The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4159 advisory.

  - containers/image: digest type does not guarantee valid type (CVE-2024-3727)

  - cri-o: malicious container can create symlink on host (CVE-2024-5154)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7182 advisory.

  - containers/image: digest type does not guarantee valid type (CVE-2024-3727)

  - webob: WebOb's location header normalization during redirect leads to open redirect (CVE-2024-42353)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9390:11 advisory.

    * containers/image: digest type does not guarantee valid type (CVE-2024-3727)
      * net/[http:](http:) Denial of service due to improper 100-continue handling in net/http     (CVE-2024-24791)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:7941 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.52. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:7939     Security Fix(es):

    * openstack-ironic: Specially crafted image may allow authenticated users     to gain access to potentially sensitive data (CVE-2024-44082)
    * containers/image: digest type does not guarantee valid type     (CVE-2024-3727)
    * webob: WebOb's location header normalization during redirect leads to     open redirect (CVE-2024-42353)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3120-1 advisory.

    Changes in docker:
    - CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
    - CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
    - CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit     (bsc#1219438)
    - CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed     (bsc#1228324)

    Other fixes:

    - Update to Docker 25.0.6-ce. See upstream changelog online at       <https://docs.docker.com/engine/release-notes/25.0/#2506>
    - Update to Docker 25.0.5-ce (bsc#1223409)

    - Fix BuildKit's symlink resolution logic to correctly handle non-lexical       symlinks. (bsc#1221916)
    - Write volume options atomically so sudden system crashes won't result in       future Docker starts failing due to empty files. (bsc#1214855)

    Changes in buildah:
    - Update to version 1.35.4:
      * [release-1.35] Bump to Buildah v1.35.4
      * [release-1.35] CVE-2024-3727 updates (bsc#1224117)
      * integration test: handle new labels in 'bud and test --unsetlabel'
      * [release-1.35] Bump go-jose CVE-2024-28180
      * [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180

    - Update to version 1.35.3:
      * [release-1.35] Bump to Buildah v1.35.3
      * [release-1.35] correctly configure /etc/hosts and resolv.conf
      * [release-1.35] buildah: refactor resolv/hosts setup.
      * [release-1.35] rename the hostFile var to reflect
      * [release-1.35] Bump c/common to v0.58.1
      * [release-1.35] Bump Buildah to v1.35.2
      * [release-1.35] CVE-2024-24786 protobuf to 1.33
      * [release-1.35] Bump to v1.35.2-dev

    - Update to version 1.35.1:
      * [release-1.35] Bump to v1.35.1
      * [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)

    - Buildah dropped cni support, require netavark instead (bsc#1221243)

    - Remove obsolete requires libcontainers-image & libcontainers-storage

    - Require passt for rootless networking (poo#156955)       Buildah moved to passt/pasta for rootless networking from slirp4netns       (https://github.com/containers/common/pull/1846)

    - Update to version 1.35.0:
      * Bump v1.35.0
      * Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
      * conformance tests: don't break on trailing zeroes in layer blobs
      * Add a conformance test for copying to a mounted prior stage
      * fix(deps): update module github.com/stretchr/testify to v1.9.0
      * cgroups: reuse version check from c/common
      * Update vendor of containers/(common,image)
      * fix(deps): update github.com/containers/storage digest to eadc620
      * fix(deps): update github.com/containers/luksy digest to ceb12d4
      * fix(deps): update github.com/containers/image/v5 digest to cdc6802
      * manifest add: complain if we get artifact flags without --artifact
      * Use retry logic from containers/common
      * Vendor in containers/(storage,image,common)
      * Update module golang.org/x/crypto to v0.20.0
      * Add comment re: Total Success task name
      * tests: skip_if_no_unshare(): check for --setuid
      * Properly handle build --pull=false
      * [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
      * Update module go.etcd.io/bbolt to v1.3.9
      * Revert 'Reduce official image size'
      * Update module github.com/opencontainers/image-spec to v1.1.0
      * Reduce official image size
      * Build with CNI support on FreeBSD
      * build --all-platforms: skip some base 'image' platforms
      * Bump main to v1.35.0-dev
      * Vendor in latest containers/(storage,image,common)
      * Split up error messages for missing --sbom related flags
      * `buildah manifest`: add artifact-related options
      * cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
      * cmd/buildah/manifest.go: don't make struct declarations aliases
      * Use golang.org/x/exp/slices.Contains
      * Disable loong64 again
      * Fix a couple of typos in one-line comments
      * egrep is obsolescent; use grep -E
      * Try Cirrus with a newer VM version
      * Set CONTAINERS_CONF in the chroot-mount-flags integration test
      * Update to match dependency API update
      * Update github.com/openshift/imagebuilder and containers/common
      * docs: correct default authfile path
      * fix(deps): update module github.com/containerd/containerd to v1.7.13
      * tests: retrofit test for heredoc summary
      * build, heredoc: show heredoc summary in build output
      * manifest, push: add support for --retry and --retry-delay
      * fix(deps): update github.com/openshift/imagebuilder digest to b767bc3
      * imagebuildah: fix crash with empty RUN
      * fix(deps): update github.com/containers/luksy digest to b62d551
      * fix(deps): update module github.com/opencontainers/runc to v1.1.12 [security]
      * fix(deps): update module github.com/moby/buildkit to v0.12.5 [security]
      * Make buildah match podman for handling of ulimits
      * docs: move footnotes to where they're applicable
      * Allow users to specify no-dereference
      * Run codespell on code
      * Fix FreeBSD version parsing
      * Fix a build break on FreeBSD
      * Remove a bad FROM line
      * fix(deps): update module github.com/onsi/gomega to v1.31.1
      * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc6
      * docs: use reversed logo for dark theme in README
      * build,commit: add --sbom to scan and produce SBOMs when committing
      * commit: force omitHistory if the parent has layers but no history
      * docs: fix a couple of typos
      * internal/mkcw.Archive(): handle extra image content
      * stage_executor,heredoc: honor interpreter in heredoc
      * stage_executor,layers: burst cache if heredoc content is changed
      * fix(deps): update module golang.org/x/crypto to v0.18.0
      * Replace map[K]bool with map[K]struct{} where it makes sense
      * fix(deps): update module golang.org/x/sync to v0.6.0
      * fix(deps): update module golang.org/x/term to v0.16.0
      * Bump CI VMs
      * Replace strings.SplitN with strings.Cut
      * fix(deps): update github.com/containers/storage digest to ef81e9b
      * fix(deps): update github.com/containers/image/v5 digest to 1b221d4
      * fix(deps): update module github.com/fsouza/go-dockerclient to v1.10.1
      * Document use of containers-transports values in buildah
      * fix(deps): update module golang.org/x/crypto to v0.17.0 [security]
      * chore(deps): update dependency containers/automation_images to v20231208
      * manifest: addCompression use default from containers.conf
      * commit: add a --add-file flag
      * mkcw: populate the rootfs using an overlay
      * chore(deps): update dependency containers/automation_images to v20230517
      * [skip-ci] Update actions/stale action to v9
      * fix(deps): update module github.com/containernetworking/plugins to v1.4.0
      * fix(deps): update github.com/containers/image/v5 digest to 7a40fee
      * Bump to v1.34.1-dev
      * Ignore errors if label.Relabel returns ENOSUP

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
311891	RHCOS 4 : OpenShift Container Platform 4.16.1 (RHSA-2024:4159)	Nessus	Red Hat Local Security Checks	5/4/2026	5/4/2026	high
311911	RHCOS 4 / 9 : OpenShift Container Platform 4.15.35 (RHSA-2024:7182)	Nessus	Red Hat Local Security Checks	5/4/2026	5/4/2026	medium
293278	MiracleLinux 9 : buildah-1.37.2-1.el9 (AXSA:2024-9390:11)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
209187	RHEL 8 / 9 : OpenShift Container Platform 4.13.z (RHSA-2024:7941)	Nessus	Red Hat Local Security Checks	10/17/2024	10/17/2024	medium
206581	SUSE SLES15 / openSUSE 15 Security Update : buildah, docker (SUSE-SU-2024:3120-1)	Nessus	SuSE Local Security Checks	9/4/2024	3/3/2026	critical
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	5/16/2026	5/16/2026	high

Detections

Analytics

Plugins Search

high

medium

high

medium

critical

high