There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual
    machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is
    accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an
    attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making
    private services on the VM accessible to the network. This issue could be also used to interrupt the
    host's services by forwarding all ports to the VM. (CVE-2021-4024)

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution
    of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone
    was used to determine the type of document during push and pull operations. Documents that contain both
    “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an
    accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a
    client may interpret the resulting content differently. The OCI Distribution Specification has been
    updated to require that a mediaType value present in a manifest or index match the Content-Type header
    used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type
    header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests”
    and “config” fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - containerd is an open source container runtime. On installations using SELinux, such as EL8 (CentOS,
    RHEL), Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime
    interface (CRI), an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any
    privileged, regular file on disk for complete read/write access (sans delete). Such is achieved by placing
    the in-container location of the hostPath volume mount at either `/etc/hosts`, `/etc/hostname`, or
    `/etc/resolv.conf`. These locations are being relabeled indiscriminately to match the container process-
    label which effectively elevates permissions for savvy containers that would not normally be able to
    access privileged host files. This issue has been resolved in version 1.5.9. Users are advised to upgrade
    as soon as possible. (CVE-2021-43816)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution
    of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone
    was used to determine the type of document during push and pull operations. Documents that contain both
    “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an
    accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a
    client may interpret the resulting content differently. The OCI Distribution Specification has been
    updated to require that a mediaType value present in a manifest or index match the Content-Type header
    used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type
    header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests”
    and “config” fields if they are unable to update to version 1.0.1 of the spec. (CVE-2021-41190)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and
    resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
    (CVE-2021-43618)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with
    a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing
    functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains
    URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus
    interpreting the filename differently from what the user intended, which may lead it to reading a
    different file than intended. (CVE-2021-21707)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    All FreeRDP clients prior to version 2.4.1 using gateway connections (`/gt:rpc`) fail to validate input
    data. A malicious gateway might allow client memory to be written out of bounds. This issue has been
    resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections
    if possible or use a direct connection without a gateway. (CVE-2021-41159)

  - FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.
    In affected versions a malicious server might trigger out of bound writes in a connected client.
    Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0`
    width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the
    memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not
    allocated) region. This issue has been patched in FreeRDP 2.4.1. (CVE-2021-41160)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged
    user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE
    filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker
    in its string form. An attacker may use this flaw to cause a denial of service to applications that use
    the affected filesystems. (CVE-2021-3995)

  - A logic error was found in the libmount library of util-linux in the function that allows an unprivileged
    user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other
    users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable
    directory. An attacker may use this flaw to cause a denial of service to applications that use the
    affected filesystems. (CVE-2021-3996)

ID	Name	Severity
400011	Alpine: multiple podman packages: security update to 3.4.2-r0 (deprecated)	medium
400010	Alpine: multiple containerd packages: security update to 1.5.8-r0 (deprecated)	critical
400009	Alpine: multiple containerd packages: security update to 1.5.7-r0 (deprecated)	medium
400008	Alpine: multiple gmp packages, libgmpxx: security update to 6.2.1-r0 (deprecated)	high
400007	Alpine: multiple expat packages, libexpat: security update to 2.4.3-r0 (deprecated)	critical
400006	Alpine: php7: security update to 7.4.25-r1 (deprecated)	medium
400005	Alpine: FreeRDP: security update to 2.4.0-r2 (deprecated)	high
400004	Alpine: agetty, blkid, cfdisk, findmnt, hexdump, multiple libblkid packages, mcookie, multiple partx packages, runuser, setpriv, multiple umount packages, wipefs: security update to 2.37.2-r7 (deprecated)	medium

Detections

Analytics

Alpine Linux Local Security Checks Family for Tenable Self-Hosted Container Security

medium

critical

medium

high

critical

medium

high

medium