A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0013 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10214:
    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens.

    CVE-2019-18466:
    An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2020-10696:
    A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-14370:
    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When     using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in     a short duration, the environment variables from the first container will get leaked into subsequent     containers. An attacker who has control over the subsequent containers could use this flaw to gain access     to sensitive information stored in such variables.

    CVE-2020-1702:
    A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

    CVE-2020-1726:
    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2681 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory.

  - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions. (CVE-2020-10696)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

  - An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host. (CVE-2019-18466)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:1650 advisory.

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1650 advisory.

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.) (CVE-2019-19921)

  - A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.
    (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2681 advisory.

    The skopeo command lets you inspect images from container image registries, get images and image layers,     and use signatures to create and verify files.

    Security Fix(es):

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Proposed registries.conf for RHEL 7.8 (BZ#1810052)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:2218 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * containers/image: Container images were reading the entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory.

    The buildah package provides a tool for facilitating building OCI container images. Among other things,     buildah enables you to: Create a working container, either from scratch or using an image as a starting     point; Create an image, either from a working container or using the instructions in a Dockerfile; Build     both Docker and OCI images.

    Security Fix(es):

    * buildah: Crafted input tar file may lead to local file overwrite during image build process     (CVE-2020-10696)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * buildah is not expanding env vars in file paths (BZ#1822031)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1937 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    Security Fix(es):

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1650 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation     (CVE-2019-19921)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    * podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created     (CVE-2020-1726)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

    Docker is an open-source engine that automates the deployment of any application as a lightweight,     portable, self-sufficient container that runs virtually anywhere.

    Security Fix(es):

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

    * proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Whitelist statx(2) in docker (BZ#1784228)

    * Upgrading docker resulting into increase Systemd logs (BZ#1791870)

    * docker should be linked against gpgme-pthread (BZ#1792243)

    * docker cannot be updated to 108 on rhos13 as a container fails to start with pivot_root invalid     argument error. (BZ#1795376)

    * OVS pods are unable to stop when running under docker version 1.13.1-108 (BZ#1796451)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1227 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

    * containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [extras-rhel-7] conmon binary stripped but debuginfo not generated (BZ#1650395)

    * Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix (BZ#1758509)

    * Podman does not enforce registries.block in the registries.conf file (BZ#1787666)

    * podman and podman-manpages needs merging (BZ#1788549)

    * podman should be linked against gpgme-pthread (BZ#1793083)

    * podman cannot support load tarball which the name with colon but docker can support this (BZ#1797599)

    * podman (1.6.4) rhel 8.1 no route to host from inside container [extras-rhel-7.8/podman] (BZ#1806895)

    * Podman can't reuse a container name, even if the container that was using it is no longer around     [extras-rhel-7.8/podman] (BZ#1807437)

    * podman exec does not reads from stdin [extras-rhel-7.8/podman] (BZ#1807586)

    * [FJ8.2 Bug]: [REG]The --group-add option of podman create doesn't function. [extras-rhel-7.8/podman]     (BZ#1808702)

    Enhancement(s):

    * [RFE] sctp support for podman (BZ#1664218)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
236549	Alibaba Cloud Linux 3 : 0013: container-tools:rhel8 (ALINUX3-SA-2021:0013)	Nessus	Alibaba Cloud Linux Local Security Checks	high
223375	Linux Distros Unpatched Vulnerability : CVE-2020-1702	Nessus	Misc.	low
208566	CentOS 7 : skopeo (RHSA-2020:2681)	Nessus	CentOS Local Security Checks	low
208529	CentOS 7 : buildah (RHSA-2020:2116)	Nessus	CentOS Local Security Checks	high
208511	CentOS 7 : podman (RHSA-2020:1227)	Nessus	CentOS Local Security Checks	medium
208507	CentOS 7 : docker (RHSA-2020:1234)	Nessus	CentOS Local Security Checks	high
185067	Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:1650)	Nessus	Rocky Linux Local Security Checks	high
180939	Oracle Linux 8 : container-tools:ol8 (ELSA-2020-1650)	Nessus	Oracle Linux Local Security Checks	high
145798	CentOS 8 : container-tools:rhel8 (CESA-2020:1650)	Nessus	CentOS Local Security Checks	high
137750	RHEL 7 : skopeo (RHSA-2020:2681)	Nessus	Red Hat Local Security Checks	low
136977	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2218)	Nessus	Red Hat Local Security Checks	low
136521	RHEL 7 : buildah (RHSA-2020:2116)	Nessus	Red Hat Local Security Checks	high
136320	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 cri-o (RHSA-2020:1937)	Nessus	Red Hat Local Security Checks	high
136053	RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)	Nessus	Red Hat Local Security Checks	high
135084	RHEL 7 : docker (RHSA-2020:1234)	Nessus	Red Hat Local Security Checks	high
135081	RHEL 7 : podman (RHSA-2020:1227)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2020-1702

low

Tenable Plugins

high

low

low

high

medium

high

high

high

high

low

low

high

high

high

high

medium