The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4297 advisory.

  - jenkins-jira-plugin: plugin information disclosure (CVE-2019-16541)

  - jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM     (CVE-2020-2252)

  - jenkins-2-plugins/blueocean: Path traversal vulnerability in Blue Ocean Plugin could allow to read     arbitrary files (CVE-2020-2254)

  - jenkins-2-plugins/blueocean: Blue Ocean Plugin does not perform permission checks in several HTTP     endpoints implementing connection tests. (CVE-2020-2255)

  - kubernetes: Docker config secrets leaked when file is malformed and loglevel >= 4 (CVE-2020-8564)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for podman fixes the following issues :

Security issue fixed :

This release resolves CVE-2020-14370, in which environment variables could be leaked between containers created using the Varlink API (bsc#1176804).

Non-security issues fixed :

add dependency to timezone package or podman fails to build a container (bsc#1178122)

Install new auto-update system units

Update to v2.1.1 (bsc#1178392) :

  - Changes

  - The `podman info` command now includes the cgroup     manager Podman is using.

  - API

  - The REST API now includes a Server header in all     responses.

  - Fixed a bug where the Libpod and Compat Attach endpoints     could terminate early, before sending all output from     the container.

  - Fixed a bug where the Compat Create endpoint for     containers did not properly handle the Interactive     parameter.

  - Fixed a bug where the Compat Kill endpoint for     containers could continue to run after a fatal error.

  - Fixed a bug where the Limit parameter of the Compat List     endpoint for Containers did not properly handle a limit     of 0 (returning nothing, instead of all containers)     [#7722].

  - The Libpod Stats endpoint for containers is being     deprecated and will be replaced by a similar endpoint     with additional features in a future release.

Changes in v2.1.0

  - Features

  - A new command, `podman image mount`, has been added.
    This allows for an image to be mounted, read-only, to     inspect its contents without creating a container from     it [#1433].

  - The `podman save` and `podman load` commands can now     create and load archives containing multiple images     [#2669].

  - Rootless Podman now supports all `podman network`     commands, and rootless containers can now be joined to     networks.

  - The performance of `podman build` on `ADD` and `COPY`     instructions has been greatly improved, especially when     a `.dockerignore` is present.

  - The `podman run` and `podman create` commands now     support a new mode for the `--cgroups` option,     `--cgroups=split`. Podman will create two cgroups under     the cgroup it was launched in, one for the container and     one for Conmon. This mode is useful for running Podman     in a systemd unit, as it ensures that all processes are     retained in systemd's cgroup hierarchy [#6400].

  - The `podman run` and `podman create` commands can now     specify options to slirp4netns by using the `--network`     option as follows :

`--net slirp4netns:opt1,opt2`. This allows for, among other things,

switching the port forwarder used by slirp4netns away from rootlessport.

  - The `podman ps` command now features a new option,     `--storage`, to show containers from Buildah, CRI-O and     other applications.

  - The `podman run` and `podman create` commands now     feature a `--sdnotify` option to control the behavior of     systemd's sdnotify with containers, enabling improved     support for Podman in `Type=notify` units.

  - The `podman run` command now features a `--preserve-fds`     opton to pass file descriptors from the host into the     container

[#6458].

  - The `podman run` and `podman create` commands can now     create overlay volume mounts, by adding the `:O` option     to a bind mount

(e.g. `-v /test:/test:O`). Overlay volume mounts will mount a directory

into a container from the host and allow changes to it, but not write

those changes back to the directory on the host.

  - The `podman play kube` command now supports the Socket     HostPath type [#7112].

  - The `podman play kube` command now supports read-only     mounts.

  - The `podman play kube` command now supports setting     labels on pods from Kubernetes metadata labels.

  - The `podman play kube` command now supports setting     container restart policy [#7656].

  - The `podman play kube` command now properly handles     `HostAlias` entries.

  - The `podman generate kube` command now adds entries to     `/etc/hosts` from `--host-add` generated YAML as     `HostAlias` entries.

  - The `podman play kube` and `podman generate kube`     commands now properly support `shareProcessNamespace` to     share the PID namespace in pods.

  - The `podman volume ls` command now supports the     `dangling` filter to identify volumes that are dangling     (not attached to any container).

  - The `podman run` and `podman create` commands now     feature a `--umask` option to set the umask of the     created container.

  - The `podman create` and `podman run` commands now     feature a `--tz` option to set the timezone within the     container [#5128].

  - Environment variables for Podman can now be added in the     `containers.conf` configuration file.

  - The `--mount` option of `podman run` and `podman create`     now supports a new mount type, `type=devpts`, to add a     `devpts` mount to the container. This is useful for     containers that want to mount `/dev/` from the host into     the container, but still create a terminal.

  - The `--security-opt` flag to `podman run` and `podman     create` now supports a new option, `proc-opts`, to     specify options for the container's `/proc` filesystem.

  - Podman with the `crun` OCI runtime now supports a new     option to `podman run` and `podman create`,     `--cgroup-conf`, which allows for advanced configuration     of cgroups on cgroups v2 systems.

  - The `podman create` and `podman run` commands now     support a `--override-variant` option, to override the     architecture variant of the image that will be pulled     and ran.

  - A new global option has been added to Podman,     `--runtime-flags`, which allows for setting flags to use     when the OCI runtime is called.

  - The `podman manifest add` command now supports the     `--cert-dir`, `--auth-file`, `--creds`, and     `--tls-verify` options.

  - Security

  - This release resolves CVE-2020-14370, in which     environment variables could be leaked between containers     created using the Varlink API.

  - Changes

  - Podman will now retry pulling an image 3 times if a pull     fails due to network errors.

  - The `podman exec` command would previously print error     messages (e.g. `exec session exited with non-zero exit     code

    -1`) when the command run exited with a non-0 exit code.
    It no

longer does this. The `podman exec` command will still exit with the same

exit code as the command run in the container did.

  - Error messages when creating a container or pod with a     name that is already in use have been improved.

  - For read-only containers running systemd init, Podman     creates a tmpfs filesystem at `/run`. This was     previously limited to 65k in size and mounted `noexec`,     but is now unlimited size and mounted `exec`.

  - The `podman system reset` command no longer removes     configuration files for rootless Podman.

  - API

  - The Libpod API version has been bumped to v2.0.0 due to     a breaking change in the Image List API.

  - Docker-compatible Volume Endpoints (Create, Inspect,     List, Remove, Prune) are now available!

  - Added an endpoint for generating systemd unit files for     containers.

  - The `last` parameter to the Libpod container list     endpoint now has an alias, `limit` [#6413].

  - The Libpod image list API new returns timestamps in Unix     format, as integer, as opposed to as strings

  - The Compat Inspect endpoint for containers now includes     port information in NetworkSettings.

  - The Compat List endpoint for images now features limited     support for the (deprecated) `filter` query parameter     [#6797].

  - Fixed a bug where the Compat Create endpoint for     containers was not correctly handling bind mounts.

  - Fixed a bug where the Compat Create endpoint for     containers would not return a 404 when the requested     image was not present.

  - Fixed a bug where the Compat Create endpoint for     containers did not properly handle Entrypoint and     Command from images.

  - Fixed a bug where name history information was not     properly added in the Libpod Image List endpoint.

  - Fixed a bug where the Libpod image search endpoint     improperly populated the Description field of responses.

  - Added a `noTrunc` option to the Libpod image search     endpoint.

  - Fixed a bug where the Pod List API would return null,     instead of an empty array, when no pods were present     [#7392].

  - Fixed a bug where endpoints that hijacked would do     perform the hijack too early, before being ready to send     and receive data [#7195].

  - Fixed a bug where Pod endpoints that can operate on     multiple containers at once (e.g. Kill, Pause, Unpause,     Stop) would not forward errors from individual     containers that failed.

  - The Compat List endpoint for networks now supports     filtering results [#7462].

  - Fixed a bug where the Top endpoint for pods would return     both a 500 and 404 when run on a non-existent pod.

  - Fixed a bug where Pull endpoints did not stream progress     back to the client.

  - The Version endpoints (Libpod and Compat) now provide     version in a format compatible with Docker.

  - All non-hijacking responses to API requests should not     include headers with the version of the server.

  - Fixed a bug where Libpod and Compat Events endpoints did     not send response headers until the first event occurred     [#7263].

  - Fixed a bug where the Build endpoints (Compat and     Libpod) did not stream progress to the client.

  - Fixed a bug where the Stats endpoints (Compat and     Libpod) did not properly handle clients disconnecting.

  - Fixed a bug where the Ignore parameter to the Libpod     Stop endpoint was not performing properly.

  - Fixed a bug where the Compat Logs endpoint for     containers did not stream its output in the correct     format [#7196].

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:0531 advisory.

  - An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When     using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in     a short duration, the environment variables from the first container will get leaked into subsequent     containers. An attacker who has control over the subsequent containers could use this flaw to gain access     to sensitive information stored in such variables. (CVE-2020-14370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0013 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10214:
    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens.

    CVE-2019-18466:
    An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during     a copy operation from the container to the host, because an undesired glob operation occurs. An attacker     could create a container image containing particular symlinks that, when copied by a victim user to the     host filesystem, may overwrite existing files with others from the host.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2020-10696:
    A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to     trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to     the user's system anywhere that the user has permissions.

    CVE-2020-14040:
    The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the     UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker     could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an     infinite loop if the String function on the Decoder is called, or the Decoder is passed to     golang.org/x/text/transform.String.

    CVE-2020-14370:
    An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When     using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in     a short duration, the environment variables from the first container will get leaked into subsequent     containers. An attacker who has control over the subsequent containers could use this flaw to gain access     to sensitive information stored in such variables.

    CVE-2020-1702:
    A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.

    CVE-2020-1726:
    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing     files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a     container based on a malicious image with an attached volume that is used for the first time, it is     possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for podman fixes the following issues :

Security issue fixed :

  - This release resolves CVE-2020-14370, in which     environment variables could be leaked between containers     created using the Varlink API (bsc#1176804).

Non-security issues fixed :

  - add dependency to timezone package or podman fails to     build a container (bsc#1178122)

  - Install new auto-update system units

  - Update to v2.1.1 (bsc#1178392) :

  - Changes

  - The `podman info` command now includes the cgroup     manager Podman is using.

  - API

  - The REST API now includes a Server header in all     responses.

  - Fixed a bug where the Libpod and Compat Attach endpoints     could terminate early, before sending all output from     the container.

  - Fixed a bug where the Compat Create endpoint for     containers did not properly handle the Interactive     parameter.

  - Fixed a bug where the Compat Kill endpoint for     containers could continue to run after a fatal error.

  - Fixed a bug where the Limit parameter of the Compat List     endpoint for Containers did not properly handle a limit     of 0 (returning nothing, instead of all containers)     [#7722].

  - The Libpod Stats endpoint for containers is being     deprecated and will be replaced by a similar endpoint     with additional features in a future release.

  - Changes in v2.1.0

  - Features

  - A new command, `podman image mount`, has been added.
    This allows for an image to be mounted, read-only, to     inspect its contents without creating a container from     it [#1433].

  - The `podman save` and `podman load` commands can now     create and load archives containing multiple images     [#2669].

  - Rootless Podman now supports all `podman network`     commands, and rootless containers can now be joined to     networks.

  - The performance of `podman build` on `ADD` and `COPY`     instructions has been greatly improved, especially when     a `.dockerignore` is present.

  - The `podman run` and `podman create` commands now     support a new mode for the `--cgroups` option,     `--cgroups=split`. Podman will create two cgroups under     the cgroup it was launched in, one for the container and     one for Conmon. This mode is useful for running Podman     in a systemd unit, as it ensures that all processes are     retained in systemd's cgroup hierarchy [#6400].

  - The `podman run` and `podman create` commands can now     specify options to slirp4netns by using the `--network`     option as follows: `--net slirp4netns:opt1,opt2`. This     allows for, among other things, switching the port     forwarder used by slirp4netns away from rootlessport.

  - The `podman ps` command now features a new option,     `--storage`, to show containers from Buildah, CRI-O and     other applications.

  - The `podman run` and `podman create` commands now     feature a `--sdnotify` option to control the behavior of     systemd's sdnotify with containers, enabling improved     support for Podman in `Type=notify` units.

  - The `podman run` command now features a `--preserve-fds`     opton to pass file descriptors from the host into the     container [#6458].

  - The `podman run` and `podman create` commands can now     create overlay volume mounts, by adding the `:O` option     to a bind mount (e.g. `-v /test:/test:O`). Overlay     volume mounts will mount a directory into a container     from the host and allow changes to it, but not write     those changes back to the directory on the host.

  - The `podman play kube` command now supports the Socket     HostPath type [#7112].

  - The `podman play kube` command now supports read-only     mounts.

  - The `podman play kube` command now supports setting     labels on pods from Kubernetes metadata labels.

  - The `podman play kube` command now supports setting     container restart policy [#7656].

  - The `podman play kube` command now properly handles     `HostAlias` entries.

  - The `podman generate kube` command now adds entries to     `/etc/hosts` from `--host-add` generated YAML as     `HostAlias` entries.

  - The `podman play kube` and `podman generate kube`     commands now properly support `shareProcessNamespace` to     share the PID namespace in pods.

  - The `podman volume ls` command now supports the     `dangling` filter to identify volumes that are dangling     (not attached to any container).

  - The `podman run` and `podman create` commands now     feature a `--umask` option to set the umask of the     created container.

  - The `podman create` and `podman run` commands now     feature a `--tz` option to set the timezone within the     container [#5128].

  - Environment variables for Podman can now be added in the     `containers.conf` configuration file.

  - The `--mount` option of `podman run` and `podman create`     now supports a new mount type, `type=devpts`, to add a     `devpts` mount to the container. This is useful for     containers that want to mount `/dev/` from the host into     the container, but still create a terminal.

  - The `--security-opt` flag to `podman run` and `podman     create` now supports a new option, `proc-opts`, to     specify options for the container's `/proc` filesystem.

  - Podman with the `crun` OCI runtime now supports a new     option to `podman run` and `podman create`,     `--cgroup-conf`, which allows for advanced configuration     of cgroups on cgroups v2 systems.

  - The `podman create` and `podman run` commands now     support a `--override-variant` option, to override the     architecture variant of the image that will be pulled     and ran.

  - A new global option has been added to Podman,     `--runtime-flags`, which allows for setting flags to use     when the OCI runtime is called.

  - The `podman manifest add` command now supports the     `--cert-dir`, `--auth-file`, `--creds`, and     `--tls-verify` options.

  - Security

  - This release resolves CVE-2020-14370, in which     environment variables could be leaked between containers     created using the Varlink API.

  - Changes

  - Podman will now retry pulling an image 3 times if a pull     fails due to network errors.

  - The `podman exec` command would previously print error     messages (e.g. `exec session exited with non-zero exit     code

    -1`) when the command run exited with a non-0 exit code.
    It no longer does this. The `podman exec` command will     still exit with the same exit code as the command run in     the container did.

  - Error messages when creating a container or pod with a     name that is already in use have been improved.

  - For read-only containers running systemd init, Podman     creates a tmpfs filesystem at `/run`. This was     previously limited to 65k in size and mounted `noexec`,     but is now unlimited size and mounted `exec`.

  - The `podman system reset` command no longer removes     configuration files for rootless Podman.

  - API

  - The Libpod API version has been bumped to v2.0.0 due to     a breaking change in the Image List API.

  - Docker-compatible Volume Endpoints (Create, Inspect,     List, Remove, Prune) are now available!

  - Added an endpoint for generating systemd unit files for     containers.

  - The `last` parameter to the Libpod container list     endpoint now has an alias, `limit` [#6413].

  - The Libpod image list API new returns timestamps in Unix     format, as integer, as opposed to as strings

  - The Compat Inspect endpoint for containers now includes     port information in NetworkSettings.

  - The Compat List endpoint for images now features limited     support for the (deprecated) `filter` query parameter     [#6797].

  - Fixed a bug where the Compat Create endpoint for     containers was not correctly handling bind mounts.

  - Fixed a bug where the Compat Create endpoint for     containers would not return a 404 when the requested     image was not present.

  - Fixed a bug where the Compat Create endpoint for     containers did not properly handle Entrypoint and     Command from images.

  - Fixed a bug where name history information was not     properly added in the Libpod Image List endpoint.

  - Fixed a bug where the Libpod image search endpoint     improperly populated the Description field of responses.

  - Added a `noTrunc` option to the Libpod image search     endpoint.

  - Fixed a bug where the Pod List API would return null,     instead of an empty array, when no pods were present     [#7392].

  - Fixed a bug where endpoints that hijacked would do     perform the hijack too early, before being ready to send     and receive data [#7195].

  - Fixed a bug where Pod endpoints that can operate on     multiple containers at once (e.g. Kill, Pause, Unpause,     Stop) would not forward errors from individual     containers that failed.

  - The Compat List endpoint for networks now supports     filtering results [#7462].

  - Fixed a bug where the Top endpoint for pods would return     both a 500 and 404 when run on a non-existent pod.

  - Fixed a bug where Pull endpoints did not stream progress     back to the client.

  - The Version endpoints (Libpod and Compat) now provide     version in a format compatible with Docker.

  - All non-hijacking responses to API requests should not     include headers with the version of the server.

  - Fixed a bug where Libpod and Compat Events endpoints did     not send response headers until the first event occurred     [#7263].

  - Fixed a bug where the Build endpoints (Compat and     Libpod) did not stream progress to the client.

  - Fixed a bug where the Stats endpoints (Compat and     Libpod) did not properly handle clients disconnecting.

  - Fixed a bug where the Ignore parameter to the Libpod     Stop endpoint was not performing properly.

  - Fixed a bug where the Compat Logs endpoint for     containers did not stream its output in the correct     format [#7196].

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
312408	RHCOS 4 : OpenShift Container Platform 4.6.1 (RHSA-2020:4297)	Nessus	Red Hat Local Security Checks	5/6/2026	5/6/2026	critical
143753	SUSE SLES15 Security Update : podman (SUSE-SU-2020:3378-1)	Nessus	SuSE Local Security Checks	12/9/2020	3/23/2023	medium
165254	SUSE SLES15 Security Update : libcontainers-common (SUSE-SU-2022:3312-1)	Nessus	SuSE Local Security Checks	9/20/2022	6/25/2026	medium
184853	Rocky Linux 8 : container-tools:rhel8 (RLSA-2021:0531)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	medium
236549	Alibaba Cloud Linux 3 : 0013: container-tools:rhel8 (ALINUX3-SA-2021:0013)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	high
143322	openSUSE Security Update : podman (openSUSE-2020-2063)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	medium
143335	openSUSE Security Update : podman (openSUSE-2020-2039)	Nessus	SuSE Local Security Checks	11/30/2020	2/7/2024	medium

Detections

Analytics

Plugins Search

critical

medium

medium

medium

high

medium

medium