Detections
Analytics

Photon OS 2.0: Docker PHSA-2021-2.0-0402

medium Nessus Plugin ID 153979

Synopsis

The remote PhotonOS host is missing multiple security updates.

Description

An update of the docker package has been released.

 - Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container can result in Unix file permission changes for existing files in the hosts filesystem, widening access to others. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running containers do not need to be restarted. (CVE-2021-41089)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected Linux packages.

See Also

https://github.com/vmware/photon/wiki/Security-Updates-2-402.md

Plugin Details

Severity: Medium

ID: 153979

File Name: PhotonOS_PHSA-2021-2_0-0402_docker.nasl

Version: 1.3

Type: local

Published: 10/11/2021

Updated: 10/12/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.3

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-41089

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:vmware:photonos:docker, cpe:/o:vmware:photonos:2.0

Required KB Items: Host/local_checks_enabled, Host/PhotonOS/release, Host/PhotonOS/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2021

Vulnerability Publication Date: 9/30/2021

Reference Information

CVE: CVE-2021-41089