The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7182 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.15.35. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7179

    Security Fix(es):

    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7187 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.38. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7184

    Security Fix(es):

    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3186-1 advisory.

    Update to version 1.35.4:

    * CVE-2024-3727 updates (bsc#1224117)
    * Bump go-jose CVE-2024-28180
    * Bump ocicrypt and go-jose CVE-2024-28180

    Update to version 1.35.3:

    * correctly configure /etc/hosts and resolv.conf
    * buildah: refactor resolv/hosts setup.
    * rename the hostFile var to reflect
    * CVE-2024-24786 protobuf to 1.33


    Update to version 1.35.1:

    * CVE-2024-1753 container escape fix (bsc#1221677)

    - Buildah dropped cni support, require netavark instead (bsc#1221243)

    - Remove obsolete requires libcontainers-image & libcontainers-storage

    - Require passt for rootless networking (poo#156955)       Buildah moved to passt/pasta for rootless networking from slirp4netns       (https://github.com/containers/common/pull/1846)

    Update to version 1.35.0:

    * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
    * conformance tests: don't break on trailing zeroes in layer blobs
    * Add a conformance test for copying to a mounted prior stage
    * cgroups: reuse version check from c/common
    * Update vendor of containers/(common,image)
    * manifest add: complain if we get artifact flags without --artifact
    * Use retry logic from containers/common
    * Vendor in containers/(storage,image,common)
    * Update module golang.org/x/crypto to v0.20.0
    * Add comment re: Total Success task name
    * tests: skip_if_no_unshare(): check for --setuid
    * Properly handle build --pull=false
    * Update module go.etcd.io/bbolt to v1.3.9
    * Update module github.com/opencontainers/image-spec to v1.1.0
    * build --all-platforms: skip some base 'image' platforms
    * Bump main to v1.35.0-dev
    * Vendor in latest containers/(storage,image,common)
    * Split up error messages for missing --sbom related flags
    * `buildah manifest`: add artifact-related options
    * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
    * cmd/buildah/manifest.go: don't make struct declarations aliases
    * Use golang.org/x/exp/slices.Contains
    * Try Cirrus with a newer VM version
    * Set CONTAINERS_CONF in the chroot-mount-flags integration test
    * Update to match dependency API update
    * Update github.com/openshift/imagebuilder and containers/common
    * docs: correct default authfile path
    * tests: retrofit test for heredoc summary
    * build, heredoc: show heredoc summary in build output
    * manifest, push: add support for --retry and --retry-delay
    * imagebuildah: fix crash with empty RUN
    * Make buildah match podman for handling of ulimits
    * docs: move footnotes to where they're applicable
    * Allow users to specify no-dereference
    * docs: use reversed logo for dark theme in README
    * build,commit: add --sbom to scan and produce SBOMs when committing
    * commit: force omitHistory if the parent has layers but no history
    * docs: fix a couple of typos
    * internal/mkcw.Archive(): handle extra image content
    * stage_executor,heredoc: honor interpreter in heredoc
    * stage_executor,layers: burst cache if heredoc content is changed
    * Replace map[K]bool with map[K]struct{} where it makes sense
    * Bump CI VMs
    * Replace strings.SplitN with strings.Cut
    * Document use of containers-transports values in buildah
    * manifest: addCompression use default from containers.conf
    * commit: add a --add-file flag
    * mkcw: populate the rootfs using an overlay
    * [skip-ci] Update actions/stale action to v9
    * Ignore errors if label.Relabel returns ENOSUP

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of containerized-data-importer / cri-o / ig / libcontainers-common / skopeo installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-3727 advisory.

  - A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger     unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local     path traversal, and other attacks. (CVE-2024-3727)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0164 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-45290:
    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with     Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed     form were not applied to the memory consumed while reading a single form line. This permits a maliciously     crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory,     potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits     the maximum size of form lines.

    CVE-2024-1394:
    A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a     resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in     github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That     function uses named return parameters to free pkey and ctx if there is an error initializing the     context or setting the different properties. All return statements related to error cases follow the     return nil, nil, fail(...) pattern, meaning that pkey and ctx will be nil inside the deferred     function that should free them.

    CVE-2024-24783:
    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause     Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth     to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not     verify client certificates.

    CVE-2024-24784:
    The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
    Since this is a misalignment with conforming address parsers, it can result in different trust decisions     being made by programs using different parsers.

    CVE-2024-24789:
    The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most     zip implementations. This misalignment could be exploited to create an zip file with contents that vary     depending on the implementation reading the file. The archive/zip package now rejects files containing     these errors.

    CVE-2024-3727:
    A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger     unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local     path traversal, and other attacks.

    CVE-2024-37298:
    gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running     `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious     attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of     `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory     exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

    CVE-2024-6104:
    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead     to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability,     CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9102:06 advisory.

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)
      * golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
      * go-retryable[http:](http:) url might write sensitive information to log file (CVE-2024-6104)
      * net/[http:](http:) Denial of service due to improper 100-continue handling in net/http     (CVE-2024-24791)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
208030	RHEL 8 / 9 : OpenShift Container Platform 4.15.35 (RHSA-2024:7182)	Nessus	Red Hat Local Security Checks	10/2/2024	10/3/2024	medium
208072	RHEL 8 / 9 : OpenShift Container Platform 4.14.38 (RHSA-2024:7187)	Nessus	Red Hat Local Security Checks	10/3/2024	10/3/2024	medium
206956	SUSE SLES15 Security Update : buildah (SUSE-SU-2024:3186-1)	Nessus	SuSE Local Security Checks	9/11/2024	9/11/2024	high
215350	Azure Linux 3.0 Security Update: containerized-data-importer / cri-o / ig / libcontainers-common / skopeo (CVE-2024-3727)	Nessus	Azure Linux Local Security Checks	2/10/2025	1/22/2026	high
236270	Alibaba Cloud Linux 3 : 0164: container-tools:rhel8 (ALINUX3-SA-2024:0164)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
292848	MiracleLinux 9 : skopeo-1.16.1-1.el9 (AXSA:2024-9102:06)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	medium

Detections

Analytics

Plugins Search

medium

medium

high

high

medium

medium