The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-4551 advisory.

    - update runc for CVE-2019-5736

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0975 advisory.

    container-selinux     [2:2.94-1.git1e99f1d]
    - Resolves: #1690286 - bump to v2.94
    - Resolves: #1693806, #1689255

    [2:2.89-1.git2521d0d]
    - bump to v2.89

    runc     [1.0.0-55.rc5.dev.git2abd837]
    - Resolves: CVE-2019-5736

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update LXC to version 3.0.4.

The release announcement can be found [here](https://discuss.linuxcontainers.org/t/lxc-3-0-4-has-been-releas ed/5080).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for lxc fixes the following issues :

Update to lxc 3.2.1. The changelog can be found at

https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322

  + seccomp: support syscall forwarding to userspace

  + add lxc.seccomp.allow_nesting

  + pidfd: Add initial support for the new pidfd api

  - Many hardening improvements.

  - Use /sys/kernel/cgroup/delegate file for cgroup v2.

  - Fix CVE-2019-5736 equivalent bug.

  - fix apparmor dropin to be compatible with LXC 3.1.0     (boo#1131762)

CVE-2019-5736

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Resolves: #1664908, #1676798 - Security fix for CVE-2019-5736

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This runc version should fix the keycreate issues on SELinux disabled machines.

----

Latest upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2021-9203 advisory.

    [1.0.0-92.rc92]
    - Add epoch value of 2 to allow upgrade to 1.0.0-92.rc92 from 1.0.0-93.rc93.

    [1.0.0-92.rc92]
    - Build for https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the docker package has been released.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-208:04 advisory.

    * docker: Ambient capability usage in containers (CVE-2016-8867)
      * docker: Security regression of CVE-2019-5736 due to inclusion of vulnerable runc (CVE-2020-14298)
      * docker: Security regression of CVE-2016-9962 due to inclusion of vulnerable runc (CVE-2020-14300)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

  - In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a     symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host     filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen     filesystem (or from within a chroot). (CVE-2018-15664)

  - Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via     a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go,     pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. (CVE-2018-20699)

  - In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the     docker build command would be able to gain command execution. An issue exists in the way docker build     processes remote git URLs, and results in command injection into the underlying git clone command,     leading to code execution in the context of the user executing the docker build command. This occurs     because git ref can be misinterpreted as a flag. (CVE-2019-13139)

  - In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before     18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a     scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It     potentially applies to other API users of the stack API if they resend the secret. (CVE-2019-13509)

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW     capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain     sensitive information, or cause a denial of service. (CVE-2020-13401)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the mesos package has been released.

ID	Name	Product	Family	Published	Updated	Severity
180638	Oracle Linux 7 : docker-engine (ELSA-2019-4551)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
127569	Oracle Linux 8 : container-tools:rhel8 (ELSA-2019-0975)	Nessus	Oracle Linux Local Security Checks	8/12/2019	11/1/2024	high
128564	Fedora 30 : lxc / lxcfs / python3-lxc (2019-2baa1f7b19)	Nessus	Fedora Local Security Checks	9/9/2019	4/26/2024	high
129580	openSUSE Security Update : lxc (openSUSE-2019-2245)	Nessus	SuSE Local Security Checks	10/4/2019	4/19/2024	high
122277	Fedora 29 : moby-engine (2019-352d4b9cd8)	Nessus	Fedora Local Security Checks	2/19/2019	6/20/2024	high
122408	Fedora 29 : 2:docker-latest (2019-4dc1e39b34)	Nessus	Fedora Local Security Checks	2/25/2019	6/18/2024	high
124570	Fedora 29 : 2:runc (2019-6174b47003)	Nessus	Fedora Local Security Checks	5/3/2019	5/29/2024	high
149049	Oracle Linux 7 : runc (ELSA-2021-9203)	Nessus	Oracle Linux Local Security Checks	4/29/2021	10/22/2024	high
203126	Photon OS 2.0: Docker PHSA-2019-2.0-0128	Nessus	PhotonOS Local Security Checks	7/23/2024	3/3/2026	high
294238	MiracleLinux 7 : docker-1.13.1-162.git64e9980.0.1.el7.AXS7 (AXSA:2020-208:04)	Nessus	Miracle Linux Local Security Checks	1/20/2026	2/4/2026	high
154519	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2021-0138)	Nessus	NewStart CGSL Local Security Checks	10/27/2021	10/28/2021	high
202868	Photon OS 2.0: Mesos PHSA-2019-2.0-0161	Nessus	PhotonOS Local Security Checks	7/22/2024	7/23/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high