The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0033 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-27649:
    A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

    CVE-2022-27651:
    A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1566 advisory.

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1762 advisory.

    - switch to RHEL maintenance branch which fixes CVE-2022-27651
    - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    - fix CVE-2022-21698

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1762 advisory.

  - A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image     to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered     after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem,     leading to information disclosure or denial of service. (CVE-2022-1227)

  - client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods. (CVE-2022-21698)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A     vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty     inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27650)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
276296	TencentOS Server 3: container-tools:3.0 (TSSA-2022:0033)	Nessus	Tencent Local Security Checks	11/20/2025	12/4/2025	high
357424	Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2022_1566)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	high
161275	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-1762)	Nessus	Oracle Linux Local Security Checks	5/18/2022	11/2/2024	high
184630	Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:1762)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high
224486	Linux Distros Unpatched Vulnerability : CVE-2022-27651	Nessus	Misc.	3/5/2025	11/5/2026	medium

Detections

Analytics

Plugins Search

high

high

high

high

medium