\n forwarded into rootless containers by a forwarded port; this has\n been changed to address the issue.\n * Changes\n - Shortname aliasing support has now been turned on by default. All\n Podman commands that must pull an image will, if a TTY is available,\n prompt the user about what image to pull.\n - The podman load command no longer accepts a NAME[:TAG] argument. The\n presence of this argument broke CLI compatibility with Docker by\n making docker load commands unusable with Podman (#7387).\n - The Go bindings for the HTTP API have been rewritten with a focus on\n limiting dependency footprint and improving extensibility. Read more\n here.\n - The legacy Varlink API has been completely removed from Podman.\n - The default log level for Podman has been changed from Error to Warn.\n - The podman network create command can now create macvlan networks\n using the --driver macvlan option for Docker compatibility. The\n existing --macvlan flag has been deprecated and will be removed in\n Podman 4.0 some time next year.\n - The podman inspect command has had the LogPath and LogTag fields\n moved into the LogConfig structure (from the root of the Inspect\n structure). The maximum size of the log file is also included.\n - The podman generate systemd command no longer generates unit files\n using the deprecated KillMode=none option (#8615).\n - The podman stop command now releases the container lock while\n waiting for it to stop - as such, commands like podman ps will no\n longer block until podman stop completes (#8501).\n - Networks created with podman network create --internal no longer use\n the dnsname plugin. This configuration never functioned as expected.\n - Error messages for the remote Podman client have been improved when\n it cannot connect to a Podman service.\n - Error messages for podman run when an invalid SELinux is specified\n have been improved.\n - Rootless Podman features improved support for containers with a\n single user mapped into the rootless user namespace.\n - Pod infra containers now respect default sysctls specified in\n containers.conf allowing for advanced configuration of the\n namespaces they will share.\n - SSH public key handling for remote Podman has been improved.\n * Bugfixes\n - Fixed a bug where the podman history --no-trunc command would\n truncate the Created By field (#9120).\n - Fixed a bug where root containers that did not explicitly specify a\n CNI network to join did not generate an entry for the network in use\n in the Networks field of the output of podman inspect (#6618).\n - Fixed a bug where, under some circumstances, container working\n directories specified by the image (via the WORKDIR instruction) but\n not present in the image, would not be created (#9040).\n - Fixed a bug where the podman generate systemd command would generate\n invalid unit files if the container was creating using a command\n line that included doubled braces ({{ and }}), e.g.\n --log-opt-tag={{.Name}} (#9034).\n - Fixed a bug where the podman generate systemd --new command could\n generate unit files including invalid Podman commands if the\n container was created using merged short options (e.g. podman run\n -dt) (#8847).\n - Fixed a bug where the podman generate systemd --new command could\n generate unit files that did not handle Podman commands including\n some special characters (e.g. $) (#9176\n - Fixed a bug where rootless containers joining CNI networks could not\n set a static IP address (#7842).\n - Fixed a bug where rootless containers joining CNI networks could not\n set network aliases (#8567).\n - Fixed a bug where the remote client could, under some circumstances,\n not include the Containerfile when sending build context to the\n server (#8374).\n - Fixed a bug where rootless Podman did not mount /sys as a new sysfs\n in some circumstances where it was acceptable.\n - Fixed a bug where rootless containers that both joined a user\n namespace and a CNI networks would cause a segfault. These options\n are incompatible and now return an error.\n - Fixed a bug where the podman play kube command did not properly\n handle CMD and ARGS from images (#8803).\n - Fixed a bug where the podman play kube command did not properly\n handle environment variables from images (#8608).\n - Fixed a bug where the podman play kube command did not properly\n print errors that occurred when starting containers.\n - Fixed a bug where the podman play kube command errored when\n hostNetwork was used (#8790).\n - Fixed a bug where the podman play kube command would always pull\n images when the :latest tag was specified, even if the image was\n available locally (#7838).\n - Fixed a bug where the podman play kube command did not properly\n handle SELinux configuration, rending YAML with custom SELinux\n configuration unusable (#8710).\n - Fixed a bug where the podman generate kube command incorrectly\n populated the args and command fields of generated YAML (#9211).\n - Fixed a bug where containers in a pod would create a duplicate entry\n in the pod's shared /etc/hosts file every time the container\n restarted (#8921).\n - Fixed a bug where the podman search --list-tags command did not\n support the --format option (#8740).\n - Fixed a bug where the http_proxy option in containers.conf was not\n being respected, and instead was set unconditionally to true (#8843).\n - Fixed a bug where rootless Podman could, on systems with a recent\n Conmon and users with a long username, fail to attach to containers\n (#8798).\n - Fixed a bug where the podman images command would break and fail to\n display any images if an empty manifest list was present in storage\n (#8931).\n - Fixed a bug where locale environment variables were not properly\n passed on to Conmon.\n - Fixed a bug where Podman would not build on the MIPS architecture\n (#8782).\n - Fixed a bug where rootless Podman could fail to properly configure\n user namespaces for rootless containers when the user specified a\n --uidmap option that included a mapping beginning with UID 0.\n - Fixed a bug where the podman logs command using the k8s-file backend\n did not properly handle partial log lines with a length of 1 (#8879).\n - Fixed a bug where the podman logs command with the --follow option\n did not properly handle log rotation (#8733).\n - Fixed a bug where user-specified HOSTNAME environment variables were\n overwritten by Podman (#8886).\n - Fixed a bug where Podman would applied default sysctls from\n containers.conf in too many situations (e.g. applying network\n sysctls when the container shared its network with a pod).\n - Fixed a bug where Podman did not properly handle cases where a\n secondary image store was in use and an image was present in both\n the secondary and primary stores (#8176).\n - Fixed a bug where systemd-managed rootless Podman containers where\n the user in the container was not root could fail as the container's\n PID file was not accessible to systemd on the host (#8506).\n - Fixed a bug where the --privileged option to podman run and podman\n create would, under some circumstances, not disable Seccomp (#8849).\n - Fixed a bug where the podman exec command did not properly add\n capabilities when the container or exec session were run with\n --privileged.\n - Fixed a bug where rootless Podman would use the --enable-sandbox\n option to slirp4netns unconditionally, even when pivot_root was\n disabled, rendering slirp4netns unusable when pivot_root was\n disabled (#8846).\n - Fixed a bug where podman build --logfile did not actually write the\n build's log to the logfile.\n - Fixed a bug where the podman system service command did not close\n STDIN, and could display user-interactive prompts (#8700).\n - Fixed a bug where the podman system reset command could, under some\n circumstances, remove all the contents of the XDG_RUNTIME_DIR\n directory (#8680).\n - Fixed a bug where the podman network create command created CNI\n configurations that did not include a default gateway (#8748).\n - Fixed a bug where the podman.service systemd unit provided by\n default used the wrong service type, and would cause systemd to not\n correctly register the service as started (#8751).\n - Fixed a bug where, if the TMPDIR environment variable was set for\n the container engine in containers.conf, it was being ignored.\n - Fixed a bug where the podman events command did not properly handle\n future times given to the --until option (#8694).\n - Fixed a bug where the podman logs command wrote container STDERR\n logs to STDOUT instead of STDERR (#8683).\n - Fixed a bug where containers created from an image with multiple\n tags would report that they were created from the wrong tag (#8547).\n - Fixed a bug where container capabilities were not set properly when\n the --cap-add=all and --user options to podman create and podman run\n were combined.\n - Fixed a bug where the --layers option to podman build was\n nonfunctional (#8643).\n - Fixed a bug where the podman system prune command did not act\n recursively, and thus would leave images, containers, pods, and\n volumes present that would be removed by a subsequent call to podman\n system prune (#7990).\n - Fixed a bug where the --publish option to podman run and podman\n create did not properly handle ports specified as a range of ports\n with no host port specified (#8650).\n - Fixed a bug where --format did not support JSON output for\n individual fields (#8444).\n - Fixed a bug where the podman stats command would fail when run on\n root containers using the slirp4netns network mode (#7883).\n - Fixed a bug where the Podman remote client would ask for a password\n even if the server's SSH daemon did not support password\n authentication (#8498).\n - Fixed a bug where the podman stats command would fail if the system\n did not support one or more of the cgroup controllers Podman\n supports (#8588).\n - Fixed a bug where the --mount option to podman create and podman run\n did not ignore the consistency mount option.\n - Fixed a bug where failures during the resizing of a container's TTY\n would print the wrong error.\n - Fixed a bug where the podman network disconnect command could cause\n the podman inspect command to fail for a container until it was\n restarted (#9234).\n - Fixed a bug where containers created from a read-only rootfs (using\n the --rootfs option to podman create and podman run) would fail\n (#9230).\n - Fixed a bug where specifying Go templates to the --format option to\n multiple Podman commands did not support the join function (#8773).\n - Fixed a bug where the podman rmi command could, when run in parallel\n on multiple images, return layer not known errors (#6510).\n - Fixed a bug where the podman inspect command on containers displayed\n unlimited ulimits incorrectly (#9303).\n - Fixed a bug where Podman would fail to start when a volume was\n mounted over a directory in a container that contained symlinks that\n terminated outside the directory and its subdirectories (#6003). API\n - Libpod API version has been bumped to v3.0.0.\n - All Libpod Pod APIs have been modified to properly report errors\n with individual containers. Cases where the operation as a whole\n succeeded but individual containers failed now report an HTTP 409\n error (#8865).\n - The Compat API for Containers now supports the Rename and Copy APIs.\n - Fixed a bug where the Compat Prune APIs (for volumes, containers,\n and images) did not return the amount of space reclaimed in their\n responses.\n - Fixed a bug where the Compat and Libpod Exec APIs for Containers\n would drop errors that occurred prior to the exec session\n successfully starting (e.g. a \"no such file\" error if an invalid\n executable was passed) (#8281)\n - Fixed a bug where the Volumes field in the Compat Create API for\n Containers was being ignored (#8649).\n - Fixed a bug where the NetworkMode field in the Compat Create API for\n Containers was not handling some values, e.g. container:, correctly.\n - Fixed a bug where the Compat Create API for Containers did not set\n container name properly.\n - Fixed a bug where containers created using the Compat Create API\n unconditionally used Kubernetes file logging (the default specified\n in containers.conf is now used).\n - Fixed a bug where the Compat Inspect API for Containers could\n include container states not recognized by Docker.\n - Fixed a bug where Podman did not properly clean up after calls to\n the Events API when the journald backend was in use, resulting in a\n leak of file descriptors (#8864).\n - Fixed a bug where the Libpod Pull endpoint for Images could fail\n with an index out of range error under certain circumstances (#8870).\n - Fixed a bug where the Libpod Exists endpoint for Images could panic.\n - Fixed a bug where the Compat List API for Containers did not support\n all filters (#8860).\n - Fixed a bug where the Compat List API for Containers did not\n properly populate the Status field.\n - Fixed a bug where the Compat and Libpod Resize APIs for Containers\n ignored the height and width parameters (#7102).\n - Fixed a bug where the Compat Search API for Images returned an\n incorrectly-formatted JSON response (#8758).\n - Fixed a bug where the Compat Load API for Images did not properly\n clean up temporary files.\n - Fixed a bug where the Compat Create API for Networks could panic\n when an empty IPAM configuration was specified.\n - Fixed a bug where the Compat Inspect and List APIs for Networks did\n not include Scope.\n - Fixed a bug where the Compat Wait endpoint for Containers did not\n support the same wait conditions that Docker did.\n * Misc\n - Updated Buildah to v1.19.2\n - Updated the containers/storage library to v1.24.5\n - Updated the containers/image library to v5.10.2\n - Updated the containers/common library to v0.33.4\n\n - Update to v2.2.1\n * Changes\n - Due to a conflict with a previously-removed field, we were forced to\n modify the way image volumes (mounting images into containers using\n --mount type=image) were handled in the database. As a result,\n containers created in Podman 2.2.0 with image volume will not have them in\n v2.2.1, and these containers will need to be re-created.\n * Bugfixes\n - Fixed a bug where rootless Podman would, on systems without the\n XDG_RUNTIME_DIR environment variable defined, use an incorrect path\n for the PID file of the Podman pause process, causing Podman to fail\n to start (#8539).\n - Fixed a bug where containers created using Podman v1.7 and earlier\n were unusable in Podman due to JSON decode errors (#8613).\n - Fixed a bug where Podman could retrieve invalid cgroup paths, instead\n of erroring, for containers that were not running.\n - Fixed a bug where the podman system reset command would print a\n warning about a duplicate shutdown handler being registered.\n - Fixed a bug where rootless Podman would attempt to mount sysfs in\n circumstances where it was not allowed; some OCI runtimes (notably\n crun) would fall back to alternatives and not fail, but others\n (notably runc) would fail to run containers.\n - Fixed a bug where the podman run and podman create commands would\n fail to create containers from untagged images (#8558).\n - Fixed a bug where remote Podman would prompt for a password even\n when the server did not support password authentication (#8498).\n - Fixed a bug where the podman exec command did not move the Conmon\n process for the exec session into the correct cgroup.\n - Fixed a bug where shell completion for the ancestor option to podman\n ps --filter did not work correctly.\n - Fixed a bug where detached containers would not properly clean\n themselves up (or remove themselves if --rm was set) if the Podman\n command that created them was invoked with --log-level=debug.\n * API\n - Fixed a bug where the Compat Create endpoint for Containers did not\n properly handle the Binds and Mounts parameters in HostConfig.\n - Fixed a bug where the Compat Create endpoint for Containers ignored\n the Name query parameter.\n - Fixed a bug where the Compat Create endpoint for Containers did not\n properly handle the \"default\" value for NetworkMode (this value is\n used extensively by docker-compose) (#8544).\n - Fixed a bug where the Compat Build endpoint for Images would\n sometimes incorrectly use the target query parameter as the image's\n tag.\n * Misc\n - Podman v2.2.0 vendored a non-released, custom version of the\n github.com/spf13/cobra package; this has been reverted to the latest\n upstream release to aid in packaging.\n - Updated the containers/image library to v5.9.0\n\n - Update to v2.2.0\n * Features\n - Experimental support for shortname aliasing has been added. This is\n not enabled by default, but can be turned on by setting the\n environment variable CONTAINERS_SHORT_NAME_ALIASING to on.\n Documentation is available here and here.\n - Initial support has been added for the podman network connect and\n podman network disconnect commands, which allow existing containers to\n modify what networks they are connected to. At present, these commands\n can only be used on running containers that did not specify\n --network=none when they were created.\n - The podman run command now supports the --network-alias option to set\n network aliases (additional names the container can be accessed at\n from other containers via DNS if the dnsname CNI plugin is in use).\n Aliases can also be added and removed using the new podman network\n connect and podman network disconnect commands. Please note that this\n requires a new release (v1.1.0) of the dnsname plugin, and will only\n work on newly-created CNI networks.\n - The podman generate kube command now features support for exporting\n container's memory and CPU limits (#7855).\n - The podman play kube command now features support for setting CPU and\n Memory limits for containers (#7742).\n - The podman play kube command now supports persistent volumes claims\n using Podman named volumes.\n - The podman play kube command now supports Kubernetes configmaps via\n the --configmap option (#7567).\n - The podman play kube command now supports a --log-driver option to set\n the log driver for created containers.\n - The podman play kube command now supports a --start option, enabled by\n default, to start the pod after creating it. This allows for podman\n play kube to be more easily used in systemd unitfiles.\n - The podman network create command now supports the --ipv6 option to\n enable dual-stack IPv6 networking for created networks (#7302).\n - The podman inspect command can now inspect pods, networks, and\n volumes, in addition to containers and images (#6757).\n - The --mount option for podman run and podman create now supports a new\n type, image, to mount the contents of an image into the container at a\n given location.\n - The Bash and ZSH completions have been completely reworked and have\n received significant enhancements! Additionally, support for Fish\n completions and completions for the podman-remote executable have been\n added.\n - The --log-opt option for podman create and podman run now supports the\n max-size option to set the maximum size for a container's logs (#7434).\n - The --network option to the podman pod create command now allows pods\n to be configured to use slirp4netns networking, even when run as root\n (#6097).\n - The podman pod stop, podman pod pause, podman pod unpause, and podman\n pod kill commands now work on multiple containers in parallel and\n should be significantly faster.\n - The podman search command now supports a --list-tags option to list\n all available tags for a single image in a single repository.\n - The podman search command can now output JSON using the --format=json\n option.\n - The podman diff and podman mount commands now work with all containers\n in the storage library, including those not created by Podman. This\n allows them to be used with Buildah and CRI-O containers.\n - The podman container exists command now features a --external option\n to check if a container exists not just in Podman, but also in the\n storage library. This will allow Podman to identify Buildah and CRI-O\n containers.\n - The --tls-verify and --authfile options have been enabled for use with\n remote Podman.\n - The /etc/hosts file now includes the container's name and hostname\n (both pointing to localhost) when the container is run with --net=none\n (#8095).\n - The podman events command now supports filtering events based on the\n labels of the container they occurred on using the --filter\n label=key=value option.\n - The podman volume ls command now supports filtering volumes based on\n their labels using the --filter label=key=value option.\n - The --volume and --mount options to podman run and podman create now\n support two new mount propagation options, unbindable and runbindable.\n - The name and id filters for podman pod ps now match based on a regular\n expression, instead of requiring an exact match.\n - The podman pod ps command now supports a new filter status, that\n matches pods in a certain state.\n * Changes\n - The podman network rm --force command will now also remove pods that\n are using the network (#7791).\n - The podman volume rm, podman network rm, and podman pod rm commands\n now return exit code 1 if the object specified for removal does not\n exist, and exit code 2 if the object is in use and the --force option\n was not given.\n - If /dev/fuse is passed into Podman containers as a device, Podman will\n open it before starting the container to ensure that the kernel module\n is loaded on the host and the device is usable in the container.\n - Global Podman options that were not supported with remote operation\n have been removed from podman-remote (e.g. --cgroup-manager,\n --storage-driver).\n - Many errors have been changed to remove repetition and be more clear\n as to what has gone wrong.\n - The --storage option to podman rm is now enabled by default, with\n slightly changed semantics. If the given container does not exist in\n Podman but does exist in the storage library, it will be removed even\n without the --storage option. If the container exists in Podman it\n will be removed normally. The --storage option for podman rm is now\n deprecated and will be removed in a future release.\n - The --storage option to podman ps has been renamed to --external. An\n alias has been added so the old form of the option will continue to\n work.\n - Podman now delays the SIGTERM and SIGINT signals during container\n creation to ensure that Podman is not stopped midway through creating\n a container resulting in potential resource leakage (#7941).\n - The podman save command now strips signatures from images it is\n exporting, as the formats we export to do not support signatures\n (#7659).\n - A new Degraded state has been added to pods. Pods that have some, but\n not all, of their containers running are now considered to be Degraded\n instead of Running.\n - Podman will now print a warning when conflicting network options\n related to port forwarding (e.g. --publish and --net=host) are\n specified when creating a container.\n - The --restart on-failure and --rm options for containers no longer\n conflict. When both are specified, the container will be restarted if\n it exits with a non-zero error code, and removed if it exits cleanly\n (#7906).\n - Remote Podman will no longer use settings from the client's\n containers.conf; defaults will instead be provided by the server's\n containers.conf (#7657).\n - The podman network rm command now has a new alias, podman network\n remove (#8402).\n * Bugfixes\n - Fixed a bug where podman load on the remote client did not error when\n attempting to load a directory, which is not yet supported for remote\n use.\n - Fixed a bug where rootless Podman could hang when the newuidmap binary\n was not installed (#7776).\n - Fixed a bug where the --pull option to podman run, podman create, and\n podman build did not match Docker's behavior.\n - Fixed a bug where sysctl settings from the containers.conf\n configuration file were applied, even if the container did not join\n the namespace associated with a sysctl.\n - Fixed a bug where Podman would not return the text of errors encounted\n when trying to run a healthcheck for a container.\n - Fixed a bug where Podman was accidentally setting the containers\n environment variable in addition to the expected container environment\n variable.\n - Fixed a bug where rootless Podman using CNI networking did not\n properly clean up DNS entries for removed containers (#7789).\n - Fixed a bug where the podman untag --all command was not supported\n with remote Podman.\n - Fixed a bug where the podman system service command could time out\n even if active attach connections were present (#7826).\n - Fixed a bug where the podman system service command would sometimes\n never time out despite no active connections being present.\n - Fixed a bug where Podman's handling of capabilities, specifically\n inheritable, did not match Docker's.\n - Fixed a bug where podman run would fail if the image specified was a\n manifest list and had already been pulled (#7798).\n - Fixed a bug where Podman did not take search registries into account\n when looking up images locally (#6381).\n - Fixed a bug where the podman manifest inspect command would fail for\n images that had already been pulled (#7726).\n - Fixed a bug where rootless Podman would not add supplemental GIDs to\n containers when when a user, but not a group, was set via the --user\n option to podman create and podman run and sufficient GIDs were\n available to add the groups (#7782).\n - Fixed a bug where remote Podman commands did not properly handle cases\n where the user gave a name that could also be a short ID for a pod or\n container (#7837).\n - Fixed a bug where podman image prune could leave images ready to be\n pruned after podman image prune was run (#7872).\n - Fixed a bug where the podman logs command with the journald log driver\n would not read all available logs (#7476).\n - Fixed a bug where the --rm and --restart options to podman create and\n podman run did not conflict when a restart policy that is not\n on-failure was chosen (#7878).\n - Fixed a bug where the --format \"table {{ .Field }}\" option to numerous\n Podman commands ceased to function on Podman v2.0 and up.\n - Fixed a bug where pods did not properly share an SELinux label between\n their containers, resulting in containers being unable to see the\n processes of other containers when the pod shared a PID namespace\n (#7886).\n - Fixed a bug where the --namespace option to podman ps did not work\n with the remote client (#7903).\n - Fixed a bug where rootless Podman incorrectly calculated the number of\n UIDs available in the container if multiple different ranges of UIDs\n were specified.\n - Fixed a bug where the /etc/hosts file would not be correctly populated\n for containers in a user namespace (#7490).\n - Fixed a bug where the podman network create and podman network remove\n commands could race when run in parallel, with unpredictable results\n (#7807).\n - Fixed a bug where the -p option to podman run, podman create, and\n podman pod create would, when given only a single number (e.g. -p 80),\n assign the same port for both host and container, instead of\n generating a random host port (#7947).\n - Fixed a bug where Podman containers did not properly store the cgroup\n manager they were created with, causing them to stop functioning after\n the cgroup manager was changed in containers.conf or with the\n --cgroup-manager option (#7830).\n - Fixed a bug where the podman inspect command did not include\n information on the CNI networks a container was connected to if it was\n not running.\n - Fixed a bug where the podman attach command would not print a newline\n after detaching from the container (#7751).\n - Fixed a bug where the HOME environment variable was not set properly\n in containers when the --userns=keep-id option was set (#8004).\n - Fixed a bug where the podman container restore command could panic\n when the container in question was in a pod (#8026).\n - Fixed a bug where the output of the podman image trust show --raw\n command was not properly formatted.\n - Fixed a bug where the podman runlabel command could panic if a label\n to run was not given (#8038).\n - Fixed a bug where the podman run and podman start --attach commands\n would exit with an error when the user detached manually using the\n detach keys on remote Podman (#7979).\n - Fixed a bug where rootless CNI networking did not use the dnsname CNI\n plugin if it was not available on the host, despite it always being\n available in the container used for rootless networking (#8040).\n - Fixed a bug where Podman did not properly handle cases where an OCI\n runtime is specified by its full path, and could revert to using\n another OCI runtime with the same binary path that existed in the\n system $PATH on subsequent invocations.\n - Fixed a bug where the --net=host option to podman create and podman\n run would cause the /etc/hosts file to be incorrectly populated\n (#8054).\n - Fixed a bug where the podman inspect command did not include container\n network information when the container shared its network namespace\n (IE, joined a pod or another container's network namespace via\n --net=container:...) (#8073).\n - Fixed a bug where the podman ps command did not include information on\n all ports a container was publishing.\n - Fixed a bug where the podman build command incorrectly forwarded STDIN\n into build containers from RUN instructions.\n - Fixed a bug where the podman wait command's --interval option did not\n work when units were not specified for the duration (#8088).\n - Fixed a bug where the --detach-keys and --detach options could be\n passed to podman create despite having no effect (and not making sense\n in that context).\n - Fixed a bug where Podman could not start containers if running on a\n system without a /etc/resolv.conf file (which occurs on some WSL2\n images) (#8089).\n - Fixed a bug where the --extract option to podman cp was nonfunctional.\n - Fixed a bug where the --cidfile option to podman run would, when the\n container was not run with --detach, only create the file after the\n container exited (#8091).\n - Fixed a bug where the podman images and podman images -a commands\n could panic and not list any images when certain improperly-formatted\n images were present in storage (#8148).\n - Fixed a bug where the podman events command could, when the journald\n events backend was in use, become nonfunctional when a badly-formatted\n event or a log message that container certain string was present in\n the journal (#8125).\n - Fixed a bug where remote Podman would, when using SSH transport, not\n authenticate to the server using hostkeys when connecting on a port\n other than 22 (#8139).\n - Fixed a bug where the podman attach command would not exit when\n containers stopped (#8154).\n - Fixed a bug where Podman did not properly clean paths before verifying\n them, resulting in Podman refusing to start if the root or temporary\n directories were specified with extra trailing / characters (#8160).\n - Fixed a bug where remote Podman did not support hashed hostnames in\n the known_hosts file on the host for establishing connections (#8159).\n - Fixed a bug where the podman image exists command would return\n non-zero (false) when multiple potential matches for the given name\n existed.\n - Fixed a bug where the podman manifest inspect command on images that\n are not manifest lists would error instead of inspecting the image\n (#8023).\n - Fixed a bug where the podman system service command would fail if the\n directory the Unix socket was to be created inside did not exist\n (#8184).\n - Fixed a bug where pods that shared the IPC namespace (which is done by\n default) did not share a /dev/shm filesystem between all containers in\n the pod (#8181).\n - Fixed a bug where filters passed to podman volume list were not\n inclusive (#6765).\n - Fixed a bug where the podman volume create command would fail when the\n volume's data directory already existed (as might occur when a volume\n was not completely removed) (#8253).\n - Fixed a bug where the podman run and podman create commands would\n deadlock when trying to create a container that mounted the same named\n volume at multiple locations (e.g. podman run -v testvol:/test1 -v\n testvol:/test2) (#8221).\n - Fixed a bug where the parsing of the --net option to podman build was\n incorrect (#8322).\n - Fixed a bug where the podman build command would print the ID of the\n built image twice when using remote Podman (#8332).\n - Fixed a bug where the podman stats command did not show memory limits\n for containers (#8265).\n - Fixed a bug where the podman pod inspect command printed the static\n MAC address of the pod in a non-human-readable format (#8386).\n - Fixed a bug where the --tls-verify option of the podman play kube\n command had its logic inverted (false would enforce the use of TLS,\n true would disable it).\n - Fixed a bug where the podman network rm command would error when\n trying to remove macvlan networks and rootless CNI networks (#8491).\n - Fixed a bug where Podman was not setting sane defaults for missing\n XDG_ environment variables.\n - Fixed a bug where remote Podman would check if volume paths to be\n mounted in the container existed on the host, not the server (#8473).\n - Fixed a bug where the podman manifest create and podman manifest add\n commands on local images would drop any images in the manifest not\n pulled by the host.\n - Fixed a bug where networks made by podman network create did not\n include the tuning plugin, and as such did not support setting custom\n MAC addresses (#8385).\n - Fixed a bug where container healthchecks did not use $PATH when\n searching for the Podman executable to run the healthcheck.\n - Fixed a bug where the --ip-range option to podman network create did\n not properly handle non-classful subnets when calculating the last\n usable IP for DHCP assignment (#8448).\n - Fixed a bug where the podman container ps alias for podman ps was\n missing (#8445).\n * API\n - The Compat Create endpoint for Container has received a major refactor\n to share more code with the Libpod Create endpoint, and should be\n significantly more stable.\n - A Compat endpoint for exporting multiple images at once, GET\n /images/get, has been added (#7950).\n - The Compat Network Connect and Network Disconnect endpoints have been\n added.\n - Endpoints that deal with image registries now support a\n X-Registry-Config header to specify registry authentication\n configuration.\n - The Compat Create endpoint for images now properly supports specifying\n images by digest.\n - The Libpod Build endpoint for images now supports an httpproxy query\n parameter which, if set to true, will forward the server's HTTP proxy\n settings into the build container for RUN instructions.\n - The Libpod Untag endpoint for images will now remove all tags for the\n given image if no repository and tag are specified for removal.\n - Fixed a bug where the Ping endpoint misspelled a header name\n (Libpod-Buildha-Version instead of Libpod-Buildah-Version).\n - Fixed a bug where the Ping endpoint sent an extra newline at the end\n of its response where Docker did not.\n - Fixed a bug where the Compat Logs endpoint for containers did not send\n a newline character after each log line.\n - Fixed a bug where the Compat Logs endpoint for containers would mangle\n line endings to change newline characters to add a preceding carriage\n return (#7942).\n - Fixed a bug where the Compat Inspect endpoint for Containers did not\n properly list the container's stop signal (#7917).\n - Fixed a bug where the Compat Inspect endpoint for Containers formatted\n the container's create time incorrectly (#7860).\n - Fixed a bug where the Compat Inspect endpoint for Containers did not\n include the container's Path, Args, and Restart Count.\n - Fixed a bug where the Compat Inspect endpoint for Containers prefixed\n added and dropped capabilities with CAP_ (Docker does not do so).\n - Fixed a bug where the Compat Info endpoint for the Engine did not\n include configured registries.\n - Fixed a bug where the server could panic if a client closed a\n connection midway through an image pull (#7896).\n - Fixed a bug where the Compat Create endpoint for volumes returned an\n error when a volume with the same name already existed, instead of\n succeeding with a 201 code (#7740).\n - Fixed a bug where a client disconnecting from the Libpod or Compat\n events endpoints could result in the server using 100% CPU (#7946).\n - Fixed a bug where the \"no such image\" error message sent by the Compat\n Inspect endpoint for Images returned a 404 status code with an error\n that was improperly formatted for Docker compatibility.\n - Fixed a bug where the Compat Create endpoint for networks did not\n properly set a default for the driver parameter if it was not provided\n by the client.\n - Fixed a bug where the Compat Inspect endpoint for images did not\n populate the RootFS field of the response.\n - Fixed a bug where the Compat Inspect endpoint for images would omit\n the ParentId field if the image had no parent, and the Created field\n if the image did not have a creation time.\n - Fixed a bug where the Compat Remove endpoint for Networks did not\n support the Force query parameter.\n\n - add dependency to timezone package or podman fails to build a\n - Correct invalid use of %{_libexecdir} to ensure files should be in\n /usr/lib SELinux support [jsc#SMO-15]\n\n\n libseccomp was updated to release 2.5.3:\n\n * Update the syscall table for Linux v5.15\n * Fix issues with multiplexed syscalls on mipsel introduced in v2.5.2\n * Document that seccomp_rule_add() may return -EACCES\n\n Update to release 2.5.2\n\n * Update the syscall table for Linux v5.14-rc7\n * Add a function, get_notify_fd(), to the Python bindings to get the\n nofication file descriptor.\n * Consolidate multiplexed syscall handling for all architectures into one\n location.\n * Add multiplexed syscall support to PPC and MIPS\n * The meaning of SECCOMP_IOCTL_NOTIF_ID_VALID changed within the kernel.\n libseccomp's fd notification logic was modified to support the kernel's\n previous and new usage of SECCOMP_IOCTL_NOTIF_ID_VALID.\n\n update to 2.5.1:\n\n * Fix a bug where seccomp_load() could only be called once\n * Change the notification fd handling to only request a notification fd if\n * the filter has a _NOTIFY action\n * Add documentation about SCMP_ACT_NOTIFY to the seccomp_add_rule(3)\n manpage\n * Clarify the maintainers' GPG keys\n\n Update to release 2.5.0\n\n * Add support for the seccomp user notifications, see the\n seccomp_notify_alloc(3), seccomp_notify_receive(3),\n seccomp_notify_respond(3) manpages for more information\n * Add support for new filter optimization approaches, including a balanced\n tree optimization, see the SCMP_FLTATR_CTL_OPTIMIZE filter attribute for\n more information\n * Add support for the 64-bit RISC-V architecture\n * Performance improvements when adding new rules to a filter thanks to the\n use of internal shadow transactions and improved syscall lookup tables\n * Properly document the libseccomp API return values and include them in\n the stable API promise\n * Improvements to the s390 and s390x multiplexed syscall handling\n * Multiple fixes and improvements to the libseccomp manpages\n * Moved from manually maintained syscall tables to an automatically\n generated syscall table in CSV format\n * Update the syscall tables to Linux v5.8.0-rc5\n * Python bindings and build now default to Python 3.x\n * Improvements to the tests have boosted code coverage to over 93%\n\n Update to release 2.4.3\n\n * Add list of authorized release signatures to README.md\n * Fix multiplexing issue with s390/s390x shm* syscalls\n * Remove the static flag from libseccomp tools compilation\n * Add define for __SNR_ppoll\n * Fix potential memory leak identified by clang in the scmp_bpf_sim tool\n\n Update to release 2.4.2\n\n * Add support for io-uring related system calls\n\n\n conmon was updated to version 2.0.30:\n\n * Remove unreachable code path\n * exit: report if the exit command was killed\n * exit: fix race zombie reaper\n * conn_sock: allow watchdog messages through the notify socket proxy\n * seccomp: add support for seccomp notify\n\n Update to version 2.0.29:\n\n * Reset OOM score back to 0 for container runtime\n * call functions registered with atexit on SIGTERM\n * conn_sock: fix potential segfault\n\n Update to version 2.0.27:\n\n * Add CRI-O integration test GitHub action\n * exec: don't fail on EBADFD\n * close_fds: fix close of external fds\n * Add arm64 static build binary\n\n Update to version 2.0.26:\n\n * conn_sock: do not fail on EAGAIN\n * fix segfault from a double freed pointer\n * Fix a bug where conmon could never spawn a container, because a\n disagreement between the caller and itself on where the attach socket\n was.\n * improve --full-attach to ignore the socket-dir directly. that means\n callers don't need to specify a socket dir at all (and can remove it)\n * add full-attach option to allow callers to not truncate a very long\n path for the attach socket\n * close only opened FDs\n * set locale to inherit environment\n\n Update to version 2.0.22:\n\n * added man page\n * attach: always chdir\n * conn_sock: Explicitly free a heap-allocated string\n * refactor I/O and add SD_NOTIFY proxy support\n\n Update to version 2.0.21:\n\n * protect against kill(-1)\n * Makefile: enable debuginfo generation\n * Remove go.sum file and add go.mod\n * Fail if conmon config could not be written\n * nix: remove double definition for e2fsprogs\n * Speedup static build by utilizing CI cache on `/nix` folder\n * Fix nix build for failing e2fsprogs tests\n * test: fix CI\n * Use Podman for building\n\n libcontainers-common was updated to include:\n\n - common 0.44.0\n - image 5.16.0\n - podman 3.3.1\n - storage 1.36.0 (changes too long to list)\n\n CVEs fixed:\n CVE-2020-14370,CVE-2020-15157,CVE-2021-20199,CVE-2021-20291,CVE-2021-3602\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.3:\n\n zypper in -t patch openSUSE-SLE-15.3-2022-23018=1", "published": "2022-03-04T00:00:00", "modified": "2022-03-04T00:00:00", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector": "NETWORK", "accessComplexity": "MEDIUM", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.1}, "severity": "HIGH", "exploitabilityScore": 8.6, "impactScore": 6.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}, "exploitabilityScore": 2.8, "impactScore": 3.6}, "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5BA2TLW7O5ZURGQUAQUH4HD5SQYNDDZ6/", "reporter": "Suse", "references": [], "cvelist": ["CVE-2020-14370", "CVE-2020-15157", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-3602", "CVE-2021-4024", "CVE-2021-41190"], "immutableFields": [], "lastseen": "2022-09-14T18:43:38", "viewCount": 115, "enchantments": {"dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2021:0531", "ALSA-2021:1796", "ALSA-2021:4154", "ALSA-2021:4221", "ALSA-2021:4222"]}, {"type": "amazon", "idList": ["ALAS-2021-1551", "ALAS-2021-1555"]}, {"type": "archlinux", "idList": ["ASA-202009-11"]}, {"type": "cve", "idList": ["CVE-2020-14370", "CVE-2020-15157", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-3602", "CVE-2021-4024", "CVE-2021-41190", "CVE-2022-2739"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4865-1:E637E"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-14370", "DEBIANCVE:CVE-2020-15157", "DEBIANCVE:CVE-2021-20199", "DEBIANCVE:CVE-2021-20291", "DEBIANCVE:CVE-2021-3602", "DEBIANCVE:CVE-2021-4024"]}, {"type": "fedora", "idList": ["FEDORA:0116A30530A9", "FEDORA:0B1F632FE8A5", "FEDORA:1412D3052BBC", "FEDORA:19EEE30530BF", "FEDORA:1A323310044E", "FEDORA:1EB23304C2FA", "FEDORA:248233081CF2", "FEDORA:2C81230609A5", "FEDORA:3101F3100457", "FEDORA:31F2E3052F03", "FEDORA:4C0743052BBC", "FEDORA:50D7430EC834", "FEDORA:53F0E30520B0", "FEDORA:57E4E304C4C4", "FEDORA:58A5F310C30C", "FEDORA:5BDF13108D8E", "FEDORA:5CCD1315A3FB", "FEDORA:6245730E461F", "FEDORA:637993104F8F", "FEDORA:649D030C5604", "FEDORA:69468307CC21", "FEDORA:70A64306A94A", "FEDORA:7610D315A3FC", "FEDORA:896DE3072621", "FEDORA:9DB0030B509A", "FEDORA:A175E305D434", "FEDORA:A2D6C304938D", "FEDORA:A361330C9EAD", "FEDORA:A386830A3E4B", "FEDORA:A8752309FF1F", "FEDORA:B367831AB73F", "FEDORA:BB52C30A5251", "FEDORA:D11A930A4A19", "FEDORA:D3E0730AE6D0", "FEDORA:D731430509DA", "FEDORA:D9A5E30A4CCD", "FEDORA:DD00930E4027", "FEDORA:DDEEE3104F8F", "FEDORA:E469F34621E5", "FEDORA:E795130A3465", "FEDORA:E8DAF306A94A", "FEDORA:EA42C3166C34", "FEDORA:F0451306099A"]}, {"type": "github", "idList": ["GHSA-3CF2-X423-X582", "GHSA-742W-89GC-8M9C", "GHSA-7638-R9R3-RMJJ", "GHSA-7QW8-847F-PGGM", "GHSA-GRH6-Q6M2-RH72", "GHSA-MC8V-MGRF-8F4M"]}, {"type": "githubexploit", "idList": ["2942D091-5D5B-5C1A-BE67-035816562025"]}, {"type": "ibm", "idList": ["30DC450AABD11109A70A2AFC8BA5DC8E8DEFDC385B32C17C4EE2BE3BF55721AB", "90033C8810900B282DA5060D5ECD8546BE618C515401F73AC2D7E6E17DBADA83", "9AE75CB1A1D3DD100D9064B9CD05456A761753026F2FA396034E23E18AE154DF"]}, {"type": "mageia", "idList": ["MGASA-2020-0406", "MGASA-2021-0531", "MGASA-2022-0006"]}, {"type": "nessus", "idList": ["ALA_ALAS-2021-1551.NASL", "ALMA_LINUX_ALSA-2021-4154.NASL", "ALMA_LINUX_ALSA-2021-4222.NASL", "CENTOS8_RHSA-2021-1796.NASL", "CENTOS8_RHSA-2021-4154.NASL", "CENTOS8_RHSA-2021-4221.NASL", "CENTOS8_RHSA-2021-4222.NASL", "DEBIAN_DSA-4865.NASL", "EULEROS_SA-2022-1424.NASL", "EULEROS_SA-2022-1445.NASL", "EULEROS_SA-2022-1482.NASL", "EULEROS_SA-2022-1501.NASL", "EULEROS_SA-2022-1886.NASL", "EULEROS_SA-2022-1926.NASL", "EULEROS_SA-2022-2218.NASL", "EULEROS_SA-2022-2240.NASL", "EULEROS_SA-2022-2253.NASL", "FEDORA_2020-3A4B8FCA5E.NASL", "FEDORA_2020-76FCD0BA34.NASL", "OPENSUSE-2020-2039.NASL", "OPENSUSE-2020-2063.NASL", "OPENSUSE-2021-1525.NASL", "OPENSUSE-2022-0334-1.NASL", "OPENSUSE-2022-23018-1.NASL", "ORACLELINUX_ELSA-2020-5900.NASL", "ORACLELINUX_ELSA-2020-5906.NASL", "ORACLELINUX_ELSA-2021-0531.NASL", "ORACLELINUX_ELSA-2021-1796.NASL", "ORACLELINUX_ELSA-2021-4154.NASL", "ORACLELINUX_ELSA-2021-4221.NASL", "ORACLELINUX_ELSA-2021-4222.NASL", "ORACLELINUX_ELSA-2022-20240.NASL", "PHOTONOS_PHSA-2020-2_0-0292_CONTAINERD.NASL", "PHOTONOS_PHSA-2020-3_0-0155_CONTAINERD.NASL", "REDHAT-RHSA-2020-4297.NASL", "REDHAT-RHSA-2020-5056.NASL", "REDHAT-RHSA-2020-5634.NASL", "REDHAT-RHSA-2021-0531.NASL", "REDHAT-RHSA-2021-1150.NASL", "REDHAT-RHSA-2021-1796.NASL", "REDHAT-RHSA-2021-4154.NASL", "REDHAT-RHSA-2021-4221.NASL", "REDHAT-RHSA-2021-4222.NASL", "REDHAT-RHSA-2022-0055.NASL", "REDHAT-RHSA-2022-6119.NASL", "SUSE_SU-2020-3378-1.NASL", "SUSE_SU-2022-0213-1.NASL", "SUSE_SU-2022-0334-1.NASL", "SUSE_SU-2022-1507-1.NASL", "UBUNTU_USN-4589-1.NASL", "UBUNTU_USN-4589-2.NASL"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-5900", "ELSA-2020-5906", "ELSA-2020-5966", "ELSA-2021-0531", "ELSA-2021-1796", "ELSA-2021-4154", "ELSA-2021-4221", "ELSA-2021-4222"]}, {"type": "osv", "idList": ["OSV:DSA-4865-1", "OSV:GHSA-3CF2-X423-X582", "OSV:GHSA-742W-89GC-8M9C", "OSV:GHSA-7638-R9R3-RMJJ", "OSV:GHSA-7QW8-847F-PGGM", "OSV:GHSA-GRH6-Q6M2-RH72", "OSV:GHSA-MC8V-MGRF-8F4M", "OSV:GO-2021-0100", "OSV:GO-2022-0345"]}, {"type": "photon", "idList": ["PHSA-2020-0155", "PHSA-2020-0292", "PHSA-2020-2.0-0292", "PHSA-2020-3.0-0155"]}, {"type": "redhat", "idList": ["RHSA-2020:4297", "RHSA-2020:5056", "RHSA-2020:5633", "RHSA-2020:5634", "RHSA-2020:5635", "RHSA-2021:0531", "RHSA-2021:0719", "RHSA-2021:1150", "RHSA-2021:1796", "RHSA-2021:2438", "RHSA-2021:4154", "RHSA-2021:4221", "RHSA-2021:4222", "RHSA-2022:0055", "RHSA-2022:0056", "RHSA-2022:0687", "RHSA-2022:1396", "RHSA-2022:1476", "RHSA-2022:1734", "RHSA-2022:4668", "RHSA-2022:4880", "RHSA-2022:4956", "RHSA-2022:5069", "RHSA-2022:6119"]}, {"type": "redhatcve", "idList": ["RH:CVE-2020-14370", "RH:CVE-2020-15157", "RH:CVE-2021-20199", "RH:CVE-2021-20291", "RH:CVE-2021-3602", "RH:CVE-2021-4024", "RH:CVE-2021-41190", "RH:CVE-2022-2739"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:2039-1", "OPENSUSE-SU-2020:2063-1", "OPENSUSE-SU-2021:1525-1", "OPENSUSE-SU-2022:0334-1"]}, {"type": "threatpost", "idList": ["THREATPOST:39625C47309704502299C3CF93814CFA", "THREATPOST:939D3A37125502BC9EE7A2E56EB485A7", "THREATPOST:CCBBEA3067FE857C1A87F48128362DB2", "THREATPOST:E7B7ABC22A2369A38FEB70BA45964658"]}, {"type": "ubuntu", "idList": ["USN-4589-1", "USN-4589-2"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-14370", "UB:CVE-2020-15157", "UB:CVE-2021-20199", "UB:CVE-2021-20291", "UB:CVE-2021-3602", "UB:CVE-2021-4024", "UB:CVE-2021-41190"]}, {"type": "veracode", "idList": ["VERACODE:27611", "VERACODE:27702", "VERACODE:29941", "VERACODE:31235", "VERACODE:33020", "VERACODE:33257", "VERACODE:36950"]}]}, "score": {"value": -0.4, "vector": "NONE"}, "backreferences": {"references": [{"type": "almalinux", "idList": ["ALSA-2021:4222"]}, {"type": "cve", "idList": ["CVE-2021-3602"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-15157", "DEBIANCVE:CVE-2021-3602"]}, {"type": "fedora", "idList": ["FEDORA:0116A30530A9", "FEDORA:19EEE30530BF", "FEDORA:248233081CF2", "FEDORA:31F2E3052F03", "FEDORA:4C0743052BBC", "FEDORA:A175E305D434", "FEDORA:A8752309FF1F", "FEDORA:B367831AB73F"]}, {"type": "github", "idList": ["GHSA-7638-R9R3-RMJJ"]}, {"type": "nessus", "idList": ["ALMA_LINUX_ALSA-2021-4154.NASL", "CENTOS8_RHSA-2021-4154.NASL", "CENTOS8_RHSA-2021-4221.NASL", "CENTOS8_RHSA-2021-4222.NASL", "ORACLELINUX_ELSA-2021-4154.NASL", "ORACLELINUX_ELSA-2021-4221.NASL", "ORACLELINUX_ELSA-2021-4222.NASL", "REDHAT-RHSA-2021-4154.NASL", "REDHAT-RHSA-2021-4221.NASL", "REDHAT-RHSA-2021-4222.NASL", "REDHAT-RHSA-2022-0055.NASL"]}, {"type": "oraclelinux", "idList": ["ELSA-2021-4221", "ELSA-2021-4222"]}, {"type": "photon", "idList": ["PHSA-2020-0292"]}, {"type": "redhat", "idList": ["RHSA-2021:4221", "RHSA-2021:4222"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-20291"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2020:2039-1", "OPENSUSE-SU-2020:2063-1", "OPENSUSE-SU-2021:1525-1", "OPENSUSE-SU-2022:0334-1"]}]}, "epss": [{"cve": "CVE-2020-14370", "epss": "0.001170000", "percentile": "0.440080000", "modified": "2023-03-17"}, {"cve": "CVE-2020-15157", "epss": "0.002850000", "percentile": "0.638040000", "modified": "2023-03-17"}, {"cve": "CVE-2021-20199", "epss": "0.000930000", "percentile": "0.380730000", "modified": "2023-03-18"}, {"cve": "CVE-2021-20291", "epss": "0.001850000", "percentile": "0.540710000", "modified": "2023-03-17"}, {"cve": "CVE-2021-3602", "epss": "0.000450000", "percentile": "0.121420000", "modified": "2023-03-17"}, {"cve": "CVE-2021-4024", "epss": "0.000840000", "percentile": "0.337930000", "modified": "2023-03-18"}, {"cve": "CVE-2021-41190", "epss": "0.001240000", "percentile": "0.451140000", "modified": "2023-03-18"}], "vulnersScore": -0.4}, "_state": {"dependencies": 1663183134, "score": 1663183033, "epss": 1679179052}, "_internal": {"score_hash": "94dc85d3ff17ace66fa4a3c481315003"}, "affectedPackage": [{"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "aarch64", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):", "packageFilename": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.aarch64.rpm", "packageName": ""}, {"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "ppc64le", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):", "packageFilename": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.ppc64le.rpm", "packageName": ""}, {"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "s390x", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):", "packageFilename": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.s390x.rpm", "packageName": ""}, {"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "x86_64", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):", "packageFilename": "- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):.x86_64.rpm", "packageName": ""}, {"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "x86_64", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (x86_64):", "packageFilename": "- openSUSE Leap 15.3 (x86_64):.x86_64.rpm", "packageName": ""}, {"OS": "openSUSE Leap", "OSVersion": "15.3", "arch": "noarch", "operator": "lt", "packageVersion": "- openSUSE Leap 15.3 (noarch):", "packageFilename": "- openSUSE Leap 15.3 (noarch):.noarch.rpm", "packageName": ""}]}

{"nessus": [{"lastseen": "2023-01-10T19:17:13", "description": "The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:23018-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-03-05T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : conmon, libcontainers-common, libseccomp, podman (openSUSE-SU-2022:23018-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370", "CVE-2020-15157", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-3602", "CVE-2021-4024", "CVE-2021-41190"], "modified": "2022-03-05T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:conmon", "p-cpe:/a:novell:opensuse:libcontainers-common", "p-cpe:/a:novell:opensuse:libseccomp-devel", "p-cpe:/a:novell:opensuse:libseccomp-tools", "p-cpe:/a:novell:opensuse:libseccomp2", "p-cpe:/a:novell:opensuse:libseccomp2-32bit", "p-cpe:/a:novell:opensuse:podman", "p-cpe:/a:novell:opensuse:podman-cni-config", "cpe:/o:novell:opensuse:15.3"], "id": "OPENSUSE-2022-23018-1.NASL", "href": "https://www.tenable.com/plugins/nessus/158634", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2022:23018-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158634);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/05\");\n\n script_cve_id(\n \"CVE-2020-14370\",\n \"CVE-2020-15157\",\n \"CVE-2021-3602\",\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\",\n \"CVE-2021-41190\"\n );\n\n script_name(english:\"openSUSE 15 Security Update : conmon, libcontainers-common, libseccomp, podman (openSUSE-SU-2022:23018-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe openSUSE-SU-2022:23018-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When\n using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in\n a short duration, the environment variables from the first container will get leaked into subsequent\n containers. An attacker who has control over the subsequent containers could use this flaw to gain access\n to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from\n parent and grandparent processes. When run in a container in a CI/CD environment, environment variables\n may include sensitive information that was shared with the container in order to be used only by Buildah\n itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1176804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1177598\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181640\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1182998\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1188520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1188914\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193273\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5BA2TLW7O5ZURGQUAQUH4HD5SQYNDDZ6/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f8e88443\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-14370\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-15157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-4024\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4024\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/03/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libcontainers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libseccomp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libseccomp-tools\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libseccomp2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libseccomp2-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nvar os_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.3', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\nvar pkgs = [\n {'reference':'conmon-2.0.30-150300.8.3.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libcontainers-common-20210626-150300.8.3.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libseccomp-devel-2.5.3-150300.10.5.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libseccomp-tools-2.5.3-150300.10.5.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libseccomp2-2.5.3-150300.10.5.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libseccomp2-32bit-2.5.3-150300.10.5.1', 'cpu':'x86_64', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-3.4.4-150300.9.3.2', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-cni-config-3.4.4-150300.9.3.2', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var cpu = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'conmon / libcontainers-common / libseccomp-devel / libseccomp-tools / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-03-15T08:42:52", "description": "The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:23018-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2023-03-10T00:00:00", "type": "nessus", "title": "SUSE SLED15 / SLES15 Security Update : conmon, libcontainers-common, libseccomp, podman (SUSE-SU-2022:23018-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370", "CVE-2020-15157", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-3602", "CVE-2021-4024", "CVE-2021-41190"], "modified": "2023-03-10T00:00:00", "cpe": ["cpe:2.3:o:novell:suse_linux:15:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:conmon:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:podman:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:libseccomp-devel:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:libseccomp2:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:podman-cni-config:*:*:*:*:*:*:*", "p-cpe:2.3:a:novell:suse_linux:libcontainers-common:*:*:*:*:*:*:*"], "id": "SUSE_SU-2022-23018-1.NASL", "href": "https://www.tenable.com/plugins/nessus/172436", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2022:23018-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(172436);\n script_version(\"1.0\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/10\");\n\n script_cve_id(\n \"CVE-2020-14370\",\n \"CVE-2020-15157\",\n \"CVE-2021-3602\",\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\",\n \"CVE-2021-41190\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2022:23018-1\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : conmon, libcontainers-common, libseccomp, podman (SUSE-SU-2022:23018-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2022:23018-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When\n using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in\n a short duration, the environment variables from the first container will get leaked into subsequent\n containers. An attacker who has control over the subsequent containers could use this flaw to gain access\n to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from\n parent and grandparent processes. When run in a container in a CI/CD environment, environment variables\n may include sensitive information that was shared with the container in order to be used only by Buildah\n itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1176804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1177598\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181640\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1182998\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1188520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1188914\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193273\");\n # https://lists.suse.com/pipermail/sle-security-updates/2022-March/010347.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98405178\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-14370\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-15157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-4024\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4024\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/02/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/03/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libcontainers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libseccomp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libseccomp2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLED15 / SLES15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(3)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLED15 SP3\", os_ver + \" SP\" + service_pack);\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(3)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP3\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'conmon-2.0.30-150300.8.3.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-containers-release-15.3', 'sles-release-15.3']},\n {'reference':'libcontainers-common-20210626-150300.8.3.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'libcontainers-common-20210626-150300.8.3.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'libseccomp-devel-2.5.3-150300.10.5.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'libseccomp-devel-2.5.3-150300.10.5.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'libseccomp2-2.5.3-150300.10.5.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'libseccomp2-2.5.3-150300.10.5.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},\n {'reference':'podman-3.4.4-150300.9.3.2', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-containers-release-15.3', 'sles-release-15.3']},\n {'reference':'podman-cni-config-3.4.4-150300.9.3.2', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-release-15.3', 'sle-module-containers-release-15.3', 'sles-release-15.3']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'conmon / libcontainers-common / libseccomp-devel / libseccomp2 / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-03-10T19:24:46", "description": "The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3312-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). (CVE-2021-3602)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-09-20T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : libcontainers-common (SUSE-SU-2022:3312-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370", "CVE-2020-15157", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-3602"], "modified": "2023-03-10T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libcontainers-common", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2022-3312-1.NASL", "href": "https://www.tenable.com/plugins/nessus/165254", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2022:3312-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(165254);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/10\");\n\n script_cve_id(\n \"CVE-2020-14370\",\n \"CVE-2020-15157\",\n \"CVE-2021-3602\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2022:3312-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : libcontainers-common (SUSE-SU-2022:3312-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2022:3312-1 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When\n using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in\n a short duration, the environment variables from the first container will get leaked into subsequent\n containers. An attacker who has control over the subsequent containers could use this flaw to gain access\n to sensitive information stored in such variables. (CVE-2020-14370)\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from\n parent and grandparent processes. When run in a container in a CI/CD environment, environment variables\n may include sensitive information that was shared with the container in order to be used only by Buildah\n itself (e.g. container registry credentials). (CVE-2021-3602)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1176804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1177598\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181640\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1182998\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1188520\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1189893\");\n # https://lists.suse.com/pipermail/sle-security-updates/2022-September/012287.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?5c455bbd\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-14370\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-15157\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected libcontainers-common package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-20199\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/09/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/09/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libcontainers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1|2)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP1/2\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'libcontainers-common-20210626-150100.3.15.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_BCL-release-15.1', 'SLES_SAP-release-15.1', 'SLE_HPC-ESPOS-release-1']},\n {'reference':'libcontainers-common-20210626-150100.3.15.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_BCL-release-15.2', 'SLES_SAP-release-15.2', 'SLE_HPC-ESPOS-release-2']},\n {'reference':'libcontainers-common-20210626-150100.3.15.1', 'sp':'1', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.1', 'sles-ltss-release-15.1']},\n {'reference':'libcontainers-common-20210626-150100.3.15.1', 'sp':'2', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.2', 'sles-ltss-release-15.2']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libcontainers-common');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-26T14:51:19", "description": "The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4154 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-11-11T00:00:00", "type": "nessus", "title": "CentOS 8 : container-tools:rhel8 (CESA-2021:4154)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20291", "CVE-2021-3602"], "modified": "2022-03-11T00:00:00", "cpe": ["cpe:/o:centos:centos:8-stream", "p-cpe:/a:centos:centos:buildah", "p-cpe:/a:centos:centos:buildah-tests", "p-cpe:/a:centos:centos:cockpit-podman", "p-cpe:/a:centos:centos:conmon", "p-cpe:/a:centos:centos:container-selinux", "p-cpe:/a:centos:centos:containernetworking-plugins", "p-cpe:/a:centos:centos:containers-common", "p-cpe:/a:centos:centos:crit", "p-cpe:/a:centos:centos:criu", "p-cpe:/a:centos:centos:criu-devel", "p-cpe:/a:centos:centos:criu-libs", "p-cpe:/a:centos:centos:crun", "p-cpe:/a:centos:centos:fuse-overlayfs", "p-cpe:/a:centos:centos:libslirp", "p-cpe:/a:centos:centos:libslirp-devel", "p-cpe:/a:centos:centos:oci-seccomp-bpf-hook", "p-cpe:/a:centos:centos:python3-criu", "p-cpe:/a:centos:centos:python3-podman", "p-cpe:/a:centos:centos:runc", "p-cpe:/a:centos:centos:skopeo", "p-cpe:/a:centos:centos:skopeo-tests", "p-cpe:/a:centos:centos:slirp4netns", "p-cpe:/a:centos:centos:udica"], "id": "CENTOS8_RHSA-2021-4154.NASL", "href": "https://www.tenable.com/plugins/nessus/155173", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# Red Hat Security Advisory RHSA-2021:4154. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155173);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/11\");\n\n script_cve_id(\"CVE-2021-3602\", \"CVE-2021-20291\");\n script_xref(name:\"RHSA\", value:\"2021:4154\");\n\n script_name(english:\"CentOS 8 : container-tools:rhel8 (CESA-2021:4154)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote CentOS host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nCESA-2021:4154 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:4154\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/04/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/11/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:8-stream\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:criu-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:criu-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:python3-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:udica\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CentOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/CentOS/release');\nif (isnull(release) || 'CentOS' >!< release) audit(AUDIT_OS_NOT, 'CentOS');\nvar os_ver = pregmatch(pattern: \"CentOS(?: Stream)?(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');\nvar os_ver = os_ver[1];\nif ('CentOS Stream' >!< release) audit(AUDIT_OS_NOT, 'CentOS 8-Stream');\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'CentOS 8.x', 'CentOS ' + os_ver);\n\nif (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);\n\nvar pkgs = [\n {'reference':'buildah-1.22.3-2.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-1.22.3-2.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-33-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-33-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'conmon-2.0.29-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'conmon-2.0.29-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'container-selinux-2.167.0-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'container-selinux-2.167.0-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containernetworking-plugins-1.0.0-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containernetworking-plugins-1.0.0-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1-2.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containers-common-1-2.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'crit-3.15-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crit-3.15-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-podman-3.2.0-2.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-podman-3.2.0-2.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.4.2-0.1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.4.2-0.1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-tests-1.4.2-0.1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-tests-1.4.2-0.1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'slirp4netns-1.1.8-1.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'slirp4netns-1.1.8-1.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.5-2.module_el8.5.0', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.5-2.module_el8.5.0', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'CentOS-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / conmon / container-selinux / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-27T14:37:17", "description": "The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4154 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-12-10T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : container-tools:ol8 (ELSA-2021-4154)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20291", "CVE-2021-3602"], "modified": "2022-03-11T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:buildah", "p-cpe:/a:oracle:linux:buildah-tests", "p-cpe:/a:oracle:linux:cockpit-podman", "p-cpe:/a:oracle:linux:conmon", "p-cpe:/a:oracle:linux:container-selinux", "p-cpe:/a:oracle:linux:containernetworking-plugins", "p-cpe:/a:oracle:linux:containers-common", "p-cpe:/a:oracle:linux:crit", "p-cpe:/a:oracle:linux:criu", "p-cpe:/a:oracle:linux:criu-devel", "p-cpe:/a:oracle:linux:criu-libs", "p-cpe:/a:oracle:linux:crun", "p-cpe:/a:oracle:linux:fuse-overlayfs", "p-cpe:/a:oracle:linux:libslirp", "p-cpe:/a:oracle:linux:libslirp-devel", "p-cpe:/a:oracle:linux:oci-seccomp-bpf-hook", "p-cpe:/a:oracle:linux:podman", "p-cpe:/a:oracle:linux:podman-catatonit", "p-cpe:/a:oracle:linux:podman-docker", "p-cpe:/a:oracle:linux:podman-gvproxy", "p-cpe:/a:oracle:linux:podman-plugins", "p-cpe:/a:oracle:linux:podman-remote", "p-cpe:/a:oracle:linux:podman-tests", "p-cpe:/a:oracle:linux:python3-criu", "p-cpe:/a:oracle:linux:python3-podman", "p-cpe:/a:oracle:linux:runc", "p-cpe:/a:oracle:linux:skopeo", "p-cpe:/a:oracle:linux:skopeo-tests", "p-cpe:/a:oracle:linux:slirp4netns", "p-cpe:/a:oracle:linux:udica"], "id": "ORACLELINUX_ELSA-2021-4154.NASL", "href": "https://www.tenable.com/plugins/nessus/155986", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2021-4154.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155986);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/11\");\n\n script_cve_id(\"CVE-2021-3602\", \"CVE-2021-20291\");\n\n script_name(english:\"Oracle Linux 8 : container-tools:ol8 (ELSA-2021-4154)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2021-4154 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2021-4154.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/04/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/12/10\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:criu-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:criu-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-catatonit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-gvproxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python3-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:udica\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');\nif ('ol8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nvar appstreams = {\n 'container-tools:ol8': [\n {'reference':'buildah-1.22.3-2.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-1.22.3-2.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-33-1.module+el8.5.0+20416+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'conmon-2.0.29-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'conmon-2.0.29-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.167.0-1.module+el8.5.0+20416+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-1.0.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containernetworking-plugins-1.0.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1-2.0.2.module+el8.5.0+20424+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'crit-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crit-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-gvproxy-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-gvproxy-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-3.3.1-9.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-podman-3.2.0-2.module+el8.5.0+20416+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.4.2-0.1.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-1.4.2-0.1.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.4.2-0.1.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.4.2-0.1.0.1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.5.0+20416+d687fed7', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'slirp4netns-1.1.8-1.module+el8.5.0+20416+d687fed7', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.5-2.module+el8.5.0+20416+d687fed7', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n};\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var package_array ( appstreams[module] ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-26T14:51:46", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4154 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-11-11T00:00:00", "type": "nessus", "title": "RHEL 8 : container-tools:rhel8 (RHSA-2021:4154)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20291", "CVE-2021-3602"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:buildah", "p-cpe:/a:redhat:enterprise_linux:buildah-tests", "p-cpe:/a:redhat:enterprise_linux:cockpit-podman", "p-cpe:/a:redhat:enterprise_linux:conmon", "p-cpe:/a:redhat:enterprise_linux:container-selinux", "p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins", "p-cpe:/a:redhat:enterprise_linux:containers-common", "p-cpe:/a:redhat:enterprise_linux:crit", "p-cpe:/a:redhat:enterprise_linux:criu", "p-cpe:/a:redhat:enterprise_linux:criu-devel", "p-cpe:/a:redhat:enterprise_linux:criu-libs", "p-cpe:/a:redhat:enterprise_linux:crun", "p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs", "p-cpe:/a:redhat:enterprise_linux:libslirp", "p-cpe:/a:redhat:enterprise_linux:libslirp-devel", "p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook", "p-cpe:/a:redhat:enterprise_linux:podman", "p-cpe:/a:redhat:enterprise_linux:podman-catatonit", "p-cpe:/a:redhat:enterprise_linux:podman-docker", "p-cpe:/a:redhat:enterprise_linux:podman-gvproxy", "p-cpe:/a:redhat:enterprise_linux:podman-plugins", "p-cpe:/a:redhat:enterprise_linux:podman-remote", "p-cpe:/a:redhat:enterprise_linux:podman-tests", "p-cpe:/a:redhat:enterprise_linux:python3-criu", "p-cpe:/a:redhat:enterprise_linux:python3-podman", "p-cpe:/a:redhat:enterprise_linux:runc", "p-cpe:/a:redhat:enterprise_linux:skopeo", "p-cpe:/a:redhat:enterprise_linux:skopeo-tests", "p-cpe:/a:redhat:enterprise_linux:slirp4netns", "p-cpe:/a:redhat:enterprise_linux:toolbox", "p-cpe:/a:redhat:enterprise_linux:toolbox-tests", "p-cpe:/a:redhat:enterprise_linux:udica"], "id": "REDHAT-RHSA-2021-4154.NASL", "href": "https://www.tenable.com/plugins/nessus/155085", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:4154. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155085);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2021-3602\", \"CVE-2021-20291\");\n script_xref(name:\"RHSA\", value:\"2021:4154\");\n\n script_name(english:\"RHEL 8 : container-tools:rhel8 (RHSA-2021:4154)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2021:4154 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:4154\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1939485\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1969264\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(200, 667);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/04/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/11/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:criu-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:criu-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-catatonit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-gvproxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:toolbox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:toolbox-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:udica\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar appstreams = {\n 'container-tools:rhel8': [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.22.3-2.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-33-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.29-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.167.0-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-1.0.0-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1-2.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2', 'allowmaj':TRUE},\n {'reference':'crit-3.15-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-gvproxy-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-3.3.1-9.module+el8.5.0+12697+018f24d7', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-podman-3.2.0-2.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.4.2-0.1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.4.2-0.1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.99.3-0.4.module+el8.5.0+12682+a4eeb084', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-tests-0.0.99.3-0.4.module+el8.5.0+12682+a4eeb084', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.5-2.module+el8.5.0+12582+56d94c81', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.22.3-2.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.22.3-2.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-33-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.29-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.167.0-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-1.0.0-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1-2.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2', 'allowmaj':TRUE},\n {'reference':'crit-3.15-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-1.0-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.7.1-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-gvproxy-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-3.3.1-9.module+el8.5.0+12697+018f24d7', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-podman-3.2.0-2.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.2-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.4.2-0.1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.4.2-0.1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.99.3-0.4.module+el8.5.0+12682+a4eeb084', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-tests-0.0.99.3-0.4.module+el8.5.0+12682+a4eeb084', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.5-2.module+el8.5.0+12582+56d94c81', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n ]\n};\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:appstreams, appstreams:TRUE);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\nif ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var module_array ( appstreams[module] ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(module_array['repo_relative_urls'])) repo_relative_urls = module_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var package_array ( module_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp']) && !enterprise_linux_flag) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get();\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / conmon / container-selinux / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-26T06:27:18", "description": "The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4154 advisory.\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-03-11T00:00:00", "type": "nessus", "title": "AlmaLinux 8 : container-tools:rhel8 (ALSA-2021:4154)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20291", "CVE-2021-3602"], "modified": "2022-03-11T00:00:00", "cpe": ["p-cpe:/a:alma:linux:crit", "p-cpe:/a:alma:linux:criu", "p-cpe:/a:alma:linux:criu-devel", "p-cpe:/a:alma:linux:criu-libs", "p-cpe:/a:alma:linux:libslirp", "p-cpe:/a:alma:linux:libslirp-devel", "p-cpe:/a:alma:linux:oci-seccomp-bpf-hook", "p-cpe:/a:alma:linux:python3-criu", "p-cpe:/a:alma:linux:slirp4netns", "p-cpe:/a:alma:linux:toolbox", "p-cpe:/a:alma:linux:toolbox-tests", "cpe:/o:alma:linux:8"], "id": "ALMA_LINUX_ALSA-2021-4154.NASL", "href": "https://www.tenable.com/plugins/nessus/158839", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# AlmaLinux Security Advisory ALSA-2021:4154.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(158839);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/03/11\");\n\n script_cve_id(\"CVE-2021-3602\", \"CVE-2021-20291\");\n script_xref(name:\"ALSA\", value:\"2021:4154\");\n\n script_name(english:\"AlmaLinux 8 : container-tools:rhel8 (ALSA-2021:4154)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote AlmaLinux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nALSA-2021:4154 advisory.\n\n - An information disclosure flaw was found in Buildah, when building containers using chroot isolation.\n Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from\n parent and grandparent processes. When run in a container in a CI/CD environment, environment variables\n may include sensitive information that was shared with the container in order to be used only by Buildah\n itself (e.g. container registry credentials). (CVE-2021-3602)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.almalinux.org/8/ALSA-2021-4154.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/04/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/03/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:criu-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:criu-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:toolbox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:toolbox-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:8\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Alma Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AlmaLinux/release\", \"Host/AlmaLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/AlmaLinux/release');\nif (isnull(release) || 'AlmaLinux' >!< release) audit(AUDIT_OS_NOT, 'AlmaLinux');\nvar os_ver = pregmatch(pattern: \"AlmaLinux release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');\nvar os_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'AlmaLinux 8.x', 'AlmaLinux ' + os_ver);\n\nif (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);\n\nvar module_ver = get_kb_item('Host/AlmaLinux/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\nif ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nvar appstreams = {\n 'container-tools:rhel8': [\n {'reference':'crit-3.15-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-devel-3.15-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-libs-3.15-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.4.0-1.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.4.0-1.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.3-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-3.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'slirp4netns-1.1.8-1.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.99.3-0.4.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-tests-0.0.99.3-0.4.module_el8.5.0+2613+1b78b731', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n};\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/AlmaLinux/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach package_array ( appstreams[module] ) {\n var reference = NULL;\n var release = NULL;\n var sp = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'Alma-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && release && (!exists_check || rpm_exists(release:release, rpm:exists_check))) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'crit / criu / criu-devel / criu-libs / libslirp / libslirp-devel / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-03-08T00:54:53", "description": "The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0326-1 advisory.\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.\n When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.\n (CVE-2021-20206)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\n - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.\n A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non- empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.\n (CVE-2022-27649)\n\n - An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. (CVE-2022-2989)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-02-14T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : podman (SUSE-SU-2023:0326-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20199", "CVE-2021-20206", "CVE-2021-4024", "CVE-2021-41190", "CVE-2022-27649", "CVE-2022-2989"], "modified": "2023-03-07T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:podman", "p-cpe:/a:novell:suse_linux:podman-cni-config", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2023-0326-1.NASL", "href": "https://www.tenable.com/plugins/nessus/171408", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2023:0326-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(171408);\n script_version(\"1.1\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/07\");\n\n script_cve_id(\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20206\",\n \"CVE-2021-41190\",\n \"CVE-2022-2989\",\n \"CVE-2022-27649\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2023:0326-1\");\n\n script_name(english:\"SUSE SLES15 Security Update : podman (SUSE-SU-2023:0326-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in\nthe SUSE-SU-2023:0326-1 advisory.\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.\n When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use\n special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows\n an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The\n highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.\n (CVE-2021-20206)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\n - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.\n A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-\n empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with\n inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.\n (CVE-2022-27649)\n\n - An incorrect handling of the supplementary groups in the Podman container engine might lead to the\n sensitive information disclosure or possible data modification if an attacker has direct access to the\n affected container where supplementary groups are used to set access permissions and is able to execute a\n binary code in that container. (CVE-2022-2989)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181640\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181961\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193273\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1197672\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1199790\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1202809\");\n # https://lists.suse.com/pipermail/sle-security-updates/2023-February/013710.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?87039eb4\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20206\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-4024\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2022-27649\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2022-2989\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected podman and / or podman-cni-config packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-20206\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-27649\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2023/02/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/02/14\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15', 'SUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(3)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP3\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'podman-4.3.1-150300.9.15.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-ESPOS-release-3']},\n {'reference':'podman-cni-config-4.3.1-150300.9.15.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3', 'SLE_HPC-ESPOS-release-3']},\n {'reference':'podman-4.3.1-150300.9.15.1', 'sp':'3', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-ESPOS-release-3']},\n {'reference':'podman-4.3.1-150300.9.15.1', 'sp':'3', 'cpu':'aarch64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.3']},\n {'reference':'podman-4.3.1-150300.9.15.1', 'sp':'3', 'cpu':'x86_64', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.3']},\n {'reference':'podman-cni-config-4.3.1-150300.9.15.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-LTSS-release-15.3', 'sles-ltss-release-15.3']},\n {'reference':'podman-4.3.1-150300.9.15.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['sles-ltss-release-15.3']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n if ('ltss' >< tolower(check)) ltss_caveat_required = TRUE;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n var ltss_plugin_caveat = NULL;\n if(ltss_caveat_required) ltss_plugin_caveat = '\\n' +\n 'NOTE: This vulnerability check contains fixes that apply to\\n' +\n 'packages only available in SUSE Enterprise Linux Server LTSS\\n' +\n 'repositories. Access to these package security updates require\\n' +\n 'a paid SUSE LTSS subscription.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + ltss_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-cni-config');\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-03-08T00:50:03", "description": "The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0187-1 advisory.\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.\n When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.\n (CVE-2021-20206)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\n - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.\n A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non- empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.\n (CVE-2022-27649)\n\n - An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container. (CVE-2022-2989)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2023-01-28T00:00:00", "type": "nessus", "title": "SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2023:0187-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20199", "CVE-2021-20206", "CVE-2021-4024", "CVE-2021-41190", "CVE-2022-27649", "CVE-2022-2989"], "modified": "2023-03-07T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:podman", "p-cpe:/a:novell:suse_linux:podman-cni-config", "p-cpe:/a:novell:suse_linux:podman-docker", "p-cpe:/a:novell:suse_linux:podman-remote", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2023-0187-1.NASL", "href": "https://www.tenable.com/plugins/nessus/170750", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# SUSE update advisory SUSE-SU-2023:0187-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(170750);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/07\");\n\n script_cve_id(\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20206\",\n \"CVE-2021-41190\",\n \"CVE-2022-2989\",\n \"CVE-2022-27649\"\n );\n script_xref(name:\"SuSE\", value:\"SUSE-SU-2023:0187-1\");\n\n script_name(english:\"SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2023:0187-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the SUSE-SU-2023:0187-1 advisory.\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1.\n When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use\n special elements such as ../ separators to reference binaries elsewhere on the system. This flaw allows\n an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The\n highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.\n (CVE-2021-20206)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\n - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.\n A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-\n empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with\n inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.\n (CVE-2022-27649)\n\n - An incorrect handling of the supplementary groups in the Podman container engine might lead to the\n sensitive information disclosure or possible data modification if an attacker has direct access to the\n affected container where supplementary groups are used to set access permissions and is able to execute a\n binary code in that container. (CVE-2022-2989)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181640\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1181961\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193166\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193273\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1197672\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1199790\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1202809\");\n # https://lists.suse.com/pipermail/sle-security-updates/2023-January/013557.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?d8ba7d5a\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-20206\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-4024\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2022-27649\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2022-2989\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected podman, podman-cni-config, podman-docker and / or podman-remote packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-20206\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2022-27649\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/02/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2023/01/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2023/01/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item(\"Host/SuSE/release\");\nif (isnull(os_release) || os_release !~ \"^(SLED|SLES|SUSE)\") audit(AUDIT_OS_NOT, \"SUSE / openSUSE\");\nvar os_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+|SUSE([\\d.]+))\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE / openSUSE');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15|SUSE15\\.4)$\", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLES15 / openSUSE 15', 'SUSE / openSUSE (' + os_ver + ')');\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE / openSUSE (' + os_ver + ')', cpu);\n\nvar service_pack = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(service_pack)) service_pack = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(4)$\", string:service_pack))) audit(AUDIT_OS_NOT, \"SLES15 SP4\", os_ver + \" SP\" + service_pack);\n\nvar pkgs = [\n {'reference':'podman-4.3.1-150400.4.11.1', 'sp':'4', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.4', 'SLE_HPC-release-15.4', 'sle-module-containers-release-15.4', 'sles-release-15.4']},\n {'reference':'podman-cni-config-4.3.1-150400.4.11.1', 'sp':'4', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.4', 'SLE_HPC-release-15.4', 'sle-module-containers-release-15.4', 'sles-release-15.4']},\n {'reference':'podman-docker-4.3.1-150400.4.11.1', 'sp':'4', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.4', 'SLE_HPC-release-15.4', 'sle-module-containers-release-15.4', 'sles-release-15.4']},\n {'reference':'podman-remote-4.3.1-150400.4.11.1', 'sp':'4', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.4', 'SLE_HPC-release-15.4', 'sle-module-containers-release-15.4', 'sles-release-15.4']},\n {'reference':'podman-4.3.1-150400.4.11.1', 'release':'SUSE15.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['openSUSE-release-15.4']},\n {'reference':'podman-cni-config-4.3.1-150400.4.11.1', 'release':'SUSE15.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['openSUSE-release-15.4']},\n {'reference':'podman-docker-4.3.1-150400.4.11.1', 'release':'SUSE15.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['openSUSE-release-15.4']},\n {'reference':'podman-remote-4.3.1-150400.4.11.1', 'release':'SUSE15.4', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['openSUSE-release-15.4']}\n];\n\nvar ltss_caveat_required = FALSE;\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var exists_check = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && _release) {\n if (exists_check) {\n var check_flag = 0;\n foreach var check (exists_check) {\n if (!rpm_exists(release:_release, rpm:check)) continue;\n check_flag++;\n }\n if (!check_flag) continue;\n }\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-cni-config / podman-docker / podman-remote');\n}\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-02-04T18:58:07", "description": "The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7954 advisory.\n\n - golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)\n\n - golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)\n\n - podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n - golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\n - podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)\n\n - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-16T00:00:00", "type": "nessus", "title": "RHEL 9 : podman (RHSA-2022:7954)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28851", "CVE-2020-28852", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-33197", "CVE-2021-34558", "CVE-2021-4024", "CVE-2022-27191"], "modified": "2023-02-02T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:9", "p-cpe:/a:redhat:enterprise_linux:podman", "p-cpe:/a:redhat:enterprise_linux:podman-docker", "p-cpe:/a:redhat:enterprise_linux:podman-gvproxy", "p-cpe:/a:redhat:enterprise_linux:podman-plugins", "p-cpe:/a:redhat:enterprise_linux:podman-remote", "p-cpe:/a:redhat:enterprise_linux:podman-tests"], "id": "REDHAT-RHSA-2022-7954.NASL", "href": "https://www.tenable.com/plugins/nessus/167600", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2022:7954. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(167600);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/02/02\");\n\n script_cve_id(\n \"CVE-2020-28851\",\n \"CVE-2020-28852\",\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\",\n \"CVE-2021-33197\",\n \"CVE-2021-34558\",\n \"CVE-2022-27191\"\n );\n script_xref(name:\"RHSA\", value:\"2022:7954\");\n\n script_name(english:\"RHEL 9 : podman (RHSA-2022:7954)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as\nreferenced in the RHSA-2022:7954 advisory.\n\n - golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)\n\n - golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)\n\n - podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\n - golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)\n\n - golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)\n\n - podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)\n\n - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-28851\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-28852\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-4024\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-20199\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-33197\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-34558\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2022-27191\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2022:7954\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1913333\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1913338\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1919050\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1939485\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1983596\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1989570\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2026675\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/2064702\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4024\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 129, 200, 327, 346, 667);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/12/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/11/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-gvproxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-tests\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '9')) audit(AUDIT_OS_NOT, 'Red Hat 9.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/dist/rhel9/9/aarch64/appstream/debug',\n 'content/dist/rhel9/9/aarch64/appstream/os',\n 'content/dist/rhel9/9/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel9/9/aarch64/baseos/debug',\n 'content/dist/rhel9/9/aarch64/baseos/os',\n 'content/dist/rhel9/9/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel9/9/aarch64/codeready-builder/debug',\n 'content/dist/rhel9/9/aarch64/codeready-builder/os',\n 'content/dist/rhel9/9/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel9/9/aarch64/highavailability/debug',\n 'content/dist/rhel9/9/aarch64/highavailability/os',\n 'content/dist/rhel9/9/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel9/9/aarch64/supplementary/debug',\n 'content/dist/rhel9/9/aarch64/supplementary/os',\n 'content/dist/rhel9/9/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/appstream/debug',\n 'content/dist/rhel9/9/ppc64le/appstream/os',\n 'content/dist/rhel9/9/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/baseos/debug',\n 'content/dist/rhel9/9/ppc64le/baseos/os',\n 'content/dist/rhel9/9/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/codeready-builder/debug',\n 'content/dist/rhel9/9/ppc64le/codeready-builder/os',\n 'content/dist/rhel9/9/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/highavailability/debug',\n 'content/dist/rhel9/9/ppc64le/highavailability/os',\n 'content/dist/rhel9/9/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/resilientstorage/debug',\n 'content/dist/rhel9/9/ppc64le/resilientstorage/os',\n 'content/dist/rhel9/9/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/sap-solutions/debug',\n 'content/dist/rhel9/9/ppc64le/sap-solutions/os',\n 'content/dist/rhel9/9/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/sap/debug',\n 'content/dist/rhel9/9/ppc64le/sap/os',\n 'content/dist/rhel9/9/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel9/9/ppc64le/supplementary/debug',\n 'content/dist/rhel9/9/ppc64le/supplementary/os',\n 'content/dist/rhel9/9/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel9/9/s390x/appstream/debug',\n 'content/dist/rhel9/9/s390x/appstream/os',\n 'content/dist/rhel9/9/s390x/appstream/source/SRPMS',\n 'content/dist/rhel9/9/s390x/baseos/debug',\n 'content/dist/rhel9/9/s390x/baseos/os',\n 'content/dist/rhel9/9/s390x/baseos/source/SRPMS',\n 'content/dist/rhel9/9/s390x/codeready-builder/debug',\n 'content/dist/rhel9/9/s390x/codeready-builder/os',\n 'content/dist/rhel9/9/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel9/9/s390x/highavailability/debug',\n 'content/dist/rhel9/9/s390x/highavailability/os',\n 'content/dist/rhel9/9/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel9/9/s390x/resilientstorage/debug',\n 'content/dist/rhel9/9/s390x/resilientstorage/os',\n 'content/dist/rhel9/9/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel9/9/s390x/sap/debug',\n 'content/dist/rhel9/9/s390x/sap/os',\n 'content/dist/rhel9/9/s390x/sap/source/SRPMS',\n 'content/dist/rhel9/9/s390x/supplementary/debug',\n 'content/dist/rhel9/9/s390x/supplementary/os',\n 'content/dist/rhel9/9/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/appstream/debug',\n 'content/dist/rhel9/9/x86_64/appstream/os',\n 'content/dist/rhel9/9/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/baseos/debug',\n 'content/dist/rhel9/9/x86_64/baseos/os',\n 'content/dist/rhel9/9/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/codeready-builder/debug',\n 'content/dist/rhel9/9/x86_64/codeready-builder/os',\n 'content/dist/rhel9/9/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/highavailability/debug',\n 'content/dist/rhel9/9/x86_64/highavailability/os',\n 'content/dist/rhel9/9/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/nfv/debug',\n 'content/dist/rhel9/9/x86_64/nfv/os',\n 'content/dist/rhel9/9/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/resilientstorage/debug',\n 'content/dist/rhel9/9/x86_64/resilientstorage/os',\n 'content/dist/rhel9/9/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/rt/debug',\n 'content/dist/rhel9/9/x86_64/rt/os',\n 'content/dist/rhel9/9/x86_64/rt/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/sap-solutions/debug',\n 'content/dist/rhel9/9/x86_64/sap-solutions/os',\n 'content/dist/rhel9/9/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/sap/debug',\n 'content/dist/rhel9/9/x86_64/sap/os',\n 'content/dist/rhel9/9/x86_64/sap/source/SRPMS',\n 'content/dist/rhel9/9/x86_64/supplementary/debug',\n 'content/dist/rhel9/9/x86_64/supplementary/os',\n 'content/dist/rhel9/9/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'podman-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-docker-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-gvproxy-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-plugins-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-remote-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-tests-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-docker / podman-gvproxy / podman-plugins / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-10T19:38:09", "description": "The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7954 advisory.\n\n - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) (CVE-2020-28851)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) (CVE-2020-28852)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.\n (CVE-2021-33197)\n\n - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. (CVE-2021-34558)\n\n - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-22T00:00:00", "type": "nessus", "title": "Oracle Linux 9 : podman (ELSA-2022-7954)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28851", "CVE-2020-28852", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-33197", "CVE-2021-34558", "CVE-2021-4024", "CVE-2022-27191"], "modified": "2022-11-22T00:00:00", "cpe": ["p-cpe:2.3:a:oracle:linux:podman:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-docker:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-remote:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-tests:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-catatonit:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-plugins:*:*:*:*:*:*:*", "p-cpe:2.3:a:oracle:linux:podman-gvproxy:*:*:*:*:*:*:*", "cpe:2.3:o:oracle:linux:9:*:*:*:*:*:*:*"], "id": "ORACLELINUX_ELSA-2022-7954.NASL", "href": "https://www.tenable.com/plugins/nessus/168070", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2022-7954.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(168070);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/11/22\");\n\n script_cve_id(\n \"CVE-2020-28851\",\n \"CVE-2020-28852\",\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\",\n \"CVE-2021-33197\",\n \"CVE-2021-34558\",\n \"CVE-2022-27191\"\n );\n script_xref(name:\"IAVB\", value:\"2021-B-0047-S\");\n\n script_name(english:\"Oracle Linux 9 : podman (ELSA-2022-7954)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nELSA-2022-7954 advisory.\n\n - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing\n the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)\n (CVE-2020-28851)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage\n while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language\n header.) (CVE-2020-28852)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from\n net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.\n (CVE-2021-33197)\n\n - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an\n X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS\n server to cause a TLS client to panic. (CVE-2021-34558)\n\n - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to\n crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2022-7954.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4024\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/12/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/11/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/11/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:9\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-catatonit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-gvproxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-tests\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_release = get_kb_item(\"Host/RedHat/release\");\nif (isnull(os_release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nvar os_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^9([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 9', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nvar pkgs = [\n {'reference':'podman-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-catatonit-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-catatonit-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-docker-4.2.0-3.0.1.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-gvproxy-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-gvproxy-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-plugins-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-plugins-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-remote-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-remote-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-tests-4.2.0-3.0.1.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-tests-4.2.0-3.0.1.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release) {\n if (exists_check) {\n if (rpm_exists(release:_release, rpm:exists_check) && rpm_check(release:_release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-catatonit / podman-docker / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-01-10T19:39:35", "description": "The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7954 advisory.\n\n - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) (CVE-2020-28851)\n\n - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) (CVE-2020-28852)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.\n (CVE-2021-33197)\n\n - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. (CVE-2021-34558)\n\n - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2022-11-19T00:00:00", "type": "nessus", "title": "AlmaLinux 9 : podman (ALSA-2022:7954)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-28851", "CVE-2020-28852", "CVE-2021-20199", "CVE-2021-20291", "CVE-2021-33197", "CVE-2021-34558", "CVE-2021-4024", "CVE-2022-27191"], "modified": "2022-11-19T00:00:00", "cpe": ["p-cpe:/a:alma:linux:podman", "p-cpe:/a:alma:linux:podman-docker", "p-cpe:/a:alma:linux:podman-gvproxy", "p-cpe:/a:alma:linux:podman-plugins", "p-cpe:/a:alma:linux:podman-remote", "p-cpe:/a:alma:linux:podman-tests", "cpe:/o:alma:linux:9", "cpe:/o:alma:linux:9::appstream"], "id": "ALMA_LINUX_ALSA-2022-7954.NASL", "href": "https://www.tenable.com/plugins/nessus/167982", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n#\n# The package checks in this plugin were extracted from\n# AlmaLinux Security Advisory ALSA-2022:7954.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(167982);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/11/19\");\n\n script_cve_id(\n \"CVE-2020-28851\",\n \"CVE-2020-28852\",\n \"CVE-2021-4024\",\n \"CVE-2021-20199\",\n \"CVE-2021-20291\",\n \"CVE-2021-33197\",\n \"CVE-2021-34558\",\n \"CVE-2022-27191\"\n );\n script_xref(name:\"ALSA\", value:\"2022:7954\");\n script_xref(name:\"IAVB\", value:\"2021-B-0047-S\");\n\n script_name(english:\"AlmaLinux 9 : podman (ALSA-2022:7954)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote AlmaLinux host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the\nALSA-2022:7954 advisory.\n\n - In x/text in Go 1.15.4, an index out of range panic occurs in language.ParseAcceptLanguage while parsing\n the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)\n (CVE-2020-28851)\n\n - In x/text in Go before v0.3.5, a slice bounds out of range panic occurs in language.ParseAcceptLanguage\n while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language\n header.) (CVE-2020-28852)\n\n - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual\n machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is\n accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an\n attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making\n private services on the VM accessible to the network. This issue could be also used to interrupt the\n host's services by forwarding all ports to the VM. (CVE-2021-4024)\n\n - Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including\n from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by\n default and do not require authentication. This issue affects Podman 1.8.0 onwards. (CVE-2021-20199)\n\n - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a\n container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid\n `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits\n for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a\n malicious image, which when downloaded and stored by an application using containers/storage, would then\n cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)\n\n - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from\n net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.\n (CVE-2021-33197)\n\n - The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an\n X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS\n server to cause a TLS client to panic. (CVE-2021-34558)\n\n - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to\n crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)\n\nNote that Nessus has not tested for these issues but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://errata.almalinux.org/9/ALSA-2022-7954.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-4024\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(129, 20, 200, 327, 346, 667);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/12/03\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/11/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman-gvproxy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:alma:linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:9\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:alma:linux:9::appstream\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Alma Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AlmaLinux/release\", \"Host/AlmaLinux/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/AlmaLinux/release');\nif (isnull(os_release) || 'AlmaLinux' >!< os_release) audit(AUDIT_OS_NOT, 'AlmaLinux');\nvar os_ver = pregmatch(pattern: \"AlmaLinux release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'AlmaLinux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^9([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'AlmaLinux 9.x', 'AlmaLinux ' + os_ver);\n\nif (!get_kb_item('Host/AlmaLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'AlmaLinux', cpu);\n\nvar pkgs = [\n {'reference':'podman-4.2.0-3.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-4.2.0-3.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-docker-4.2.0-3.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-gvproxy-4.2.0-3.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-gvproxy-4.2.0-3.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-plugins-4.2.0-3.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-plugins-4.2.0-3.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-remote-4.2.0-3.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-remote-4.2.0-3.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-tests-4.2.0-3.el9', 'cpu':'aarch64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'podman-tests-4.2.0-3.el9', 'cpu':'x86_64', 'release':'9', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'}\n];\n\nvar flag = 0;\nforeach var package_array ( pkgs ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'Alma-' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {\n if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-docker / podman-gvproxy / podman-plugins / etc');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-10T14:50:52", "description": "An update of the containerd package has been released.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-10-23T00:00:00", "type": "nessus", "title": "Photon OS 2.0: Containerd PHSA-2020-2.0-0292", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2021-03-18T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:containerd", "cpe:/o:vmware:photonos:2.0"], "id": "PHOTONOS_PHSA-2020-2_0-0292_CONTAINERD.NASL", "href": "https://www.tenable.com/plugins/nessus/141858", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2020-2.0-0292. The text\n# itself is copyright (C) VMware, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141858);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/18\");\n\n script_cve_id(\"CVE-2020-15157\");\n\n script_name(english:\"Photon OS 2.0: Containerd PHSA-2020-2.0-0292\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the containerd package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-2-292.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:containerd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/PhotonOS/release');\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, 'PhotonOS');\nif (release !~ \"^VMware Photon (?:Linux|OS) 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, 'PhotonOS 2.0');\n\nif (!get_kb_item('Host/PhotonOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'PhotonOS', cpu);\n\nflag = 0;\n\nif (rpm_check(release:'PhotonOS-2.0', cpu:'x86_64', reference:'containerd-1.2.14-1.ph2')) flag++;\nif (rpm_check(release:'PhotonOS-2.0', cpu:'x86_64', reference:'containerd-doc-1.2.14-1.ph2')) flag++;\nif (rpm_check(release:'PhotonOS-2.0', cpu:'x86_64', reference:'containerd-extras-1.2.14-1.ph2')) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'containerd');\n}\n", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:51:09", "description": "An update of the containerd package has been released.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-10-24T00:00:00", "type": "nessus", "title": "Photon OS 3.0: Containerd PHSA-2020-3.0-0155", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2021-03-18T00:00:00", "cpe": ["p-cpe:/a:vmware:photonos:containerd", "cpe:/o:vmware:photonos:3.0"], "id": "PHOTONOS_PHSA-2020-3_0-0155_CONTAINERD.NASL", "href": "https://www.tenable.com/plugins/nessus/141867", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from VMware Security Advisory PHSA-2020-3.0-0155. The text\n# itself is copyright (C) VMware, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141867);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/18\");\n\n script_cve_id(\"CVE-2020-15157\");\n\n script_name(english:\"Photon OS 3.0: Containerd PHSA-2020-3.0-0155\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote PhotonOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"An update of the containerd package has been released.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://github.com/vmware/photon/wiki/Security-Updates-3.0-155.md\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected Linux packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:vmware:photonos:containerd\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:vmware:photonos:3.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"PhotonOS Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/PhotonOS/release\", \"Host/PhotonOS/rpm-list\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item('Host/PhotonOS/release');\nif (isnull(release) || release !~ \"^VMware Photon\") audit(AUDIT_OS_NOT, 'PhotonOS');\nif (release !~ \"^VMware Photon (?:Linux|OS) 3\\.0(\\D|$)\") audit(AUDIT_OS_NOT, 'PhotonOS 3.0');\n\nif (!get_kb_item('Host/PhotonOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'PhotonOS', cpu);\n\nflag = 0;\n\nif (rpm_check(release:'PhotonOS-3.0', cpu:'x86_64', reference:'containerd-1.2.14-1.ph3')) flag++;\nif (rpm_check(release:'PhotonOS-3.0', cpu:'x86_64', reference:'containerd-doc-1.2.14-1.ph3')) flag++;\nif (rpm_check(release:'PhotonOS-3.0', cpu:'x86_64', reference:'containerd-extras-1.2.14-1.ph3')) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'containerd');\n}\n", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:52:05", "description": "The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-5906 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-11-03T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : containerd (ELSA-2020-5906)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2021-03-18T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:containerd"], "id": "ORACLELINUX_ELSA-2020-5906.NASL", "href": "https://www.tenable.com/plugins/nessus/142222", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-5906.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142222);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/18\");\n\n script_cve_id(\"CVE-2020-15157\");\n\n script_name(english:\"Oracle Linux 7 : containerd (ELSA-2020-5906)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the\nELSA-2020-5906 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2020-5906.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected containerd package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:containerd\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\npkgs = [\n {'reference':'containerd-1.2.14-1.0.1.el7', 'cpu':'x86_64', 'release':'7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'containerd');\n}", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:50:36", "description": "The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4589-2 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-10-19T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Docker vulnerability (USN-4589-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2023-01-17T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:20.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:docker.io"], "id": "UBUNTU_USN-4589-2.NASL", "href": "https://www.tenable.com/plugins/nessus/141538", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4589-2. The text\n# itself is copyright (C) Canonical, Inc. See\n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered\n# trademark of Canonical, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141538);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/17\");\n\n script_cve_id(\"CVE-2020-15157\");\n script_xref(name:\"USN\", value:\"4589-2\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Docker vulnerability (USN-4589-2)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as\nreferenced in the USN-4589-2 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4589-2\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected docker.io package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/19\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:20.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:docker.io\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('ubuntu.inc');\ninclude('misc_func.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/Ubuntu/release');\nif ( isnull(release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|20\\.04)$\", string:release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04 / 18.04 / 20.04', 'Ubuntu ' + release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\n\npkgs = [\n {'osver': '16.04', 'pkgname': 'docker.io', 'pkgver': '18.09.7-0ubuntu1~16.04.6'},\n {'osver': '18.04', 'pkgname': 'docker.io', 'pkgver': '19.03.6-0ubuntu1~18.04.2'},\n {'osver': '20.04', 'pkgname': 'docker.io', 'pkgver': '19.03.8-0ubuntu1.20.04.1'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n osver = NULL;\n pkgname = NULL;\n pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'docker.io');\n}", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:51:26", "description": "The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4589-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-10-16T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS : containerd vulnerability (USN-4589-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2023-01-17T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:16.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:containerd"], "id": "UBUNTU_USN-4589-1.NASL", "href": "https://www.tenable.com/plugins/nessus/141479", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4589-1. The text\n# itself is copyright (C) Canonical, Inc. See\n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered\n# trademark of Canonical, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(141479);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/17\");\n\n script_cve_id(\"CVE-2020-15157\");\n script_xref(name:\"USN\", value:\"4589-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS : containerd vulnerability (USN-4589-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the\nUSN-4589-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's\nself-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4589-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected containerd package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/15\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:containerd\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2020-2023 Canonical, Inc. / NASL script (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('audit.inc');\ninclude('ubuntu.inc');\ninclude('misc_func.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item('Host/Ubuntu/release');\nif ( isnull(release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04)$\", string:release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04', 'Ubuntu ' + release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\n\npkgs = [\n {'osver': '16.04', 'pkgname': 'containerd', 'pkgver': '1.2.6-0ubuntu1~16.04.4'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n osver = NULL;\n pkgname = NULL;\n pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'containerd');\n}", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:50:30", "description": "The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5900 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 4.0}, "published": "2020-10-28T00:00:00", "type": "nessus", "title": "Oracle Linux 7 : docker-engine / docker-cli (ELSA-2020-5900)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 4.9, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "HIGH", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-15157"], "modified": "2021-03-18T00:00:00", "cpe": ["cpe:/o:oracle:linux:7", "p-cpe:/a:oracle:linux:docker-cli", "p-cpe:/a:oracle:linux:docker-engine"], "id": "ORACLELINUX_ELSA-2020-5900.NASL", "href": "https://www.tenable.com/plugins/nessus/142024", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2020-5900.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(142024);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/03/18\");\n\n script_cve_id(\"CVE-2020-15157\");\n\n script_name(english:\"Oracle Linux 7 : docker-engine / docker-cli (ELSA-2020-5900)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the\nELSA-2020-5900 advisory.\n\n - In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking\n vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format\n includes a URL for the location of a specific image layer (otherwise known as a foreign layer), the\n default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or\n later, the default containerd resolver will provide its authentication credentials if the server where the\n URL is located presents an HTTP 401 status code along with registry-specific HTTP headers. If an attacker\n publishes a public image with a manifest that directs one of the layers to be fetched from a web server\n they control and they trick a user or system into pulling the image, they can obtain the credentials used\n for pulling that image. In some cases, this may be the user's username and password for the registry. In\n other cases, this may be the credentials attached to the cloud virtual instance which can grant access to\n other cloud resources in the account. The default containerd resolver is used by the cri-containerd plugin\n (which can be used by Kubernetes), the ctr development tool, and other client programs that have\n explicitly linked against it. This vulnerability has been fixed in containerd 1.2.14. containerd 1.3 and\n later are not affected. If you are using containerd 1.3 or later, you are not affected. If you are using\n cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.\n Other container runtimes built on top of containerd but not using the default resolver (such as Docker)\n are not affected. (CVE-2020-15157)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2020-5900.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected docker-cli and / or docker-engine packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-15157\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/10/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/28\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:docker-cli\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:docker-engine\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 7', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\nif ('x86_64' >!< cpu) audit(AUDIT_ARCH_NOT, 'x86_64', cpu);\n\npkgs = [\n {'reference':'docker-cli-19.03.11.ol-6.el7', 'cpu':'x86_64', 'release':'7'},\n {'reference':'docker-engine-19.03.11.ol-6.el7', 'cpu':'x86_64', 'release':'7'}\n];\n\nflag = 0;\nforeach package_array ( pkgs ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n rpm_prefix = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rpm_prefix'])) rpm_prefix = package_array['rpm_prefix'];\n if (reference && release) {\n if (rpm_prefix) {\n if (rpm_exists(release:release, rpm:rpm_prefix) && rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n } else {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'docker-cli / docker-engine');\n}", "cvss": {"score": 2.6, "vector": "AV:N/AC:H/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-01-26T14:42:42", "description": "The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1150 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2021-04-20T00:00:00", "type": "nessus", "title": "RHEL 7 / 8 : OpenShift Container Platform 4.7.7 (RHSA-2021:1150)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "COMPLETE", "integrityImpact": "NONE", "baseScore": 7.1, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-20291"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7", "cpe:/o:redhat:enterprise_linux:8", "p-cpe:/a:redhat:enterprise_linux:cri-o", "p-cpe:/a:redhat:enterprise_linux:openshift-hyperkube"], "id": "REDHAT-RHSA-2021-1150.NASL", "href": "https://www.tenable.com/plugins/nessus/148852", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:1150. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148852);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2021-20291\");\n script_xref(name:\"RHSA\", value:\"2021:1150\");\n\n script_name(english:\"RHEL 7 / 8 : OpenShift Container Platform 4.7.7 (RHSA-2021:1150)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced\nin the RHSA-2021:1150 advisory.\n\n - containers/storage: DoS via malicious image (CVE-2021-20291)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-20291\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:1150\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1939485\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected cri-o and / or openshift-hyperkube packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-20291\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(667);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/04/01\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/04/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/04/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:cri-o\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:openshift-hyperkube\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release_list(operator: 'ge', os_version: os_ver, rhel_versions: ['7','8'])) audit(AUDIT_OS_NOT, 'Red Hat 7.x / 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar constraints = [\n {\n 'repo_relative_urls': [\n 'content/dist/layered/rhel8/s390x/rhocp/4.7/debug',\n 'content/dist/layered/rhel8/s390x/rhocp/4.7/os',\n 'content/dist/layered/rhel8/s390x/rhocp/4.7/source/SRPMS',\n 'content/dist/layered/rhel8/x86_64/rhocp/4.7/debug',\n 'content/dist/layered/rhel8/x86_64/rhocp/4.7/os',\n 'content/dist/layered/rhel8/x86_64/rhocp/4.7/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'cri-o-1.20.2-6.rhaos4.7.gitf1d5201.el8', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'},\n {'reference':'cri-o-1.20.2-6.rhaos4.7.gitf1d5201.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'},\n {'reference':'openshift-hyperkube-4.7.0-202104090228.p0.git.97111.77863f8.el8', 'cpu':'s390x', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'},\n {'reference':'openshift-hyperkube-4.7.0-202104090228.p0.git.97111.77863f8.el8', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel/server/7/7Server/x86_64/ose/4.7/debug',\n 'content/dist/rhel/server/7/7Server/x86_64/ose/4.7/os',\n 'content/dist/rhel/server/7/7Server/x86_64/ose/4.7/source/SRPMS',\n 'content/dist/rhel/system-z/7/7Server/s390x/ose/4.7/debug',\n 'content/dist/rhel/system-z/7/7Server/s390x/ose/4.7/os',\n 'content/dist/rhel/system-z/7/7Server/s390x/ose/4.7/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'cri-o-1.20.2-6.rhaos4.7.gitf1d5201.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'},\n {'reference':'openshift-hyperkube-4.7.0-202104090228.p0.git.97111.77863f8.el7', 'cpu':'x86_64', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'exists_check':'openshift-hyperkube'}\n ]\n }\n];\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:constraints);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar flag = 0;\nforeach var constraint_array ( constraints ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(constraint_array['repo_relative_urls'])) repo_relative_urls = constraint_array['repo_relative_urls'];\n foreach var pkg ( constraint_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];\n if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];\n if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];\n if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];\n if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];\n if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];\n if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];\n if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];\n if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get() + redhat_report_package_caveat();\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'cri-o / openshift-hyperkube');\n}\n", "cvss": {"score": 7.1, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"}}, {"lastseen": "2023-02-10T14:50:58", "description": "autobuilt v2.1.0,Security fix for CVE-2020-14370\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-10-09T00:00:00", "type": "nessus", "title": "Fedora 31 : 2:podman / crun (2020-3a4b8fca5e)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2022-09-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:2:podman", "p-cpe:/a:fedoraproject:fedora:crun", "cpe:/o:fedoraproject:fedora:31"], "id": "FEDORA_2020-3A4B8FCA5E.NASL", "href": "https://www.tenable.com/plugins/nessus/141317", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2020-3a4b8fca5e.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(141317);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/09/21\");\n\n script_cve_id(\"CVE-2020-14370\");\n script_xref(name:\"FEDORA\", value:\"2020-3a4b8fca5e\");\n\n script_name(english:\"Fedora 31 : 2:podman / crun (2020-3a4b8fca5e)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"autobuilt v2.1.0,Security fix for CVE-2020-14370\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2020-3a4b8fca5e\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected 2:podman and / or crun packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-14370\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:2:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:31\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^31([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 31\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC31\", reference:\"podman-2.1.1-3.fc31\", epoch:\"2\")) flag++;\nif (rpm_check(release:\"FC31\", reference:\"crun-0.15-5.fc31\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"2:podman / crun\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:53:09", "description": "This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\n - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).\n\nNon-security issues fixed :\n\n - add dependency to timezone package or podman fails to build a container (bsc#1178122)\n\n - Install new auto-update system units\n\n - Update to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.\n\n - Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].\n\n - The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.\n\n - Changes in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].\n\n - The `podman save` and `podman load` commands can now create and load archives containing multiple images [#2669].\n\n - Rootless Podman now supports all `podman network` commands, and rootless containers can now be joined to networks.\n\n - The performance of `podman build` on `ADD` and `COPY` instructions has been greatly improved, especially when a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now support a new mode for the `--cgroups` option, `--cgroups=split`. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now specify options to slirp4netns by using the `--network` option as follows: `--net slirp4netns:opt1,opt2`. This allows for, among other things, switching the port forwarder used by slirp4netns away from rootlessport.\n\n - The `podman ps` command now features a new option, `--storage`, to show containers from Buildah, CRI-O and other applications.\n\n - The `podman run` and `podman create` commands now feature a `--sdnotify` option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds` opton to pass file descriptors from the host into the container [#6458].\n\n - The `podman run` and `podman create` commands can now create overlay volume mounts, by adding the `:O` option to a bind mount (e.g. `-v /test:/test:O`). Overlay volume mounts will mount a directory into a container from the host and allow changes to it, but not write those changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only mounts.\n\n - The `podman play kube` command now supports setting labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting container restart policy [#7656].\n\n - The `podman play kube` command now properly handles `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to `/etc/hosts` from `--host-add` generated YAML as `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube` commands now properly support `shareProcessNamespace` to share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the `dangling` filter to identify volumes that are dangling (not attached to any container).\n\n - The `podman run` and `podman create` commands now feature a `--umask` option to set the umask of the created container.\n\n - The `podman create` and `podman run` commands now feature a `--tz` option to set the timezone within the container [#5128].\n\n - Environment variables for Podman can now be added in the `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create` now supports a new mount type, `type=devpts`, to add a `devpts` mount to the container. This is useful for containers that want to mount `/dev/` from the host into the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman create` now supports a new option, `proc-opts`, to specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new option to `podman run` and `podman create`, `--cgroup-conf`, which allows for advanced configuration of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now support a `--override-variant` option, to override the architecture variant of the image that will be pulled and ran.\n\n - A new global option has been added to Podman, `--runtime-flags`, which allows for setting flags to use when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the `--cert-dir`, `--auth-file`, `--creds`, and `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull fails due to network errors.\n\n - The `podman exec` command would previously print error messages (e.g. `exec session exited with non-zero exit code\n\n -1`) when the command run exited with a non-0 exit code.\n It no longer does this. The `podman exec` command will still exit with the same exit code as the command run in the container did.\n\n - Error messages when creating a container or pod with a name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman creates a tmpfs filesystem at `/run`. This was previously limited to 65k in size and mounted `noexec`, but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect, List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for containers.\n\n - The `last` parameter to the Libpod container list endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited support for the (deprecated) `filter` query parameter [#6797].\n\n - Fixed a bug where the Compat Create endpoint for containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for containers would not return a 404 when the requested image was not present.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle Entrypoint and Command from images.\n\n - Fixed a bug where name history information was not properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search endpoint.\n\n - Fixed a bug where the Pod List API would return null, instead of an empty array, when no pods were present [#7392].\n\n - Fixed a bug where endpoints that hijacked would do perform the hijack too early, before being ready to send and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on multiple containers at once (e.g. Kill, Pause, Unpause, Stop) would not forward errors from individual containers that failed.\n\n - The Compat List endpoint for networks now supports filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did not send response headers until the first event occurred [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for containers did not stream its output in the correct format [#7196].\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-11-30T00:00:00", "type": "nessus", "title": "openSUSE Security Update : podman (openSUSE-2020-2039)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2020-12-02T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:podman", "p-cpe:/a:novell:opensuse:podman-cni-config", "cpe:/o:novell:opensuse:15.1"], "id": "OPENSUSE-2020-2039.NASL", "href": "https://www.tenable.com/plugins/nessus/143335", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-2039.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(143335);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/12/02\");\n\n script_cve_id(\"CVE-2020-14370\");\n\n script_name(english:\"openSUSE Security Update : podman (openSUSE-2020-2039)\");\n script_summary(english:\"Check for the openSUSE-2020-2039 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\n - This release resolves CVE-2020-14370, in which\n environment variables could be leaked between containers\n created using the Varlink API (bsc#1176804).\n\nNon-security issues fixed :\n\n - add dependency to timezone package or podman fails to\n build a container (bsc#1178122)\n\n - Install new auto-update system units\n\n - Update to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup\n manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all\n responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints\n could terminate early, before sending all output from\n the container.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle the Interactive\n parameter.\n\n - Fixed a bug where the Compat Kill endpoint for\n containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List\n endpoint for Containers did not properly handle a limit\n of 0 (returning nothing, instead of all containers)\n [#7722].\n\n - The Libpod Stats endpoint for containers is being\n deprecated and will be replaced by a similar endpoint\n with additional features in a future release.\n\n - Changes in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to\n inspect its contents without creating a container from\n it [#1433].\n\n - The `podman save` and `podman load` commands can now\n create and load archives containing multiple images\n [#2669].\n\n - Rootless Podman now supports all `podman network`\n commands, and rootless containers can now be joined to\n networks.\n\n - The performance of `podman build` on `ADD` and `COPY`\n instructions has been greatly improved, especially when\n a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now\n support a new mode for the `--cgroups` option,\n `--cgroups=split`. Podman will create two cgroups under\n the cgroup it was launched in, one for the container and\n one for Conmon. This mode is useful for running Podman\n in a systemd unit, as it ensures that all processes are\n retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now\n specify options to slirp4netns by using the `--network`\n option as follows: `--net slirp4netns:opt1,opt2`. This\n allows for, among other things, switching the port\n forwarder used by slirp4netns away from rootlessport.\n\n - The `podman ps` command now features a new option,\n `--storage`, to show containers from Buildah, CRI-O and\n other applications.\n\n - The `podman run` and `podman create` commands now\n feature a `--sdnotify` option to control the behavior of\n systemd's sdnotify with containers, enabling improved\n support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds`\n opton to pass file descriptors from the host into the\n container [#6458].\n\n - The `podman run` and `podman create` commands can now\n create overlay volume mounts, by adding the `:O` option\n to a bind mount (e.g. `-v /test:/test:O`). Overlay\n volume mounts will mount a directory into a container\n from the host and allow changes to it, but not write\n those changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket\n HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only\n mounts.\n\n - The `podman play kube` command now supports setting\n labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting\n container restart policy [#7656].\n\n - The `podman play kube` command now properly handles\n `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to\n `/etc/hosts` from `--host-add` generated YAML as\n `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube`\n commands now properly support `shareProcessNamespace` to\n share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the\n `dangling` filter to identify volumes that are dangling\n (not attached to any container).\n\n - The `podman run` and `podman create` commands now\n feature a `--umask` option to set the umask of the\n created container.\n\n - The `podman create` and `podman run` commands now\n feature a `--tz` option to set the timezone within the\n container [#5128].\n\n - Environment variables for Podman can now be added in the\n `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create`\n now supports a new mount type, `type=devpts`, to add a\n `devpts` mount to the container. This is useful for\n containers that want to mount `/dev/` from the host into\n the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman\n create` now supports a new option, `proc-opts`, to\n specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new\n option to `podman run` and `podman create`,\n `--cgroup-conf`, which allows for advanced configuration\n of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now\n support a `--override-variant` option, to override the\n architecture variant of the image that will be pulled\n and ran.\n\n - A new global option has been added to Podman,\n `--runtime-flags`, which allows for setting flags to use\n when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the\n `--cert-dir`, `--auth-file`, `--creds`, and\n `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which\n environment variables could be leaked between containers\n created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull\n fails due to network errors.\n\n - The `podman exec` command would previously print error\n messages (e.g. `exec session exited with non-zero exit\n code\n\n -1`) when the command run exited with a non-0 exit code.\n It no longer does this. The `podman exec` command will\n still exit with the same exit code as the command run in\n the container did.\n\n - Error messages when creating a container or pod with a\n name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman\n creates a tmpfs filesystem at `/run`. This was\n previously limited to 65k in size and mounted `noexec`,\n but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes\n configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to\n a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect,\n List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for\n containers.\n\n - The `last` parameter to the Libpod container list\n endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix\n format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes\n port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited\n support for the (deprecated) `filter` query parameter\n [#6797].\n\n - Fixed a bug where the Compat Create endpoint for\n containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for\n containers would not return a 404 when the requested\n image was not present.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle Entrypoint and\n Command from images.\n\n - Fixed a bug where name history information was not\n properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint\n improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search\n endpoint.\n\n - Fixed a bug where the Pod List API would return null,\n instead of an empty array, when no pods were present\n [#7392].\n\n - Fixed a bug where endpoints that hijacked would do\n perform the hijack too early, before being ready to send\n and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on\n multiple containers at once (e.g. Kill, Pause, Unpause,\n Stop) would not forward errors from individual\n containers that failed.\n\n - The Compat List endpoint for networks now supports\n filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return\n both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress\n back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide\n version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not\n include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did\n not send response headers until the first event occurred\n [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and\n Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and\n Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod\n Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for\n containers did not stream its output in the correct\n format [#7196].\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1176804\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1178122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1178392\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected podman packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"podman-2.1.1-lp151.3.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"podman-cni-config-2.1.1-lp151.3.25.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"podman / podman-cni-config\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:53:38", "description": "This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\n - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).\n\nNon-security issues fixed :\n\n - add dependency to timezone package or podman fails to build a container (bsc#1178122)\n\n - Install new auto-update system units\n\n - Update to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.\n\n - Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].\n\n - The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.\n\n - Changes in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].\n\n - The `podman save` and `podman load` commands can now create and load archives containing multiple images [#2669].\n\n - Rootless Podman now supports all `podman network` commands, and rootless containers can now be joined to networks.\n\n - The performance of `podman build` on `ADD` and `COPY` instructions has been greatly improved, especially when a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now support a new mode for the `--cgroups` option, `--cgroups=split`. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now specify options to slirp4netns by using the `--network` option as follows: `--net slirp4netns:opt1,opt2`. This allows for, among other things, switching the port forwarder used by slirp4netns away from rootlessport.\n\n - The `podman ps` command now features a new option, `--storage`, to show containers from Buildah, CRI-O and other applications.\n\n - The `podman run` and `podman create` commands now feature a `--sdnotify` option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds` opton to pass file descriptors from the host into the container [#6458].\n\n - The `podman run` and `podman create` commands can now create overlay volume mounts, by adding the `:O` option to a bind mount (e.g. `-v /test:/test:O`). Overlay volume mounts will mount a directory into a container from the host and allow changes to it, but not write those changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only mounts.\n\n - The `podman play kube` command now supports setting labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting container restart policy [#7656].\n\n - The `podman play kube` command now properly handles `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to `/etc/hosts` from `--host-add` generated YAML as `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube` commands now properly support `shareProcessNamespace` to share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the `dangling` filter to identify volumes that are dangling (not attached to any container).\n\n - The `podman run` and `podman create` commands now feature a `--umask` option to set the umask of the created container.\n\n - The `podman create` and `podman run` commands now feature a `--tz` option to set the timezone within the container [#5128].\n\n - Environment variables for Podman can now be added in the `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create` now supports a new mount type, `type=devpts`, to add a `devpts` mount to the container. This is useful for containers that want to mount `/dev/` from the host into the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman create` now supports a new option, `proc-opts`, to specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new option to `podman run` and `podman create`, `--cgroup-conf`, which allows for advanced configuration of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now support a `--override-variant` option, to override the architecture variant of the image that will be pulled and ran.\n\n - A new global option has been added to Podman, `--runtime-flags`, which allows for setting flags to use when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the `--cert-dir`, `--auth-file`, `--creds`, and `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull fails due to network errors.\n\n - The `podman exec` command would previously print error messages (e.g. `exec session exited with non-zero exit code\n\n -1`) when the command run exited with a non-0 exit code.\n It no longer does this. The `podman exec` command will still exit with the same exit code as the command run in the container did.\n\n - Error messages when creating a container or pod with a name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman creates a tmpfs filesystem at `/run`. This was previously limited to 65k in size and mounted `noexec`, but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect, List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for containers.\n\n - The `last` parameter to the Libpod container list endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited support for the (deprecated) `filter` query parameter [#6797].\n\n - Fixed a bug where the Compat Create endpoint for containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for containers would not return a 404 when the requested image was not present.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle Entrypoint and Command from images.\n\n - Fixed a bug where name history information was not properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search endpoint.\n\n - Fixed a bug where the Pod List API would return null, instead of an empty array, when no pods were present [#7392].\n\n - Fixed a bug where endpoints that hijacked would do perform the hijack too early, before being ready to send and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on multiple containers at once (e.g. Kill, Pause, Unpause, Stop) would not forward errors from individual containers that failed.\n\n - The Compat List endpoint for networks now supports filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did not send response headers until the first event occurred [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for containers did not stream its output in the correct format [#7196].\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-11-30T00:00:00", "type": "nessus", "title": "openSUSE Security Update : podman (openSUSE-2020-2063)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2020-12-02T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:podman", "p-cpe:/a:novell:opensuse:podman-cni-config", "cpe:/o:novell:opensuse:15.2"], "id": "OPENSUSE-2020-2063.NASL", "href": "https://www.tenable.com/plugins/nessus/143322", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2020-2063.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(143322);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/12/02\");\n\n script_cve_id(\"CVE-2020-14370\");\n\n script_name(english:\"openSUSE Security Update : podman (openSUSE-2020-2063)\");\n script_summary(english:\"Check for the openSUSE-2020-2063 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\n - This release resolves CVE-2020-14370, in which\n environment variables could be leaked between containers\n created using the Varlink API (bsc#1176804).\n\nNon-security issues fixed :\n\n - add dependency to timezone package or podman fails to\n build a container (bsc#1178122)\n\n - Install new auto-update system units\n\n - Update to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup\n manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all\n responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints\n could terminate early, before sending all output from\n the container.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle the Interactive\n parameter.\n\n - Fixed a bug where the Compat Kill endpoint for\n containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List\n endpoint for Containers did not properly handle a limit\n of 0 (returning nothing, instead of all containers)\n [#7722].\n\n - The Libpod Stats endpoint for containers is being\n deprecated and will be replaced by a similar endpoint\n with additional features in a future release.\n\n - Changes in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to\n inspect its contents without creating a container from\n it [#1433].\n\n - The `podman save` and `podman load` commands can now\n create and load archives containing multiple images\n [#2669].\n\n - Rootless Podman now supports all `podman network`\n commands, and rootless containers can now be joined to\n networks.\n\n - The performance of `podman build` on `ADD` and `COPY`\n instructions has been greatly improved, especially when\n a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now\n support a new mode for the `--cgroups` option,\n `--cgroups=split`. Podman will create two cgroups under\n the cgroup it was launched in, one for the container and\n one for Conmon. This mode is useful for running Podman\n in a systemd unit, as it ensures that all processes are\n retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now\n specify options to slirp4netns by using the `--network`\n option as follows: `--net slirp4netns:opt1,opt2`. This\n allows for, among other things, switching the port\n forwarder used by slirp4netns away from rootlessport.\n\n - The `podman ps` command now features a new option,\n `--storage`, to show containers from Buildah, CRI-O and\n other applications.\n\n - The `podman run` and `podman create` commands now\n feature a `--sdnotify` option to control the behavior of\n systemd's sdnotify with containers, enabling improved\n support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds`\n opton to pass file descriptors from the host into the\n container [#6458].\n\n - The `podman run` and `podman create` commands can now\n create overlay volume mounts, by adding the `:O` option\n to a bind mount (e.g. `-v /test:/test:O`). Overlay\n volume mounts will mount a directory into a container\n from the host and allow changes to it, but not write\n those changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket\n HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only\n mounts.\n\n - The `podman play kube` command now supports setting\n labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting\n container restart policy [#7656].\n\n - The `podman play kube` command now properly handles\n `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to\n `/etc/hosts` from `--host-add` generated YAML as\n `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube`\n commands now properly support `shareProcessNamespace` to\n share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the\n `dangling` filter to identify volumes that are dangling\n (not attached to any container).\n\n - The `podman run` and `podman create` commands now\n feature a `--umask` option to set the umask of the\n created container.\n\n - The `podman create` and `podman run` commands now\n feature a `--tz` option to set the timezone within the\n container [#5128].\n\n - Environment variables for Podman can now be added in the\n `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create`\n now supports a new mount type, `type=devpts`, to add a\n `devpts` mount to the container. This is useful for\n containers that want to mount `/dev/` from the host into\n the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman\n create` now supports a new option, `proc-opts`, to\n specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new\n option to `podman run` and `podman create`,\n `--cgroup-conf`, which allows for advanced configuration\n of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now\n support a `--override-variant` option, to override the\n architecture variant of the image that will be pulled\n and ran.\n\n - A new global option has been added to Podman,\n `--runtime-flags`, which allows for setting flags to use\n when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the\n `--cert-dir`, `--auth-file`, `--creds`, and\n `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which\n environment variables could be leaked between containers\n created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull\n fails due to network errors.\n\n - The `podman exec` command would previously print error\n messages (e.g. `exec session exited with non-zero exit\n code\n\n -1`) when the command run exited with a non-0 exit code.\n It no longer does this. The `podman exec` command will\n still exit with the same exit code as the command run in\n the container did.\n\n - Error messages when creating a container or pod with a\n name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman\n creates a tmpfs filesystem at `/run`. This was\n previously limited to 65k in size and mounted `noexec`,\n but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes\n configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to\n a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect,\n List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for\n containers.\n\n - The `last` parameter to the Libpod container list\n endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix\n format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes\n port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited\n support for the (deprecated) `filter` query parameter\n [#6797].\n\n - Fixed a bug where the Compat Create endpoint for\n containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for\n containers would not return a 404 when the requested\n image was not present.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle Entrypoint and\n Command from images.\n\n - Fixed a bug where name history information was not\n properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint\n improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search\n endpoint.\n\n - Fixed a bug where the Pod List API would return null,\n instead of an empty array, when no pods were present\n [#7392].\n\n - Fixed a bug where endpoints that hijacked would do\n perform the hijack too early, before being ready to send\n and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on\n multiple containers at once (e.g. Kill, Pause, Unpause,\n Stop) would not forward errors from individual\n containers that failed.\n\n - The Compat List endpoint for networks now supports\n filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return\n both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress\n back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide\n version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not\n include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did\n not send response headers until the first event occurred\n [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and\n Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and\n Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod\n Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for\n containers did not stream its output in the correct\n format [#7196].\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1176804\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1178122\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1178392\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected podman packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:podman-cni-config\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/11/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.2\", reference:\"podman-2.1.1-lp152.4.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.2\", reference:\"podman-cni-config-2.1.1-lp152.4.6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"podman / podman-cni-config\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:55:22", "description": "This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\nThis release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).\n\nNon-security issues fixed :\n\nadd dependency to timezone package or podman fails to build a container (bsc#1178122)\n\nInstall new auto-update system units\n\nUpdate to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints could terminate early, before sending all output from the container.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle the Interactive parameter.\n\n - Fixed a bug where the Compat Kill endpoint for containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List endpoint for Containers did not properly handle a limit of 0 (returning nothing, instead of all containers) [#7722].\n\n - The Libpod Stats endpoint for containers is being deprecated and will be replaced by a similar endpoint with additional features in a future release.\n\nChanges in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to inspect its contents without creating a container from it [#1433].\n\n - The `podman save` and `podman load` commands can now create and load archives containing multiple images [#2669].\n\n - Rootless Podman now supports all `podman network` commands, and rootless containers can now be joined to networks.\n\n - The performance of `podman build` on `ADD` and `COPY` instructions has been greatly improved, especially when a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now support a new mode for the `--cgroups` option, `--cgroups=split`. Podman will create two cgroups under the cgroup it was launched in, one for the container and one for Conmon. This mode is useful for running Podman in a systemd unit, as it ensures that all processes are retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now specify options to slirp4netns by using the `--network` option as follows :\n\n`--net slirp4netns:opt1,opt2`. This allows for, among other things,\n\nswitching the port forwarder used by slirp4netns away from rootlessport.\n\n - The `podman ps` command now features a new option, `--storage`, to show containers from Buildah, CRI-O and other applications.\n\n - The `podman run` and `podman create` commands now feature a `--sdnotify` option to control the behavior of systemd's sdnotify with containers, enabling improved support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds` opton to pass file descriptors from the host into the container\n\n[#6458].\n\n - The `podman run` and `podman create` commands can now create overlay volume mounts, by adding the `:O` option to a bind mount\n\n(e.g. `-v /test:/test:O`). Overlay volume mounts will mount a directory\n\ninto a container from the host and allow changes to it, but not write\n\nthose changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only mounts.\n\n - The `podman play kube` command now supports setting labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting container restart policy [#7656].\n\n - The `podman play kube` command now properly handles `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to `/etc/hosts` from `--host-add` generated YAML as `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube` commands now properly support `shareProcessNamespace` to share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the `dangling` filter to identify volumes that are dangling (not attached to any container).\n\n - The `podman run` and `podman create` commands now feature a `--umask` option to set the umask of the created container.\n\n - The `podman create` and `podman run` commands now feature a `--tz` option to set the timezone within the container [#5128].\n\n - Environment variables for Podman can now be added in the `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create` now supports a new mount type, `type=devpts`, to add a `devpts` mount to the container. This is useful for containers that want to mount `/dev/` from the host into the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman create` now supports a new option, `proc-opts`, to specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new option to `podman run` and `podman create`, `--cgroup-conf`, which allows for advanced configuration of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now support a `--override-variant` option, to override the architecture variant of the image that will be pulled and ran.\n\n - A new global option has been added to Podman, `--runtime-flags`, which allows for setting flags to use when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the `--cert-dir`, `--auth-file`, `--creds`, and `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull fails due to network errors.\n\n - The `podman exec` command would previously print error messages (e.g. `exec session exited with non-zero exit code\n\n -1`) when the command run exited with a non-0 exit code.\n It no\n\nlonger does this. The `podman exec` command will still exit with the same\n\nexit code as the command run in the container did.\n\n - Error messages when creating a container or pod with a name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman creates a tmpfs filesystem at `/run`. This was previously limited to 65k in size and mounted `noexec`, but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect, List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for containers.\n\n - The `last` parameter to the Libpod container list endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited support for the (deprecated) `filter` query parameter [#6797].\n\n - Fixed a bug where the Compat Create endpoint for containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for containers would not return a 404 when the requested image was not present.\n\n - Fixed a bug where the Compat Create endpoint for containers did not properly handle Entrypoint and Command from images.\n\n - Fixed a bug where name history information was not properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search endpoint.\n\n - Fixed a bug where the Pod List API would return null, instead of an empty array, when no pods were present [#7392].\n\n - Fixed a bug where endpoints that hijacked would do perform the hijack too early, before being ready to send and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on multiple containers at once (e.g. Kill, Pause, Unpause, Stop) would not forward errors from individual containers that failed.\n\n - The Compat List endpoint for networks now supports filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did not send response headers until the first event occurred [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for containers did not stream its output in the correct format [#7196].\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-12-09T00:00:00", "type": "nessus", "title": "SUSE SLES15 Security Update : podman (SUSE-SU-2020:3378-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2022-09-14T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:podman", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2020-3378-1.NASL", "href": "https://www.tenable.com/plugins/nessus/143753", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:3378-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(143753);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/09/14\");\n\n script_cve_id(\"CVE-2020-14370\");\n\n script_name(english:\"SUSE SLES15 Security Update : podman (SUSE-SU-2020:3378-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for podman fixes the following issues :\n\nSecurity issue fixed :\n\nThis release resolves CVE-2020-14370, in which environment variables\ncould be leaked between containers created using the Varlink API\n(bsc#1176804).\n\nNon-security issues fixed :\n\nadd dependency to timezone package or podman fails to build a\ncontainer (bsc#1178122)\n\nInstall new auto-update system units\n\nUpdate to v2.1.1 (bsc#1178392) :\n\n - Changes\n\n - The `podman info` command now includes the cgroup\n manager Podman is using.\n\n - API\n\n - The REST API now includes a Server header in all\n responses.\n\n - Fixed a bug where the Libpod and Compat Attach endpoints\n could terminate early, before sending all output from\n the container.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle the Interactive\n parameter.\n\n - Fixed a bug where the Compat Kill endpoint for\n containers could continue to run after a fatal error.\n\n - Fixed a bug where the Limit parameter of the Compat List\n endpoint for Containers did not properly handle a limit\n of 0 (returning nothing, instead of all containers)\n [#7722].\n\n - The Libpod Stats endpoint for containers is being\n deprecated and will be replaced by a similar endpoint\n with additional features in a future release.\n\nChanges in v2.1.0\n\n - Features\n\n - A new command, `podman image mount`, has been added.\n This allows for an image to be mounted, read-only, to\n inspect its contents without creating a container from\n it [#1433].\n\n - The `podman save` and `podman load` commands can now\n create and load archives containing multiple images\n [#2669].\n\n - Rootless Podman now supports all `podman network`\n commands, and rootless containers can now be joined to\n networks.\n\n - The performance of `podman build` on `ADD` and `COPY`\n instructions has been greatly improved, especially when\n a `.dockerignore` is present.\n\n - The `podman run` and `podman create` commands now\n support a new mode for the `--cgroups` option,\n `--cgroups=split`. Podman will create two cgroups under\n the cgroup it was launched in, one for the container and\n one for Conmon. This mode is useful for running Podman\n in a systemd unit, as it ensures that all processes are\n retained in systemd's cgroup hierarchy [#6400].\n\n - The `podman run` and `podman create` commands can now\n specify options to slirp4netns by using the `--network`\n option as follows :\n\n`--net slirp4netns:opt1,opt2`. This allows for, among other things,\n\nswitching the port forwarder used by slirp4netns away from\nrootlessport.\n\n - The `podman ps` command now features a new option,\n `--storage`, to show containers from Buildah, CRI-O and\n other applications.\n\n - The `podman run` and `podman create` commands now\n feature a `--sdnotify` option to control the behavior of\n systemd's sdnotify with containers, enabling improved\n support for Podman in `Type=notify` units.\n\n - The `podman run` command now features a `--preserve-fds`\n opton to pass file descriptors from the host into the\n container\n\n[#6458].\n\n - The `podman run` and `podman create` commands can now\n create overlay volume mounts, by adding the `:O` option\n to a bind mount\n\n(e.g. `-v /test:/test:O`). Overlay volume mounts will mount a\ndirectory\n\ninto a container from the host and allow changes to it, but not write\n\nthose changes back to the directory on the host.\n\n - The `podman play kube` command now supports the Socket\n HostPath type [#7112].\n\n - The `podman play kube` command now supports read-only\n mounts.\n\n - The `podman play kube` command now supports setting\n labels on pods from Kubernetes metadata labels.\n\n - The `podman play kube` command now supports setting\n container restart policy [#7656].\n\n - The `podman play kube` command now properly handles\n `HostAlias` entries.\n\n - The `podman generate kube` command now adds entries to\n `/etc/hosts` from `--host-add` generated YAML as\n `HostAlias` entries.\n\n - The `podman play kube` and `podman generate kube`\n commands now properly support `shareProcessNamespace` to\n share the PID namespace in pods.\n\n - The `podman volume ls` command now supports the\n `dangling` filter to identify volumes that are dangling\n (not attached to any container).\n\n - The `podman run` and `podman create` commands now\n feature a `--umask` option to set the umask of the\n created container.\n\n - The `podman create` and `podman run` commands now\n feature a `--tz` option to set the timezone within the\n container [#5128].\n\n - Environment variables for Podman can now be added in the\n `containers.conf` configuration file.\n\n - The `--mount` option of `podman run` and `podman create`\n now supports a new mount type, `type=devpts`, to add a\n `devpts` mount to the container. This is useful for\n containers that want to mount `/dev/` from the host into\n the container, but still create a terminal.\n\n - The `--security-opt` flag to `podman run` and `podman\n create` now supports a new option, `proc-opts`, to\n specify options for the container's `/proc` filesystem.\n\n - Podman with the `crun` OCI runtime now supports a new\n option to `podman run` and `podman create`,\n `--cgroup-conf`, which allows for advanced configuration\n of cgroups on cgroups v2 systems.\n\n - The `podman create` and `podman run` commands now\n support a `--override-variant` option, to override the\n architecture variant of the image that will be pulled\n and ran.\n\n - A new global option has been added to Podman,\n `--runtime-flags`, which allows for setting flags to use\n when the OCI runtime is called.\n\n - The `podman manifest add` command now supports the\n `--cert-dir`, `--auth-file`, `--creds`, and\n `--tls-verify` options.\n\n - Security\n\n - This release resolves CVE-2020-14370, in which\n environment variables could be leaked between containers\n created using the Varlink API.\n\n - Changes\n\n - Podman will now retry pulling an image 3 times if a pull\n fails due to network errors.\n\n - The `podman exec` command would previously print error\n messages (e.g. `exec session exited with non-zero exit\n code\n\n -1`) when the command run exited with a non-0 exit code.\n It no\n\nlonger does this. The `podman exec` command will still exit with the\nsame\n\nexit code as the command run in the container did.\n\n - Error messages when creating a container or pod with a\n name that is already in use have been improved.\n\n - For read-only containers running systemd init, Podman\n creates a tmpfs filesystem at `/run`. This was\n previously limited to 65k in size and mounted `noexec`,\n but is now unlimited size and mounted `exec`.\n\n - The `podman system reset` command no longer removes\n configuration files for rootless Podman.\n\n - API\n\n - The Libpod API version has been bumped to v2.0.0 due to\n a breaking change in the Image List API.\n\n - Docker-compatible Volume Endpoints (Create, Inspect,\n List, Remove, Prune) are now available!\n\n - Added an endpoint for generating systemd unit files for\n containers.\n\n - The `last` parameter to the Libpod container list\n endpoint now has an alias, `limit` [#6413].\n\n - The Libpod image list API new returns timestamps in Unix\n format, as integer, as opposed to as strings\n\n - The Compat Inspect endpoint for containers now includes\n port information in NetworkSettings.\n\n - The Compat List endpoint for images now features limited\n support for the (deprecated) `filter` query parameter\n [#6797].\n\n - Fixed a bug where the Compat Create endpoint for\n containers was not correctly handling bind mounts.\n\n - Fixed a bug where the Compat Create endpoint for\n containers would not return a 404 when the requested\n image was not present.\n\n - Fixed a bug where the Compat Create endpoint for\n containers did not properly handle Entrypoint and\n Command from images.\n\n - Fixed a bug where name history information was not\n properly added in the Libpod Image List endpoint.\n\n - Fixed a bug where the Libpod image search endpoint\n improperly populated the Description field of responses.\n\n - Added a `noTrunc` option to the Libpod image search\n endpoint.\n\n - Fixed a bug where the Pod List API would return null,\n instead of an empty array, when no pods were present\n [#7392].\n\n - Fixed a bug where endpoints that hijacked would do\n perform the hijack too early, before being ready to send\n and receive data [#7195].\n\n - Fixed a bug where Pod endpoints that can operate on\n multiple containers at once (e.g. Kill, Pause, Unpause,\n Stop) would not forward errors from individual\n containers that failed.\n\n - The Compat List endpoint for networks now supports\n filtering results [#7462].\n\n - Fixed a bug where the Top endpoint for pods would return\n both a 500 and 404 when run on a non-existent pod.\n\n - Fixed a bug where Pull endpoints did not stream progress\n back to the client.\n\n - The Version endpoints (Libpod and Compat) now provide\n version in a format compatible with Docker.\n\n - All non-hijacking responses to API requests should not\n include headers with the version of the server.\n\n - Fixed a bug where Libpod and Compat Events endpoints did\n not send response headers until the first event occurred\n [#7263].\n\n - Fixed a bug where the Build endpoints (Compat and\n Libpod) did not stream progress to the client.\n\n - Fixed a bug where the Stats endpoints (Compat and\n Libpod) did not properly handle clients disconnecting.\n\n - Fixed a bug where the Ignore parameter to the Libpod\n Stop endpoint was not performing properly.\n\n - Fixed a bug where the Compat Logs endpoint for\n containers did not stream its output in the correct\n format [#7196].\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1176804\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1178122\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1178392\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-14370/\");\n # https://www.suse.com/support/update/announcement/2020/suse-su-20203378-1\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?86678f58\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Containers 15-SP2 :\n\nzypper in -t patch SUSE-SLE-Module-Containers-15-SP2-2020-3378=1\n\nSUSE Linux Enterprise Module for Containers 15-SP1 :\n\nzypper in -t patch SUSE-SLE-Module-Containers-15-SP1-2020-3378=1\n\nSUSE Enterprise Storage 7 :\n\nzypper in -t patch SUSE-Storage-7-2020-3378=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-14370\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/11/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/12/09\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"false\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP1/2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"podman-2.1.1-4.28.1\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"2\", reference:\"podman-2.1.1-4.28.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"podman\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-01-24T14:42:15", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0531 advisory.\n\n - podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-02-16T00:00:00", "type": "nessus", "title": "RHEL 8 : container-tools:rhel8 (RHSA-2021:0531)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.4", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.4", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.4", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.4", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:buildah", "p-cpe:/a:redhat:enterprise_linux:buildah-tests", "p-cpe:/a:redhat:enterprise_linux:cockpit-podman", "p-cpe:/a:redhat:enterprise_linux:conmon", "p-cpe:/a:redhat:enterprise_linux:container-selinux", "p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins", "p-cpe:/a:redhat:enterprise_linux:containers-common", "p-cpe:/a:redhat:enterprise_linux:crit", "p-cpe:/a:redhat:enterprise_linux:criu", "p-cpe:/a:redhat:enterprise_linux:crun", "p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs", "p-cpe:/a:redhat:enterprise_linux:libslirp", "p-cpe:/a:redhat:enterprise_linux:libslirp-devel", "p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook", "p-cpe:/a:redhat:enterprise_linux:podman", "p-cpe:/a:redhat:enterprise_linux:podman-catatonit", "p-cpe:/a:redhat:enterprise_linux:podman-docker", "p-cpe:/a:redhat:enterprise_linux:podman-plugins", "p-cpe:/a:redhat:enterprise_linux:podman-remote", "p-cpe:/a:redhat:enterprise_linux:podman-tests", "p-cpe:/a:redhat:enterprise_linux:python-podman-api", "p-cpe:/a:redhat:enterprise_linux:python3-criu", "p-cpe:/a:redhat:enterprise_linux:runc", "p-cpe:/a:redhat:enterprise_linux:skopeo", "p-cpe:/a:redhat:enterprise_linux:skopeo-tests", "p-cpe:/a:redhat:enterprise_linux:slirp4netns", "p-cpe:/a:redhat:enterprise_linux:toolbox", "p-cpe:/a:redhat:enterprise_linux:udica"], "id": "REDHAT-RHSA-2021-0531.NASL", "href": "https://www.tenable.com/plugins/nessus/146537", "sourceData": "##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:0531. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146537);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2020-14370\");\n script_xref(name:\"RHSA\", value:\"2021:0531\");\n\n script_name(english:\"RHEL 8 : container-tools:rhel8 (RHSA-2021:0531)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in\nthe RHSA-2021:0531 advisory.\n\n - podman: environment variables leak between containers when started via Varlink or Docker-compatible REST\n API (CVE-2020-14370)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2020-14370\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:0531\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1874268\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-14370\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(200, 212);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/16\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-catatonit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-podman-api\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:toolbox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:udica\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar appstreams = {\n 'container-tools:rhel8': [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.4/x86_64/appstream/debug',\n 'content/aus/rhel8/8.4/x86_64/appstream/os',\n 'content/aus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.4/x86_64/baseos/debug',\n 'content/aus/rhel8/8.4/x86_64/baseos/os',\n 'content/aus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.4/ppc64le/sap/os',\n 'content/e4s/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.4/x86_64/appstream/os',\n 'content/e4s/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.4/x86_64/baseos/os',\n 'content/e4s/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.4/x86_64/sap/debug',\n 'content/e4s/rhel8/8.4/x86_64/sap/os',\n 'content/e4s/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/appstream/debug',\n 'content/eus/rhel8/8.4/aarch64/appstream/os',\n 'content/eus/rhel8/8.4/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/baseos/debug',\n 'content/eus/rhel8/8.4/aarch64/baseos/os',\n 'content/eus/rhel8/8.4/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.4/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.4/aarch64/highavailability/os',\n 'content/eus/rhel8/8.4/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.4/aarch64/supplementary/os',\n 'content/eus/rhel8/8.4/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.4/ppc64le/appstream/os',\n 'content/eus/rhel8/8.4/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.4/ppc64le/baseos/os',\n 'content/eus/rhel8/8.4/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.4/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.4/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.4/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.4/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/sap/debug',\n 'content/eus/rhel8/8.4/ppc64le/sap/os',\n 'content/eus/rhel8/8.4/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.4/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/appstream/debug',\n 'content/eus/rhel8/8.4/s390x/appstream/os',\n 'content/eus/rhel8/8.4/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/baseos/debug',\n 'content/eus/rhel8/8.4/s390x/baseos/os',\n 'content/eus/rhel8/8.4/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.4/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/highavailability/debug',\n 'content/eus/rhel8/8.4/s390x/highavailability/os',\n 'content/eus/rhel8/8.4/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.4/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/sap/debug',\n 'content/eus/rhel8/8.4/s390x/sap/os',\n 'content/eus/rhel8/8.4/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/s390x/supplementary/debug',\n 'content/eus/rhel8/8.4/s390x/supplementary/os',\n 'content/eus/rhel8/8.4/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/appstream/debug',\n 'content/eus/rhel8/8.4/x86_64/appstream/os',\n 'content/eus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/baseos/debug',\n 'content/eus/rhel8/8.4/x86_64/baseos/os',\n 'content/eus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.4/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.4/x86_64/highavailability/os',\n 'content/eus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.4/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.4/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/sap/debug',\n 'content/eus/rhel8/8.4/x86_64/sap/os',\n 'content/eus/rhel8/8.4/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.4/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.4/x86_64/supplementary/os',\n 'content/eus/rhel8/8.4/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/appstream/debug',\n 'content/tus/rhel8/8.4/x86_64/appstream/os',\n 'content/tus/rhel8/8.4/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/baseos/debug',\n 'content/tus/rhel8/8.4/x86_64/baseos/os',\n 'content/tus/rhel8/8.4/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.4/x86_64/highavailability/os',\n 'content/tus/rhel8/8.4/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/nfv/debug',\n 'content/tus/rhel8/8.4/x86_64/nfv/os',\n 'content/tus/rhel8/8.4/x86_64/nfv/source/SRPMS',\n 'content/tus/rhel8/8.4/x86_64/rt/debug',\n 'content/tus/rhel8/8.4/x86_64/rt/os',\n 'content/tus/rhel8/8.4/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.16.7-4.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.16.7-4.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-27.1-3.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.22-3.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.155.0-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.9.0-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-0.16-2.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.3.0-2.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.8-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.4-1.module+el8.3.1+9857+68fb1526', 'sp':'4', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.16.7-4.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.16.7-4.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-27.1-3.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.22-3.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.155.0-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.9.0-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-0.16-2.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.3.0-2.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-2.2.1-7.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.2.0-9.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.8-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.4-1.module+el8.3.1+9857+68fb1526', 'sp':'6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.16.7-4.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.16.7-4.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-27.1-3.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.22-3.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.155.0-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.9.0-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1.2.0-9.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.15-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-0.16-2.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.3.0-2.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.3.1-1.module+el8.3.1+9803+64eb0fd6', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-2.2.1-7.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-70.rc92.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-1.2.0-9.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.2.0-9.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.8-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.4-1.module+el8.3.1+9857+68fb1526', 'release':'8', 'el_string':'el8.3.1', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n ]\n};\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:appstreams, appstreams:TRUE);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\nif ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var module_array ( appstreams[module] ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(module_array['repo_relative_urls'])) repo_relative_urls = module_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var package_array ( module_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp']) && !enterprise_linux_flag) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get();\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / conmon / container-selinux / etc');\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-02-10T14:51:18", "description": "autobuilt v2.1.0, Security fix for CVE-2020-14370\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2020-10-05T00:00:00", "type": "nessus", "title": "Fedora 32 : 2:podman / crun (2020-76fcd0ba34)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2022-09-21T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:2:podman", "p-cpe:/a:fedoraproject:fedora:crun", "cpe:/o:fedoraproject:fedora:32"], "id": "FEDORA_2020-76FCD0BA34.NASL", "href": "https://www.tenable.com/plugins/nessus/141140", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2020-76fcd0ba34.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(141140);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/09/21\");\n\n script_cve_id(\"CVE-2020-14370\");\n script_xref(name:\"FEDORA\", value:\"2020-76fcd0ba34\");\n\n script_name(english:\"Fedora 32 : 2:podman / crun (2020-76fcd0ba34)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Fedora host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"autobuilt v2.1.0, Security fix for CVE-2020-14370\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2020-76fcd0ba34\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected 2:podman and / or crun packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-14370\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:2:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:32\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/10/05\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^32([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 32\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC32\", reference:\"podman-2.1.1-7.fc32\", epoch:\"2\")) flag++;\nif (rpm_check(release:\"FC32\", reference:\"crun-0.15-5.fc32\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"2:podman / crun\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-03-24T15:17:37", "description": "The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0531 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables. (CVE-2020-14370)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-02-20T00:00:00", "type": "nessus", "title": "Oracle Linux 8 : container-tools:ol8 (ELSA-2021-0531)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2020-14370"], "modified": "2023-03-23T00:00:00", "cpe": ["cpe:/o:oracle:linux:8", "p-cpe:/a:oracle:linux:buildah", "p-cpe:/a:oracle:linux:buildah-tests", "p-cpe:/a:oracle:linux:cockpit-podman", "p-cpe:/a:oracle:linux:conmon", "p-cpe:/a:oracle:linux:container-selinux", "p-cpe:/a:oracle:linux:containernetworking-plugins", "p-cpe:/a:oracle:linux:containers-common", "p-cpe:/a:oracle:linux:crit", "p-cpe:/a:oracle:linux:criu", "p-cpe:/a:oracle:linux:crun", "p-cpe:/a:oracle:linux:fuse-overlayfs", "p-cpe:/a:oracle:linux:libslirp", "p-cpe:/a:oracle:linux:libslirp-devel", "p-cpe:/a:oracle:linux:oci-seccomp-bpf-hook", "p-cpe:/a:oracle:linux:podman", "p-cpe:/a:oracle:linux:podman-catatonit", "p-cpe:/a:oracle:linux:podman-docker", "p-cpe:/a:oracle:linux:podman-plugins", "p-cpe:/a:oracle:linux:podman-remote", "p-cpe:/a:oracle:linux:podman-tests", "p-cpe:/a:oracle:linux:python-podman-api", "p-cpe:/a:oracle:linux:python3-criu", "p-cpe:/a:oracle:linux:runc", "p-cpe:/a:oracle:linux:skopeo", "p-cpe:/a:oracle:linux:skopeo-tests", "p-cpe:/a:oracle:linux:slirp4netns", "p-cpe:/a:oracle:linux:udica"], "id": "ORACLELINUX_ELSA-2021-0531.NASL", "href": "https://www.tenable.com/plugins/nessus/146640", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Oracle Linux Security Advisory ELSA-2021-0531.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146640);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/03/23\");\n\n script_cve_id(\"CVE-2020-14370\");\n\n script_name(english:\"Oracle Linux 8 : container-tools:ol8 (ELSA-2021-0531)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Oracle Linux host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the\nELSA-2021-0531 advisory.\n\n - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When\n using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in\n a short duration, the environment variables from the first container will get leaked into subsequent\n containers. An attacker who has control over the subsequent containers could use this flaw to gain access\n to sensitive information stored in such variables. (CVE-2020-14370)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://linux.oracle.com/errata/ELSA-2021-0531.html\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-14370\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2020/09/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:crun\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libslirp\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:libslirp-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:oci-seccomp-bpf-hook\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-catatonit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python-podman-api\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:udica\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/local_checks_enabled\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, 'Oracle Linux');\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');\nos_ver = os_ver[1];\nif (! preg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);\n\nmodule_ver = get_kb_item('Host/RedHat/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');\nif ('ol8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nappstreams = {\n 'container-tools:ol8': [\n {'reference':'buildah-1.16.7-4.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-1.16.7-4.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.16.7-4.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.16.7-4.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-27.1-3.module+el8.3.1+9659+c1901784', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'conmon-2.0.22-3.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'conmon-2.0.22-3.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.155.0-1.module+el8.3.1+9659+c1901784', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.9.0-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containernetworking-plugins-0.9.0-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'containers-common-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crit-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-0.16-2.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'crun-0.16-2.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.3.0-2.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-1.3.0-2.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.3.1-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-4.3.1-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.3.1-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'libslirp-devel-4.3.1-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'oci-seccomp-bpf-hook-1.2.0-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-catatonit-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-plugins-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-2.2.1-7.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.3.1+9659+c1901784', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.15-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-70.rc92.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'rc_precedence':TRUE},\n {'reference':'runc-1.0.0-70.rc92.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'rc_precedence':TRUE},\n {'reference':'skopeo-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-1.2.0-9.0.1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-1.1.8-1.module+el8.3.1+9659+c1901784', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'slirp4netns-1.1.8-1.module+el8.3.1+9659+c1901784', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.4-1.module+el8.3.1+9659+c1901784', 'release':'8', 'rpm_spec_vers_cmp':TRUE}\n ]\n};\n\nflag = 0;\nappstreams_found = 0;\nforeach module (keys(appstreams)) {\n appstream = NULL;\n appstream_name = NULL;\n appstream_version = NULL;\n appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach package_array ( appstreams[module] ) {\n reference = NULL;\n release = NULL;\n sp = NULL;\n cpu = NULL;\n el_string = NULL;\n rpm_spec_vers_cmp = NULL;\n epoch = NULL;\n allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = 'EL' + package_array['release'];\n if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['rc_precedence'])) rc_precedence = package_array['rc_precedence'];\n if (reference && release) {\n if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, rc_precedence:rc_precedence)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / etc');\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}}, {"lastseen": "2023-01-11T14:59:21", "description": "The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1525-1 advisory.\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-12-05T00:00:00", "type": "nessus", "title": "openSUSE 15 Security Update : singularity (openSUSE-SU-2021:1525-1)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41190"], "modified": "2021-12-05T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:singularity", "cpe:/o:novell:opensuse:15.3"], "id": "OPENSUSE-2021-1525.NASL", "href": "https://www.tenable.com/plugins/nessus/155860", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The package checks in this plugin were extracted from\n# openSUSE Security Update openSUSE-SU-2021:1525-1. The text itself\n# is copyright (C) SUSE.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155860);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/12/05\");\n\n script_cve_id(\"CVE-2021-41190\");\n\n script_name(english:\"openSUSE 15 Security Update : singularity (openSUSE-SU-2021:1525-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the\nopenSUSE-SU-2021:1525-1 advisory.\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/1193273\");\n # https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L3AGIEOXZIUUEYYMWKJCJCQI7V235UTR/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?6b7d2cab\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected singularity package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41190\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/12/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/12/05\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:singularity\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.3\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude('audit.inc');\ninclude('global_settings.inc');\ninclude('misc_func.inc');\ninclude('rpm.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar release = get_kb_item('Host/SuSE/release');\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, 'openSUSE');\nvar os_ver = pregmatch(pattern: \"^SUSE([\\d.]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');\nos_ver = os_ver[1];\nif (release !~ \"^(SUSE15\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '15.3', release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + os_ver, cpu);\n\nvar pkgs = [\n {'reference':'singularity-3.8.5-bp153.2.10.1', 'release':'SUSE15.3', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var cpu = NULL;\n var rpm_spec_vers_cmp = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'singularity');\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}, {"lastseen": "2023-01-11T14:57:37", "description": "The version of containerd installed on the remote host is prior to 1.4.6-7.11. The version of docker installed on the remote host is prior to 20.10.7-5.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1551 advisory.\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests? and layers? fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content- Type header and reject an ambiguous document that contains both manifests? and layers? fields or manifests? and config? fields if they are unable to update to version 1.0.1 of the spec.\n (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-11-18T00:00:00", "type": "nessus", "title": "Amazon Linux AMI : containerd, docker (ALAS-2021-1551)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41190"], "modified": "2021-11-23T00:00:00", "cpe": ["p-cpe:/a:amazon:linux:containerd", "p-cpe:/a:amazon:linux:containerd-debuginfo", "p-cpe:/a:amazon:linux:containerd-stress", "p-cpe:/a:amazon:linux:docker", "p-cpe:/a:amazon:linux:docker-debuginfo", "cpe:/o:amazon:linux"], "id": "ALA_ALAS-2021-1551.NASL", "href": "https://www.tenable.com/plugins/nessus/155607", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2021-1551.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155607);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/11/23\");\n\n script_cve_id(\"CVE-2021-41190\");\n script_xref(name:\"ALAS\", value:\"2021-1551\");\n\n script_name(english:\"Amazon Linux AMI : containerd, docker (ALAS-2021-1551)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Amazon Linux AMI host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of containerd installed on the remote host is prior to 1.4.6-7.11. The version of docker installed on the\nremote host is prior to 20.10.7-5.76. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1551\nadvisory.\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests? and layers? fields could be interpreted as either a manifest or an index in the\n absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the\n same digest, a client may interpret the resulting content differently. The OCI Distribution Specification\n has been updated to require that a mediaType value present in a manifest or index match the Content-Type\n header used during the push and pull operations. Clients pulling from a registry may distrust the Content-\n Type header and reject an ambiguous document that contains both manifests? and layers? fields or\n manifests? and config? fields if they are unable to update to version 1.0.1 of the spec.\n (CVE-2021-41190)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://alas.aws.amazon.com/ALAS-2021-1551.html\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-41190\");\n script_set_attribute(attribute:\"solution\", value:\n\"Run 'yum update containerd' to update your system.\n Run 'yum update docker' to update your system.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41190\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/11/18\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:containerd\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:containerd-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:containerd-stress\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:docker-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar release = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nvar os_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nvar os_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar pkgs = [\n {'reference':'containerd-1.4.6-7.11.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containerd-debuginfo-1.4.6-7.11.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containerd-stress-1.4.6-7.11.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'docker-20.10.7-5.76.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'docker-debuginfo-20.10.7-5.76.amzn1', 'cpu':'x86_64', 'release':'ALA', 'rpm_spec_vers_cmp':TRUE}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var reference = NULL;\n var release = NULL;\n var cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var allowmaj = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) release = package_array['release'];\n if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (reference && release) {\n if (rpm_check(release:release, cpu:cpu, reference:reference, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"containerd / containerd-debuginfo / containerd-stress / etc\");\n}", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}, {"lastseen": "2023-01-10T19:37:08", "description": "According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both manifests and layers fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both manifests and layers fields or manifests and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.0, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2022-11-04T00:00:00", "type": "nessus", "title": "EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2022-2706)", "bulletinFamily": "scanner", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41190"], "modified": "2022-11-04T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:docker-engine", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2022-2706.NASL", "href": "https://www.tenable.com/plugins/nessus/166974", "sourceData": "#%NASL_MIN_LEVEL 80900\n##\n# (C) Tenable, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(166974);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/11/04\");\n\n script_cve_id(\"CVE-2021-41190\");\n\n script_name(english:\"EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2022-2706)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is\naffected by the following vulnerabilities :\n\n - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution\n of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone\n was used to determine the type of document during push and pull operations. Documents that contain both\n manifests and layers fields could be interpreted as either a manifest or an index in the absence of an\n accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a\n client may interpret the resulting content differently. The OCI Distribution Specification has been\n updated to require that a mediaType value present in a manifest or index match the Content-Type header\n used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type\n header and reject an ambiguous document that contains both manifests and layers fields or manifests\n and config fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the EulerOS security\nadvisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional\nissues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2022-2706\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?814fe49f\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected docker-engine packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-41190\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/17\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2022/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2022/11/04\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:docker-engine\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nvar _release = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(_release) || _release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nvar uvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (_release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nvar sp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(5)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\");\n\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP5\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nvar flag = 0;\n\nvar pkgs = [\n \"docker-engine-18.09.0.101-1.h55.23.12.eulerosv2r7\"\n];\n\nforeach (var pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"5\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"docker-engine\");\n}\n", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N"}}, {"lastseen": "2023-01-24T14:55:15", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4221 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-11-11T00:00:00", "type": "nessus", "title": "RHEL 8 : container-tools:2.0 (RHSA-2021:4221)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 1.9, "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-3602"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:buildah", "p-cpe:/a:redhat:enterprise_linux:buildah-tests", "p-cpe:/a:redhat:enterprise_linux:cockpit-podman", "p-cpe:/a:redhat:enterprise_linux:conmon", "p-cpe:/a:redhat:enterprise_linux:container-selinux", "p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins", "p-cpe:/a:redhat:enterprise_linux:containers-common", "p-cpe:/a:redhat:enterprise_linux:crit", "p-cpe:/a:redhat:enterprise_linux:criu", "p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs", "p-cpe:/a:redhat:enterprise_linux:podman", "p-cpe:/a:redhat:enterprise_linux:podman-docker", "p-cpe:/a:redhat:enterprise_linux:podman-remote", "p-cpe:/a:redhat:enterprise_linux:podman-tests", "p-cpe:/a:redhat:enterprise_linux:python-podman-api", "p-cpe:/a:redhat:enterprise_linux:python3-criu", "p-cpe:/a:redhat:enterprise_linux:runc", "p-cpe:/a:redhat:enterprise_linux:skopeo", "p-cpe:/a:redhat:enterprise_linux:skopeo-tests", "p-cpe:/a:redhat:enterprise_linux:slirp4netns", "p-cpe:/a:redhat:enterprise_linux:toolbox", "p-cpe:/a:redhat:enterprise_linux:udica"], "id": "REDHAT-RHSA-2021-4221.NASL", "href": "https://www.tenable.com/plugins/nessus/155181", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:4221. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155181);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2021-3602\");\n script_xref(name:\"RHSA\", value:\"2021:4221\");\n\n script_name(english:\"RHEL 8 : container-tools:2.0 (RHSA-2021:4221)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in\nthe RHSA-2021:4221 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:4221\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1969264\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(200);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/11/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_aus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_e4s:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_eus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:rhel_tus:8.6\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:buildah-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:cockpit-podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:conmon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:container-selinux\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:containers-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:crit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-docker\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-remote\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:podman-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python-podman-api\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:python3-criu\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:runc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:skopeo-tests\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:slirp4netns\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:toolbox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:udica\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"redhat_repos.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude('rpm.inc');\ninclude('rhel.inc');\n\nif (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/RedHat/release');\nif (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');\nvar os_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:os_release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');\nos_ver = os_ver[1];\nif (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '8')) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);\n\nif (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);\n\nvar appstreams = {\n 'container-tools:2.0': [\n {\n 'repo_relative_urls': [\n 'content/aus/rhel8/8.6/x86_64/appstream/debug',\n 'content/aus/rhel8/8.6/x86_64/appstream/os',\n 'content/aus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/aus/rhel8/8.6/x86_64/baseos/debug',\n 'content/aus/rhel8/8.6/x86_64/baseos/os',\n 'content/aus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/debug',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/os',\n 'content/e4s/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/debug',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/os',\n 'content/e4s/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/os',\n 'content/e4s/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/ppc64le/sap/debug',\n 'content/e4s/rhel8/8.6/ppc64le/sap/os',\n 'content/e4s/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/appstream/debug',\n 'content/e4s/rhel8/8.6/x86_64/appstream/os',\n 'content/e4s/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/baseos/debug',\n 'content/e4s/rhel8/8.6/x86_64/baseos/os',\n 'content/e4s/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/debug',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/os',\n 'content/e4s/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/e4s/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/e4s/rhel8/8.6/x86_64/sap/debug',\n 'content/e4s/rhel8/8.6/x86_64/sap/os',\n 'content/e4s/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/appstream/debug',\n 'content/eus/rhel8/8.6/aarch64/appstream/os',\n 'content/eus/rhel8/8.6/aarch64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/baseos/debug',\n 'content/eus/rhel8/8.6/aarch64/baseos/os',\n 'content/eus/rhel8/8.6/aarch64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/os',\n 'content/eus/rhel8/8.6/aarch64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/highavailability/debug',\n 'content/eus/rhel8/8.6/aarch64/highavailability/os',\n 'content/eus/rhel8/8.6/aarch64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/aarch64/supplementary/debug',\n 'content/eus/rhel8/8.6/aarch64/supplementary/os',\n 'content/eus/rhel8/8.6/aarch64/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/appstream/debug',\n 'content/eus/rhel8/8.6/ppc64le/appstream/os',\n 'content/eus/rhel8/8.6/ppc64le/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/baseos/debug',\n 'content/eus/rhel8/8.6/ppc64le/baseos/os',\n 'content/eus/rhel8/8.6/ppc64le/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/debug',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/os',\n 'content/eus/rhel8/8.6/ppc64le/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/debug',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/os',\n 'content/eus/rhel8/8.6/ppc64le/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/debug',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/os',\n 'content/eus/rhel8/8.6/ppc64le/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/os',\n 'content/eus/rhel8/8.6/ppc64le/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/sap/debug',\n 'content/eus/rhel8/8.6/ppc64le/sap/os',\n 'content/eus/rhel8/8.6/ppc64le/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/debug',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/os',\n 'content/eus/rhel8/8.6/ppc64le/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/appstream/debug',\n 'content/eus/rhel8/8.6/s390x/appstream/os',\n 'content/eus/rhel8/8.6/s390x/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/baseos/debug',\n 'content/eus/rhel8/8.6/s390x/baseos/os',\n 'content/eus/rhel8/8.6/s390x/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/debug',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/os',\n 'content/eus/rhel8/8.6/s390x/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/highavailability/debug',\n 'content/eus/rhel8/8.6/s390x/highavailability/os',\n 'content/eus/rhel8/8.6/s390x/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/debug',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/os',\n 'content/eus/rhel8/8.6/s390x/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/sap/debug',\n 'content/eus/rhel8/8.6/s390x/sap/os',\n 'content/eus/rhel8/8.6/s390x/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/s390x/supplementary/debug',\n 'content/eus/rhel8/8.6/s390x/supplementary/os',\n 'content/eus/rhel8/8.6/s390x/supplementary/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/appstream/debug',\n 'content/eus/rhel8/8.6/x86_64/appstream/os',\n 'content/eus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/baseos/debug',\n 'content/eus/rhel8/8.6/x86_64/baseos/os',\n 'content/eus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/debug',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/os',\n 'content/eus/rhel8/8.6/x86_64/codeready-builder/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/eus/rhel8/8.6/x86_64/highavailability/os',\n 'content/eus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/debug',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/os',\n 'content/eus/rhel8/8.6/x86_64/resilientstorage/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/debug',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/os',\n 'content/eus/rhel8/8.6/x86_64/sap-solutions/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/sap/debug',\n 'content/eus/rhel8/8.6/x86_64/sap/os',\n 'content/eus/rhel8/8.6/x86_64/sap/source/SRPMS',\n 'content/eus/rhel8/8.6/x86_64/supplementary/debug',\n 'content/eus/rhel8/8.6/x86_64/supplementary/os',\n 'content/eus/rhel8/8.6/x86_64/supplementary/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/appstream/debug',\n 'content/tus/rhel8/8.6/x86_64/appstream/os',\n 'content/tus/rhel8/8.6/x86_64/appstream/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/baseos/debug',\n 'content/tus/rhel8/8.6/x86_64/baseos/os',\n 'content/tus/rhel8/8.6/x86_64/baseos/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/highavailability/debug',\n 'content/tus/rhel8/8.6/x86_64/highavailability/os',\n 'content/tus/rhel8/8.6/x86_64/highavailability/source/SRPMS',\n 'content/tus/rhel8/8.6/x86_64/rt/os',\n 'content/tus/rhel8/8.6/x86_64/rt/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.11.6-9.module+el8.5.0+12239+ec01067b', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.11.6-9.module+el8.5.0+12239+ec01067b', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-11-1.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.15-1.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.130.0-1.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.8.3-4.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-0.1.41-4.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.12-9.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.12-9.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-0.7.8-1.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-1.6.4-26.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-1.6.4-26.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-1.6.4-26.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-1.6.4-26.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.12-9.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-66.rc10.module+el8.5.0+11041+627a5cdc', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-0.1.41-4.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-0.1.41-4.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.7-1.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.1-2.module+el8.5.0+10223+f7559c42', 'sp':'6', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE}\n ]\n },\n {\n 'repo_relative_urls': [\n 'content/dist/rhel8/8/aarch64/appstream/debug',\n 'content/dist/rhel8/8/aarch64/appstream/os',\n 'content/dist/rhel8/8/aarch64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/baseos/debug',\n 'content/dist/rhel8/8/aarch64/baseos/os',\n 'content/dist/rhel8/8/aarch64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/codeready-builder/debug',\n 'content/dist/rhel8/8/aarch64/codeready-builder/os',\n 'content/dist/rhel8/8/aarch64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/highavailability/debug',\n 'content/dist/rhel8/8/aarch64/highavailability/os',\n 'content/dist/rhel8/8/aarch64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/aarch64/supplementary/debug',\n 'content/dist/rhel8/8/aarch64/supplementary/os',\n 'content/dist/rhel8/8/aarch64/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/appstream/debug',\n 'content/dist/rhel8/8/ppc64le/appstream/os',\n 'content/dist/rhel8/8/ppc64le/appstream/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/baseos/debug',\n 'content/dist/rhel8/8/ppc64le/baseos/os',\n 'content/dist/rhel8/8/ppc64le/baseos/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/debug',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/os',\n 'content/dist/rhel8/8/ppc64le/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/highavailability/debug',\n 'content/dist/rhel8/8/ppc64le/highavailability/os',\n 'content/dist/rhel8/8/ppc64le/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/debug',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/os',\n 'content/dist/rhel8/8/ppc64le/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/debug',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/os',\n 'content/dist/rhel8/8/ppc64le/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/sap/debug',\n 'content/dist/rhel8/8/ppc64le/sap/os',\n 'content/dist/rhel8/8/ppc64le/sap/source/SRPMS',\n 'content/dist/rhel8/8/ppc64le/supplementary/debug',\n 'content/dist/rhel8/8/ppc64le/supplementary/os',\n 'content/dist/rhel8/8/ppc64le/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/s390x/appstream/debug',\n 'content/dist/rhel8/8/s390x/appstream/os',\n 'content/dist/rhel8/8/s390x/appstream/source/SRPMS',\n 'content/dist/rhel8/8/s390x/baseos/debug',\n 'content/dist/rhel8/8/s390x/baseos/os',\n 'content/dist/rhel8/8/s390x/baseos/source/SRPMS',\n 'content/dist/rhel8/8/s390x/codeready-builder/debug',\n 'content/dist/rhel8/8/s390x/codeready-builder/os',\n 'content/dist/rhel8/8/s390x/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/s390x/highavailability/debug',\n 'content/dist/rhel8/8/s390x/highavailability/os',\n 'content/dist/rhel8/8/s390x/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/s390x/resilientstorage/debug',\n 'content/dist/rhel8/8/s390x/resilientstorage/os',\n 'content/dist/rhel8/8/s390x/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/s390x/sap/debug',\n 'content/dist/rhel8/8/s390x/sap/os',\n 'content/dist/rhel8/8/s390x/sap/source/SRPMS',\n 'content/dist/rhel8/8/s390x/supplementary/debug',\n 'content/dist/rhel8/8/s390x/supplementary/os',\n 'content/dist/rhel8/8/s390x/supplementary/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/appstream/debug',\n 'content/dist/rhel8/8/x86_64/appstream/os',\n 'content/dist/rhel8/8/x86_64/appstream/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/baseos/debug',\n 'content/dist/rhel8/8/x86_64/baseos/os',\n 'content/dist/rhel8/8/x86_64/baseos/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/codeready-builder/debug',\n 'content/dist/rhel8/8/x86_64/codeready-builder/os',\n 'content/dist/rhel8/8/x86_64/codeready-builder/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/highavailability/debug',\n 'content/dist/rhel8/8/x86_64/highavailability/os',\n 'content/dist/rhel8/8/x86_64/highavailability/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/nfv/debug',\n 'content/dist/rhel8/8/x86_64/nfv/os',\n 'content/dist/rhel8/8/x86_64/nfv/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/resilientstorage/debug',\n 'content/dist/rhel8/8/x86_64/resilientstorage/os',\n 'content/dist/rhel8/8/x86_64/resilientstorage/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/rt/debug',\n 'content/dist/rhel8/8/x86_64/rt/os',\n 'content/dist/rhel8/8/x86_64/rt/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap-solutions/debug',\n 'content/dist/rhel8/8/x86_64/sap-solutions/os',\n 'content/dist/rhel8/8/x86_64/sap-solutions/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/sap/debug',\n 'content/dist/rhel8/8/x86_64/sap/os',\n 'content/dist/rhel8/8/x86_64/sap/source/SRPMS',\n 'content/dist/rhel8/8/x86_64/supplementary/debug',\n 'content/dist/rhel8/8/x86_64/supplementary/os',\n 'content/dist/rhel8/8/x86_64/supplementary/source/SRPMS'\n ],\n 'pkgs': [\n {'reference':'buildah-1.11.6-9.module+el8.5.0+12239+ec01067b', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'buildah-tests-1.11.6-9.module+el8.5.0+12239+ec01067b', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'cockpit-podman-11-1.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},\n {'reference':'conmon-2.0.15-1.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'container-selinux-2.130.0-1.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},\n {'reference':'containernetworking-plugins-0.8.3-4.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'containers-common-0.1.41-4.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'crit-3.12-9.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'criu-3.12-9.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'fuse-overlayfs-0.7.8-1.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-1.6.4-26.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-docker-1.6.4-26.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-remote-1.6.4-26.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'podman-tests-1.6.4-26.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'python3-criu-3.12-9.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'runc-1.0.0-66.rc10.module+el8.5.0+11041+627a5cdc', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'skopeo-0.1.41-4.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'skopeo-tests-0.1.41-4.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},\n {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'toolbox-0.0.7-1.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE},\n {'reference':'udica-0.2.1-2.module+el8.5.0+10223+f7559c42', 'release':'8', 'el_string':'el8.5.0', 'rpm_spec_vers_cmp':TRUE}\n ]\n }\n ]\n};\n\nvar applicable_repo_urls = rhel_determine_applicable_repository_urls(constraints:appstreams, appstreams:TRUE);\nif(applicable_repo_urls == RHEL_REPOS_NO_OVERLAP_MESSAGE) exit(0, RHEL_REPO_NOT_ENABLED);\n\nvar module_ver = get_kb_item('Host/RedHat/appstream/container-tools');\nif (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:2.0');\nif ('2.0' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);\n\nvar flag = 0;\nvar appstreams_found = 0;\nforeach var module (keys(appstreams)) {\n var appstream = NULL;\n var appstream_name = NULL;\n var appstream_version = NULL;\n var appstream_split = split(module, sep:':', keep:FALSE);\n if (!empty_or_null(appstream_split)) {\n appstream_name = appstream_split[0];\n appstream_version = appstream_split[1];\n if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);\n }\n if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {\n appstreams_found++;\n foreach var module_array ( appstreams[module] ) {\n var repo_relative_urls = NULL;\n if (!empty_or_null(module_array['repo_relative_urls'])) repo_relative_urls = module_array['repo_relative_urls'];\n var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);\n foreach var package_array ( module_array['pkgs'] ) {\n var reference = NULL;\n var _release = NULL;\n var sp = NULL;\n var _cpu = NULL;\n var el_string = NULL;\n var rpm_spec_vers_cmp = NULL;\n var epoch = NULL;\n var allowmaj = NULL;\n var exists_check = NULL;\n if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];\n if (!empty_or_null(package_array['release'])) _release = 'RHEL' + package_array['release'];\n if (!empty_or_null(package_array['sp']) && !enterprise_linux_flag) sp = package_array['sp'];\n if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];\n if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];\n if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];\n if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];\n if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];\n if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];\n if (reference &&\n _release &&\n rhel_decide_repo_relative_url_check(required_repo_url_list:repo_relative_urls) &&\n (applicable_repo_urls || (!exists_check || rpm_exists(release:_release, rpm:exists_check))) &&\n rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;\n }\n }\n }\n}\n\nif (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:2.0');\n\nif (flag)\n{\n var extra = NULL;\n if (empty_or_null(applicable_repo_urls)) extra = rpm_report_get() + redhat_report_repo_caveat();\n else extra = rpm_report_get();\n security_report_v4(\n port : 0,\n severity : SECURITY_NOTE,\n extra : extra\n );\n exit(0);\n}\nelse\n{\n var tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-tests / cockpit-podman / conmon / container-selinux / etc');\n}\n", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-01-24T14:55:47", "description": "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4222 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-11-11T00:00:00", "type": "nessus", "title": "RHEL 8 : container-tools:3.0 (RHSA-2021:4222)", "bulletinFamily": "scanner", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 1.9, "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-3602"], "modified": "2023-01-23T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:8", "cpe:/o:redhat:rhel_aus:8.6", "cpe:/o:redhat:rhel_e4s:8.6", "cpe:/o:redhat:rhel_eus:8.6", "cpe:/o:redhat:rhel_tus:8.6", "p-cpe:/a:redhat:enterprise_linux:buildah", "p-cpe:/a:redhat:enterprise_linux:buildah-tests", "p-cpe:/a:redhat:enterprise_linux:cockpit-podman", "p-cpe:/a:redhat:enterprise_linux:conmon", "p-cpe:/a:redhat:enterprise_linux:container-selinux", "p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins", "p-cpe:/a:redhat:enterprise_linux:containers-common", "p-cpe:/a:redhat:enterprise_linux:crit", "p-cpe:/a:redhat:enterprise_linux:criu", "p-cpe:/a:redhat:enterprise_linux:crun", "p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs", "p-cpe:/a:redhat:enterprise_linux:libslirp", "p-cpe:/a:redhat:enterprise_linux:libslirp-devel", "p-cpe:/a:redhat:enterprise_linux:oci-seccomp-bpf-hook", "p-cpe:/a:redhat:enterprise_linux:podman", "p-cpe:/a:redhat:enterprise_linux:podman-catatonit", "p-cpe:/a:redhat:enterprise_linux:podman-docker", "p-cpe:/a:redhat:enterprise_linux:podman-plugins", "p-cpe:/a:redhat:enterprise_linux:podman-remote", "p-cpe:/a:redhat:enterprise_linux:podman-tests", "p-cpe:/a:redhat:enterprise_linux:python3-criu", "p-cpe:/a:redhat:enterprise_linux:runc", "p-cpe:/a:redhat:enterprise_linux:skopeo", "p-cpe:/a:redhat:enterprise_linux:skopeo-tests", "p-cpe:/a:redhat:enterprise_linux:slirp4netns", "p-cpe:/a:redhat:enterprise_linux:toolbox", "p-cpe:/a:redhat:enterprise_linux:toolbox-tests", "p-cpe:/a:redhat:enterprise_linux:udica"], "id": "REDHAT-RHSA-2021-4222.NASL", "href": "https://www.tenable.com/plugins/nessus/155144", "sourceData": "#%NASL_MIN_LEVEL 70300\n##\n# (C) Tenable, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2021:4222. The text\n# itself is copyright (C) Red Hat, Inc.\n##\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(155144);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/23\");\n\n script_cve_id(\"CVE-2021-3602\");\n script_xref(name:\"RHSA\", value:\"2021:4222\");\n\n script_name(english:\"RHEL 8 : container-tools:3.0 (RHSA-2021:4222)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Red Hat host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in\nthe RHSA-2021:4222 advisory.\n\n - buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version\nnumber.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/security/cve/CVE-2021-3602\");\n script_set_attribute(attribute:\"see_also\", value:\"https://access.redhat.com/errata/RHSA-2021:4222\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.redhat.com/1969264\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-3602\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(200);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/11/09\");\n script_set_attribute(attribute:\"patch_publication