Detections
Analytics
Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2021_4154)
medium Nessus Plugin ID 358729
Synopsis
The Rocky Linux host is missing one or more security updates.Description
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2021_4154 advisory.* buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)
* containers/storage: DoS via malicious image (CVE-2021-20291)
Tenable has extracted the preceding description block directly from the CIQ security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages based on the guidance in CIQ advisory crlsa-2021_4154.See Also
https://access.redhat.com/errata/RHSA-2021:4154
https://bugzilla.redhat.com/show_bug.cgi?id=1914687
https://bugzilla.redhat.com/show_bug.cgi?id=1928935
https://bugzilla.redhat.com/show_bug.cgi?id=1932399
https://bugzilla.redhat.com/show_bug.cgi?id=1933775
https://bugzilla.redhat.com/show_bug.cgi?id=1933776
https://bugzilla.redhat.com/show_bug.cgi?id=1934415
https://bugzilla.redhat.com/show_bug.cgi?id=1934480
https://bugzilla.redhat.com/show_bug.cgi?id=1937641
https://bugzilla.redhat.com/show_bug.cgi?id=1937830
https://bugzilla.redhat.com/show_bug.cgi?id=1939485
https://bugzilla.redhat.com/show_bug.cgi?id=1940037
https://bugzilla.redhat.com/show_bug.cgi?id=1940054
https://bugzilla.redhat.com/show_bug.cgi?id=1940082
https://bugzilla.redhat.com/show_bug.cgi?id=1940493
https://bugzilla.redhat.com/show_bug.cgi?id=1941380
https://bugzilla.redhat.com/show_bug.cgi?id=1947432
https://bugzilla.redhat.com/show_bug.cgi?id=1947999
https://bugzilla.redhat.com/show_bug.cgi?id=1952204
https://bugzilla.redhat.com/show_bug.cgi?id=1952698
https://bugzilla.redhat.com/show_bug.cgi?id=1957299
https://bugzilla.redhat.com/show_bug.cgi?id=1957840
https://bugzilla.redhat.com/show_bug.cgi?id=1957904
https://bugzilla.redhat.com/show_bug.cgi?id=1958353
https://bugzilla.redhat.com/show_bug.cgi?id=1960948
https://bugzilla.redhat.com/show_bug.cgi?id=1966538
https://bugzilla.redhat.com/show_bug.cgi?id=1966872
https://bugzilla.redhat.com/show_bug.cgi?id=1969264
https://bugzilla.redhat.com/show_bug.cgi?id=1972150
https://bugzilla.redhat.com/show_bug.cgi?id=1972209
https://bugzilla.redhat.com/show_bug.cgi?id=1972211
https://bugzilla.redhat.com/show_bug.cgi?id=1972282
https://bugzilla.redhat.com/show_bug.cgi?id=1972648
https://bugzilla.redhat.com/show_bug.cgi?id=1973418
https://bugzilla.redhat.com/show_bug.cgi?id=1976283
https://bugzilla.redhat.com/show_bug.cgi?id=1977280
https://bugzilla.redhat.com/show_bug.cgi?id=1977673
https://bugzilla.redhat.com/show_bug.cgi?id=1978415
https://bugzilla.redhat.com/show_bug.cgi?id=1978556
https://bugzilla.redhat.com/show_bug.cgi?id=1978647
https://bugzilla.redhat.com/show_bug.cgi?id=1979497
https://bugzilla.redhat.com/show_bug.cgi?id=1980212
https://bugzilla.redhat.com/show_bug.cgi?id=1982593
https://bugzilla.redhat.com/show_bug.cgi?id=1982762
https://bugzilla.redhat.com/show_bug.cgi?id=1985499
https://bugzilla.redhat.com/show_bug.cgi?id=1985905
https://bugzilla.redhat.com/show_bug.cgi?id=1987049
https://bugzilla.redhat.com/show_bug.cgi?id=1993209
https://bugzilla.redhat.com/show_bug.cgi?id=1993249
https://bugzilla.redhat.com/show_bug.cgi?id=1995041
https://bugzilla.redhat.com/show_bug.cgi?id=1998191
https://bugzilla.redhat.com/show_bug.cgi?id=1999144
https://bugzilla.redhat.com/show_bug.cgi?id=2000943
https://bugzilla.redhat.com/show_bug.cgi?id=2004562
https://bugzilla.redhat.com/show_bug.cgi?id=2005018
https://errata.build.resf.org/RLSA-2021:4154
Plugin Details
Severity: Medium
ID: 358729
File Name: ciq_rocky_linux_8_crlsa-2021_4154.nasl
Version: 1.1
Type: Local
Published: 10/1/2026
Updated: 10/1/2026
Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.48
Vendor
Vendor Severity: Unknown
CVSS v2
Risk Factor: Low
Base Score: 1.9
Temporal Score: 1.5
Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2021-3602
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list, Host/OS/extended-third-party
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/9/2021
Vulnerability Publication Date: 4/1/2021
Reference Information
CVE: CVE-2021-20291, CVE-2021-3602