In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03545-1 advisory.

    Note this update contains a already fixed references mostly.

    - Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. bsc#1250596

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Update to Go 1.23 for building now that upstream has switched their 23.0.x       LTSS to use Go 1.23.

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the telegraf package has been released.

An update of the kapacitor package has been released.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4827 advisory.

    docker-engine     [19.03.1-1.0.0]
    - update to 19.03.1

    [19.03-0.0.1]
    - update to 19.03

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top :

  - Remove fuse-overlayfs because it's (currently) an     unsatisfied dependency on SLE (bsc#1143386)

  - Update libpod.conf to use correct infra_command

  - Update libpod.conf to use better versioned pause     container

  - Update libpod.conf to use official kubic pause container

  - Update libpod.conf to match latest features set:
    detach_keys, lock_type, runtime_supports_json

  - Add podman-remote varlink client

Version update podman to v1.4.4 :

  - Features

  - Podman now has greatly improved support for containers     using multiple OCI runtimes. Containers now remember if     they were created with a different runtime using
    --runtime and will always use that runtime

  - The cached and delegated options for volume mounts are     now allowed for Docker compatability (#3340)

  - The podman diff command now supports the --latest flag

  - Bugfixes

  - Fixed a bug where rootless Podman would attempt to use     the entire root configuration if no rootless     configuration was present for the user, breaking     rootless Podman for new installations

  - Fixed a bug where rootless Podman's pause process would     block SIGTERM, preventing graceful system shutdown and     hanging until the system's init send SIGKILL

  - Fixed a bug where running Podman as root with sudo -E     would not work after running rootless Podman at least     once

  - Fixed a bug where options for tmpfs volumes added with     the --tmpfs flag were being ignored

  - Fixed a bug where images with no layers could not     properly be displayed and removed by Podman

  - Fixed a bug where locks were not properly freed on     failure to create a container or pod

  - Fixed a bug where podman cp on a single file would     create a directory at the target and place the file in     it (#3384)

  - Fixed a bug where podman inspect --format '((.Mounts))'     would print a hexadecimal address instead of a     container's mounts

  - Fixed a bug where rootless Podman would not add an entry     to container's /etc/hosts files for their own hostname     (#3405)

  - Fixed a bug where podman ps --sync would segfault     (#3411)

  - Fixed a bug where podman generate kube would produce an     invalid ports configuration (#3408)

  - Misc

  - Updated containers/storage to v1.12.13

  - Podman now performs much better on systems with heavy     I/O load

  - The --cgroup-manager flag to podman now shows the     correct default setting in help if the default was     overridden by libpod.conf

  - For backwards compatability, setting
    --log-driver=json-file in podman run is now supported as     an alias for --log-driver=k8s-file. This is considered     deprecated, and json-file will be moved to a new     implementation in the future     ([#3363](https://github.com/containers/libpo\     d/issues/3363))

  - Podman's default libpod.conf file now allows the crun     OCI runtime to be used if it is installed

Update podman to v1.4.2 :

  - Fixed a bug where Podman could not run containers using     an older version of Systemd as init

  - Updated vendored Buildah to v1.9.0 to resolve a critical     bug with Dockerfile RUN instructions

  - The error message for running podman kill on containers     that are not running has been improved

  - Podman remote client can now log to a file if syslog is     not available

  - The podman exec command now sets its error code     differently based on whether the container does not     exist, and the command in the container does not exist

  - The podman inspect command on containers now outputs     Mounts JSON that matches that of docker inspect, only     including user-specified volumes and differentiating     bind mounts and named volumes

  - The podman inspect command now reports the path to a     container's OCI spec with the OCIConfigPath key (only     included when the container is initialized or running)

  - The podman run --mount command now supports the     bind-nonrecursive option for bind mounts

  - Fixed a bug where podman play kube would fail to create     containers due to an unspecified log driver

  - Fixed a bug where Podman would fail to build with musl     libc

  - Fixed a bug where rootless Podman using slirp4netns     networking in an environment with no nameservers on the     host other than localhost would result in nonfunctional     networking

  - Fixed a bug where podman import would not properly set     environment variables, discarding their values and     retaining only keys

  - Fixed a bug where Podman would fail to run when built     with Apparmor support but run on systems without the     Apparmor kernel module loaded

  - Remote Podman will now default the username it uses to     log in to remote systems to the username of the current     user

  - Podman now uses JSON logging with OCI runtimes that     support it, allowing for better error reporting

  - Updated vendored containers/image to v2.0

  - Update conmon to v0.3.0

  - Support OOM Monitor under cgroup V2

  - Add config binary and make target for configuring conmon     with a go library for importing values

Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460) 

  - Podman checkpoint and podman restore commands can now be     used to migrate containers between Podman installations     on different systems.

  - The podman cp now supports pause flag.

  - The remote client now supports a configuration file for     pre-configuring connections to remote Podman     installations

  - CVE-2019-10152: Fixed an iproper dereference of symlinks     of the the podman cp command which introduced in version     1.1.0 (bsc#1136974).

  - Fixed a bug where podman commit could improperly set     environment variables that contained = characters

  - Fixed a bug where rootless podman would sometimes fail     to start containers with forwarded ports

  - Fixed a bug where podman version on the remote client     could segfault

  - Fixed a bug where podman container runlabel would use     /proc/self/exe instead of the path of the Podman command     when printing the command being executed

  - Fixed a bug where filtering images by label did not work

  - Fixed a bug where specifying a bing mount or tmpfs mount     over an image volume would cause a container to be     unable to start

  - Fixed a bug where podman generate kube did not work with     containers with named volumes

  - Fixed a bug where rootless podman would receive     permission denied errors accessing conmon.pid

  - Fixed a bug where podman cp with a folder specified as     target would replace the folder, as opposed to copying     into it

  - Fixed a bug where rootless Podman commands could     double-unlock a lock, causing a crash

  - Fixed a bug where podman incorrectly set tmpcopyup on     /dev/ mounts, causing errors when using the Kata     containers runtime

  - Fixed a bug where podman exec would fail on older     kernels

  - Podman commit command is now usable with the Podman     remote client

  - Signature-policy flag has been deprecated

  - Updated vendored containers/storage and containers/image     libraries with numerous bugfixes

  - Updated vendored Buildah to v1.8.3

  - Podman now requires Conmon v0.2.0

  - The podman cp command is now aliased as podman container     cp

  - Rootless podman will now default init_path using root     Podman's configuration files     (/etc/containers/libpod.conf and     /usr/share/containers/libpod.conf) if not overridden in     the rootless configuration

  - Added fuse-overlayfs dependency to support overlay based     rootless image manipulations

  - The podman cp command can now read input redirected to     STDIN, and output to STDOUT instead of a file, using -     instead of an argument.

  - The podman remote client now displays version     information from both the client and server in podman     version

  - The podman unshare command has been added, allowing easy     entry into the user namespace set up by rootless Podman     (allowing the removal of files created by rootless     podman, among other things)

  - Fixed a bug where Podman containers with the --rm flag     were removing created volumes when they were     automatically removed

  - Fixed a bug where container and pod locks were     incorrectly marked as released after a system reboot,     causing errors on container and pod removal

  - Fixed a bug where Podman pods could not be removed if     any container in the pod encountered an error during     removal

  - Fixed a bug where Podman pods run with the cgroupfs     CGroup driver would encounter a race condition during     removal, potentially failing to remove the pod CGroup

  - Fixed a bug where the podman container checkpoint and     podman container restore commands were not visible in     the remote client

  - Fixed a bug where podman remote ps --ns would not print     the container's namespaces

  - Fixed a bug where removing stopped containers with     healthchecks could cause an error

  - Fixed a bug where the default libpod.conf file was     causing parsing errors

  - Fixed a bug where pod locks were not being freed when     pods were removed, potentially leading to lock     exhaustion

  - Fixed a bug where 'podman run' with SD_NOTIFY set could,     on short-running containers, create an inconsistent     state rendering the container unusable

  - The remote Podman client now uses the Varlink bridge to     establish remote connections by default

  - Fixed an issue with apparmor_parser (bsc#1123387)

  - Update to libpod v1.4.0 (bsc#1137860) :

  - The podman checkpoint and podman restore commands can     now be used to migrate containers between Podman     installations on different systems

  - The podman cp command now supports a pause flag to pause     containers while copying into them

  - The remote client now supports a configuration file for     pre-configuring connections to remote Podman     installations

  - Fixed CVE-2019-10152 - The podman cp command improperly     dereferenced symlinks in host context

  - Fixed a bug where podman commit could improperly set     environment variables that contained = characters

  - Fixed a bug where rootless Podman would sometimes fail     to start containers with forwarded ports

  - Fixed a bug where podman version on the remote client     could segfault

  - Fixed a bug where podman container runlabel would use     /proc/self/exe instead of the path of the Podman command     when printing the command being executed

  - Fixed a bug where filtering images by label did not work

  - Fixed a bug where specifying a bing mount or tmpfs mount     over an image volume would cause a container to be     unable to start

  - Fixed a bug where podman generate kube did not work with     containers with named volumes

  - Fixed a bug where rootless Podman would receive     permission denied errors accessing conmon.pid

  - Fixed a bug where podman cp with a folder specified as     target would replace the folder, as opposed to copying     into it

  - Fixed a bug where rootless Podman commands could     double-unlock a lock, causing a crash

  - Fixed a bug where Podman incorrectly set tmpcopyup on     /dev/ mounts, causing errors when using the Kata     containers runtime

  - Fixed a bug where podman exec would fail on older     kernels

  - The podman commit command is now usable with the Podman     remote client

  - The --signature-policy flag (used with several     image-related commands) has been deprecated

  - The podman unshare command now defines two environment     variables in the spawned shell: CONTAINERS_RUNROOT and     CONTAINERS_GRAPHROOT, pointing to temporary and     permanent storage for rootless containers

  - Updated vendored containers/storage and containers/image     libraries with numerous bugfixes

  - Updated vendored Buildah to v1.8.3

  - Podman now requires Conmon v0.2.0

  - The podman cp command is now aliased as podman container     cp

  - Rootless Podman will now default init_path using root     Podman's configuration files     (/etc/containers/libpod.conf and     /usr/share/containers/libpod.conf) if not overridden in     the rootless configuration

  - Update to image v1.5.1

  - Vendor in latest containers/storage

  - docker/docker_client: Drop redundant Domain(ref.ref)     call

  - pkg/blobinfocache: Split implementations into     subpackages

  - copy: progress bar: show messages on completion

  - docs: rename manpages to *.5.command

  - add container-certs.d.md manpage

  - pkg/docker/config: Bring auth tests from     docker/docker_client_test

  - Don't allocate a sync.Mutex separately

Update to storage v1.12.10 :

  - Add function to parse out mount options from graphdriver

  - Merge the disparate parts of all of the Unix-like     lockfiles

  - Fix unix-but-not-Linux compilation

  - Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set

  - Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes

  - lockfile: add RecursiveLock() API

  - Update generated files

  - Fix crash on tesing of aufs code

  - Let consumers know when Layers and Images came from     read-only stores

  - chown: do not change owner for the mountpoint

  - locks: correctly mark updates to the layers list

  - CreateContainer: don't worry about mapping layers unless     necessary

  - docs: fix manpage for containers-storage.conf

  - docs: sort configuration options alphabetically

  - docs: document OSTree file deduplication

  - Add missing options to man page for containers-storage

  - overlay: use the layer idmapping if present

  - vfs: prefer layer custom idmappings

  - layers: propagate down the idmapping settings

  - Recreate symlink when not found

  - docs: fix manpage for configuration file

  - docs: add special handling for manpages in sect 5

  - overlay: fix single-lower test

  - Recreate symlink when not found

  - overlay: propagate errors from mountProgram

  - utils: root in a userns uses global conf file

  - Fix handling of additional stores

  - Correctly check permissions on rootless directory

  - Fix possible integer overflow on 32bit builds

  - Evaluate device path for lvm

  - lockfile test: make concurrent RW test determinisitc

  - lockfile test: make concurrent read tests deterministic

  - drivers.DirCopy: fix filemode detection

  - storage: move the logic to detect rootless into utils.go

  - Don't set (struct flock).l_pid

  - Improve documentation of getLockfile

  - Rename getLockFile to createLockerForPath, and document     it

  - Add FILES section to containers-storage.5 man page

  - add digest locks

  - drivers/copy: add a non-cgo fallback

slirp4netns was updated to 0.3.0 :

  - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu()     (bsc#1123156)

This update also includes :

  - fuse3 and fuse-overlayfs to support rootless containers.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top :

Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386)

Update libpod.conf to use correct infra_command

Update libpod.conf to use better versioned pause container

Update libpod.conf to use official kubic pause container

Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json

Add podman-remote varlink client

Version update podman to v1.4.4: Features

  - Podman now has greatly improved support for containers     using multiple OCI runtimes. Containers now remember if     they were created with a different runtime using
    --runtime and will always use that runtime

  - The cached and delegated options for volume mounts are     now allowed for Docker compatability (#3340)

  - The podman diff command now supports the --latest flag     Bugfixes

  - Fixed a bug where rootless Podman would attempt to use     the entire root configuration if no rootless     configuration was present for the user, breaking     rootless Podman for new installations

  - Fixed a bug where rootless Podman's pause process would     block SIGTERM, preventing graceful system shutdown and     hanging until the system's init send SIGKILL

  - Fixed a bug where running Podman as root with sudo -E     would not work after running rootless Podman at least     once

  - Fixed a bug where options for tmpfs volumes added with     the --tmpfs flag were being ignored

  - Fixed a bug where images with no layers could not     properly be displayed and removed by Podman

  - Fixed a bug where locks were not properly freed on     failure to create a container or pod

  - Fixed a bug where podman cp on a single file would     create a directory at the target and place the file in     it (#3384)

  - Fixed a bug where podman inspect --format '{{.Mounts}}'     would print a hexadecimal address instead of a     container's mounts

  - Fixed a bug where rootless Podman would not add an entry     to container's /etc/hosts files for their own hostname     (#3405)

  - Fixed a bug where podman ps --sync would segfault     (#3411)

  - Fixed a bug where podman generate kube would produce an     invalid ports configuration (#3408) Misc

  - Updated containers/storage to v1.12.13

  - Podman now performs much better on systems with heavy     I/O load

  - The --cgroup-manager flag to podman now shows the     correct default setting in help if the default was     overridden by libpod.conf

  - For backwards compatability, setting
    --log-driver=json-file in podman run is now supported as     an alias for --log-driver=k8s-file. This is considered     deprecated, and json-file will be moved to a new     implementation in the future     ([#3363](https://github.com/containers/libpo\     d/issues/3363))

  - Podman's default libpod.conf file now allows the crun     OCI runtime to be used if it is installed

Update podman to v1.4.2: Fixed a bug where Podman could not run containers using an older version of Systemd as init

Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions

The error message for running podman kill on containers that are not running has been improved

Podman remote client can now log to a file if syslog is not available

The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist

The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes

The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running)

The podman run --mount command now supports the bind-nonrecursive option for bind mounts

Fixed a bug where podman play kube would fail to create containers due to an unspecified log driver

Fixed a bug where Podman would fail to build with musl libc

Fixed a bug where rootless Podman using slirp4netns networking in an environment with no nameservers on the host other than localhost would result in nonfunctional networking

Fixed a bug where podman import would not properly set environment variables, discarding their values and retaining only keys

Fixed a bug where Podman would fail to run when built with Apparmor support but run on systems without the Apparmor kernel module loaded

Remote Podman will now default the username it uses to log in to remote systems to the username of the current user

Podman now uses JSON logging with OCI runtimes that support it, allowing for better error reporting

Updated vendored containers/image to v2.0

Update conmon to v0.3.0

Support OOM Monitor under cgroup V2

Add config binary and make target for configuring conmon with a go library for importing values

Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460) Podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems.

The podman cp now supports pause flag.

The remote client now supports a configuration file for pre-configuring connections to remote Podman installations

CVE-2019-10152: Fixed an iproper dereference of symlinks of the the podman cp command which introduced in version 1.1.0 (bsc#1136974).

Fixed a bug where podman commit could improperly set environment variables that contained = characters

Fixed a bug where rootless podman would sometimes fail to start containers with forwarded ports

Fixed a bug where podman version on the remote client could segfault

Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed

Fixed a bug where filtering images by label did not work

Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start

Fixed a bug where podman generate kube did not work with containers with named volumes

Fixed a bug where rootless podman would receive permission denied errors accessing conmon.pid

Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it

Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash

Fixed a bug where podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime

Fixed a bug where podman exec would fail on older kernels

Podman commit command is now usable with the Podman remote client

Signature-policy flag has been deprecated

Updated vendored containers/storage and containers/image libraries with numerous bugfixes

Updated vendored Buildah to v1.8.3

Podman now requires Conmon v0.2.0

The podman cp command is now aliased as podman container cp

Rootless podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration

Added fuse-overlayfs dependency to support overlay based rootless image manipulations

The podman cp command can now read input redirected to STDIN, and output to STDOUT instead of a file, using - instead of an argument.

The podman remote client now displays version information from both the client and server in podman version

The podman unshare command has been added, allowing easy entry into the user namespace set up by rootless Podman (allowing the removal of files created by rootless podman, among other things)

Fixed a bug where Podman containers with the --rm flag were removing created volumes when they were automatically removed

Fixed a bug where container and pod locks were incorrectly marked as released after a system reboot, causing errors on container and pod removal

Fixed a bug where Podman pods could not be removed if any container in the pod encountered an error during removal

Fixed a bug where Podman pods run with the cgroupfs CGroup driver would encounter a race condition during removal, potentially failing to remove the pod CGroup

Fixed a bug where the podman container checkpoint and podman container restore commands were not visible in the remote client

Fixed a bug where podman remote ps --ns would not print the container's namespaces

Fixed a bug where removing stopped containers with healthchecks could cause an error

Fixed a bug where the default libpod.conf file was causing parsing errors

Fixed a bug where pod locks were not being freed when pods were removed, potentially leading to lock exhaustion

Fixed a bug where 'podman run' with SD_NOTIFY set could, on short-running containers, create an inconsistent state rendering the container unusable

The remote Podman client now uses the Varlink bridge to establish remote connections by default

Fixed an issue with apparmor_parser (bsc#1123387)

Update to libpod v1.4.0 (bsc#1137860) :

The podman checkpoint and podman restore commands can now be used to migrate containers between Podman installations on different systems

The podman cp command now supports a pause flag to pause containers while copying into them

The remote client now supports a configuration file for pre-configuring connections to remote Podman installations

Fixed CVE-2019-10152 - The podman cp command improperly dereferenced symlinks in host context

Fixed a bug where podman commit could improperly set environment variables that contained = characters

Fixed a bug where rootless Podman would sometimes fail to start containers with forwarded ports

Fixed a bug where podman version on the remote client could segfault

Fixed a bug where podman container runlabel would use /proc/self/exe instead of the path of the Podman command when printing the command being executed

Fixed a bug where filtering images by label did not work

Fixed a bug where specifying a bing mount or tmpfs mount over an image volume would cause a container to be unable to start

Fixed a bug where podman generate kube did not work with containers with named volumes

Fixed a bug where rootless Podman would receive permission denied errors accessing conmon.pid

Fixed a bug where podman cp with a folder specified as target would replace the folder, as opposed to copying into it

Fixed a bug where rootless Podman commands could double-unlock a lock, causing a crash

Fixed a bug where Podman incorrectly set tmpcopyup on /dev/ mounts, causing errors when using the Kata containers runtime

Fixed a bug where podman exec would fail on older kernels

The podman commit command is now usable with the Podman remote client

The --signature-policy flag (used with several image-related commands) has been deprecated

The podman unshare command now defines two environment variables in the spawned shell: CONTAINERS_RUNROOT and CONTAINERS_GRAPHROOT, pointing to temporary and permanent storage for rootless containers

Updated vendored containers/storage and containers/image libraries with numerous bugfixes

Updated vendored Buildah to v1.8.3

Podman now requires Conmon v0.2.0

The podman cp command is now aliased as podman container cp

Rootless Podman will now default init_path using root Podman's configuration files (/etc/containers/libpod.conf and /usr/share/containers/libpod.conf) if not overridden in the rootless configuration

Update to image v1.5.1

Vendor in latest containers/storage

docker/docker_client: Drop redundant Domain(ref.ref) call

pkg/blobinfocache: Split implementations into subpackages

copy: progress bar: show messages on completion

docs: rename manpages to *.5.command

add container-certs.d.md manpage

pkg/docker/config: Bring auth tests from docker/docker_client_test

Don't allocate a sync.Mutex separately

Update to storage v1.12.10: Add function to parse out mount options from graphdriver

Merge the disparate parts of all of the Unix-like lockfiles

Fix unix-but-not-Linux compilation

Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set

Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes

lockfile: add RecursiveLock() API

Update generated files

Fix crash on tesing of aufs code

Let consumers know when Layers and Images came from read-only stores

chown: do not change owner for the mountpoint

locks: correctly mark updates to the layers list

CreateContainer: don't worry about mapping layers unless necessary

docs: fix manpage for containers-storage.conf

docs: sort configuration options alphabetically

docs: document OSTree file deduplication

Add missing options to man page for containers-storage

overlay: use the layer idmapping if present

vfs: prefer layer custom idmappings

layers: propagate down the idmapping settings

Recreate symlink when not found

docs: fix manpage for configuration file

docs: add special handling for manpages in sect 5

overlay: fix single-lower test

Recreate symlink when not found

overlay: propagate errors from mountProgram

utils: root in a userns uses global conf file

Fix handling of additional stores

Correctly check permissions on rootless directory

Fix possible integer overflow on 32bit builds

Evaluate device path for lvm

lockfile test: make concurrent RW test determinisitc

lockfile test: make concurrent read tests deterministic

drivers.DirCopy: fix filemode detection

storage: move the logic to detect rootless into utils.go

Don't set (struct flock).l_pid

Improve documentation of getLockfile

Rename getLockFile to createLockerForPath, and document it

Add FILES section to containers-storage.5 man page

add digest locks

drivers/copy: add a non-cgo fallback

slirp4netns was updated to 0.3.0: CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() (bsc#1123156)

This update also includes: fuse3 and fuse-overlayfs to support rootless containers.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1910 advisory.

    Docker is an open-source engine that automates the deployment of any application as a lightweight,     portable, self-sufficient container that runs virtually anywhere.

    Security Fix(es):

    * docker: symlink-exchange race attacks in docker cp (CVE-2018-15664)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * slowness of system shutdown when containers are being stopped - dockerd is unable to communicate with     rhel-push-plugin (BZ#1714032)

    * journald Log() in dockerd causes nil pointer dereference when PutMessage() is called before reading     msg.Source (BZ#1720363)

    * regression: docker cp: Rel: can't make /..../a relative to a (BZ#1723491)

    * Regression: docker cp: can no longer pull image files (BZ#1727488)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A flaw was discovered in the API endpoint behind the 'docker cp' command. The endpoint is vulnerable to a Time Of Check to Time Of Use (TOCTOU) vulnerability in the way it handles symbolic links inside a container. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
(CVE-2018-15664)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4048-1 advisory.

    Aleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use     this vulnerability to read and write arbitrary files on the host filesystem as root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for docker fixes the following issues :

Security issue fixed: &#9; 

  - CVE-2018-15664: Fixed an issue which could make docker     cp vulnerable to symlink-exchange race attacks     (bsc#1096726).

This update was imported from the SUSE:SLE-15:Update update project.

An update of the docker package has been released.

This update for docker fixes the following issues :

Security issue fixed :

CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4680 advisory.

    - cherry-picked fix for CVE-2018-15664 from upstream

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
270307	SUSE SLES15 / openSUSE 15 Security Update : docker-stable (SUSE-SU-2025:03545-1)	Nessus	SuSE Local Security Checks	critical
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	critical
266258	NewStart CGSL MAIN 6.06 : docker-ce Multiple Vulnerabilities (NS-SA-2025-0217)	Nessus	NewStart CGSL Local Security Checks	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	high
204224	Photon OS 5.0: Kapacitor PHSA-2023-5.0-0045	Nessus	PhotonOS Local Security Checks	critical
180695	Oracle Linux 7 : docker-engine / docker-cli (ELSA-2019-4827)	Nessus	Oracle Linux Local Security Checks	critical
154519	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2021-0138)	Nessus	NewStart CGSL Local Security Checks	high
143962	NewStart CGSL CORE 5.04 / MAIN 5.04 : docker-ce Multiple Vulnerabilities (NS-SA-2020-0082)	Nessus	NewStart CGSL Local Security Checks	high
128458	openSUSE Security Update : podman / slirp4netns and libcontainers-common (openSUSE-2019-2044)	Nessus	SuSE Local Security Checks	high
128302	SUSE SLES15 Security Update : podman, slirp4netns / libcontainers-common (SUSE-SU-2019:2223-1)	Nessus	SuSE Local Security Checks	high
127627	RHEL 7 : docker (RHSA-2019:1910)	Nessus	Red Hat Local Security Checks	high
127073	Amazon Linux AMI : docker (ALAS-2019-1245)	Nessus	Amazon Linux Local Security Checks	high
126564	Ubuntu 16.04 LTS / 18.04 LTS : Docker vulnerabilities (USN-4048-1)	Nessus	Ubuntu Local Security Checks	high
126236	openSUSE Security Update : docker (openSUSE-2019-1621)	Nessus	SuSE Local Security Checks	high
126209	Photon OS 2.0: Docker PHSA-2019-2.0-0162	Nessus	PhotonOS Local Security Checks	high
126192	Photon OS 3.0: Docker PHSA-2019-3.0-0019	Nessus	PhotonOS Local Security Checks	high
126190	Photon OS 1.0: Docker PHSA-2019-1.0-0238	Nessus	PhotonOS Local Security Checks	high
126047	SUSE SLED15 / SLES15 Security Update : docker (SUSE-SU-2019:1562-1)	Nessus	SuSE Local Security Checks	high
125938	Oracle Linux 7 : docker-engine (ELSA-2019-4680)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2018-15664

high

Tenable Plugins

critical

critical

high

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high