Update to 1.0.7

Fixes related to CVE-2019-5736.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the way runc handled system file     descriptors when running containers. A malicious     container could use this flaw to overwrite contents of     the runc binary and consequently run arbitrary commands     on the container host system. (CVE-2019-5736)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues :

Security issues fixed :

  - CVE-2018-16875: Fixed a CPU Denial of Service     (bsc#1118899).

  - CVE-2018-16874: Fixed a vulnerabity in go get command     which could allow directory traversal in GOPATH mode     (bsc#1118898).

  - CVE-2018-16873: Fixed a vulnerability in go get command     which could allow remote code execution when executed     with -u in GOPATH mode (bsc#1118897).

  - CVE-2019-5736: Effectively copying /proc/self/exe during     re-exec to avoid write attacks to the host runc binary,     which could lead to a container breakout (bsc#1121967).

Other changes and bug fixes :

  - Update shell completion to use Group: System/Shells.

  - Add daemon.json file with rotation logs configuration     (bsc#1114832)

  - Update to Docker 18.09.1-ce (bsc#1124308) and to to runc     96ec2177ae84. See upstream changelog in the packaged     /usr/share/doc/packages/docker/CHANGELOG.md.

  - Disable leap based builds for kubic flavor     (bsc#1121412).

  - Allow users to explicitly specify the NIS domain name of     a container (bsc#1001161).

  - Update docker.service to match upstream and avoid rlimit     problems (bsc#1112980).

  - Update go requirements to >= go1.10 

  - Use -buildmode=pie for tests and binary build     (bsc#1048046 and bsc#1051429).

  - Remove the usage of 'cp -r' to reduce noise in the build     logs.

This update was imported from the SUSE:SLE-12:Update update project.

This runc version should fix the keycreate issues on SELinux disabled machines.

----

Latest upstream

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4048-1 advisory.

    Aleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use     this vulnerability to read and write arbitrary files on the host filesystem as root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-0975 advisory.

    container-selinux     [2:2.94-1.git1e99f1d]
    - Resolves: #1690286 - bump to v2.94
    - Resolves: #1693806, #1689255

    [2:2.89-1.git2521d0d]
    - bump to v2.89

    runc     [1.0.0-55.rc5.dev.git2abd837]
    - Resolves: CVE-2019-5736

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues :

Docker :

CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).

CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).

Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649).

runc: Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920).

Update to runc 425e105d5a03, which is required by Docker (bsc#1139649).

containerd: CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967).

Update to containerd v1.2.6, which is required by docker (bsc#1139649).

golang-github-docker-libnetwork: Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413, bsc#1139649).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of RancherOS prior to v1.5.1, hence it is vulnerable to a Local Command Execution Vulnerability.

Opencontainers runc is prone to a local command-execution vulnerability.
A local attacker can exploit this issue to execute arbitrary commands with root privileges.
runc through 1.0-rc6 are vulnerable.

ID	Name	Product	Family	Published	Updated	Severity
122523	Fedora 28 : flatpak (2019-a5f616808e)	Nessus	Fedora Local Security Checks	3/1/2019	6/18/2024	high
122697	EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2019-1074)	Nessus	Huawei Local Security Checks	3/8/2019	6/14/2024	high
123542	openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2019-1079)	Nessus	SuSE Local Security Checks	4/1/2019	6/6/2024	high
124575	Fedora 30 : 2:runc (2019-bc70b381ad)	Nessus	Fedora Local Security Checks	5/3/2019	5/29/2024	high
126564	Ubuntu 16.04 LTS / 18.04 LTS : Docker vulnerabilities (USN-4048-1)	Nessus	Ubuntu Local Security Checks	7/9/2019	8/28/2024	high
127569	Oracle Linux 8 : container-tools:rhel8 (ELSA-2019-0975)	Nessus	Oracle Linux Local Security Checks	8/12/2019	11/1/2024	high
127884	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2019:2117-1)	Nessus	SuSE Local Security Checks	8/14/2019	12/5/2022	critical
132255	RancherOS < 1.5.1 Local Command Execution	Nessus	Misc.	12/19/2019	7/1/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

critical

high