The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1325 advisory.

  - buildah: possible information disclosure and modification (CVE-2022-2990)

  - OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)

  - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

  - golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

  - golang: path/filepath: path-filepath filepath.Clean path traversal (CVE-2022-41722)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7457 advisory.

  - golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

  - opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

  - cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

  - golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

  - runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

  - buildah: possible information disclosure and modification (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8431 advisory.

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is     for applications that use container pods. Container pods is a concept in Kubernetes.

    Security Fix(es):

    * podman: possible information disclosure and modification (CVE-2022-2989)

    * buildah: possible information disclosure and modification (CVE-2022-2990)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * (podman image trust) does not support the new trust type sigstoreSigned  (BZ#2120436)

    * dnf-update broken for podman/catatonit (BZ#2123319)

    * podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905)

    * podman kill may deadlock [RHEL 9.1] (BZ#2124716)

    * containers config.json gets empty after sudden power loss (BZ#2136278)

    * PANIC podman API service endpoint handler panic (BZ#2136287)

    Enhancement(s):

    * Podman volume plugin timeout should be configurable [rhel-9.1.0 Z] (BZ#2124676)

    * [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4425:01 advisory.

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
      * cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
      * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
      * opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
      * buildah: possible information disclosure and modification (CVE-2022-2990)
      * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4470:01 advisory.

    * podman: possible information disclosure and modification (CVE-2022-2989)
      * buildah: possible information disclosure and modification (CVE-2022-2990)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the podman package has been released.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7457 advisory.

    * golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
    * cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
    * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
    * opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)
    * buildah: possible information disclosure and modification (CVE-2022-2990)
    * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8431 advisory.

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8431 advisory.

    [4.2.0-7.0.1]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [2:4.2.0-7]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/35c0df3)
    - Resolves: #2120436

    [2:4.2.0-6]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/d520a5c)
    - Resolves: #2136845

    [2:4.2.0-5]
    - properly obsolete catatonit
    - Resolves: #2123319

    [2:4.2.0-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/4978898)
    - Resolves: #2124676

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
189426	RHCOS 4 / 9 : OpenShift Container Platform 4.13.0 (RHSA-2023:1325)	Nessus	Red Hat Local Security Checks	1/24/2024	5/4/2026	critical
167135	CentOS 8 : container-tools:rhel8 (CESA-2022:7457)	Nessus	CentOS Local Security Checks	11/9/2022	10/5/2023	high
167608	RHEL 9 : podman (RHSA-2022:8431)	Nessus	Red Hat Local Security Checks	11/16/2022	3/16/2025	high
293662	MiracleLinux 8 : container-tools:rhel8 (AXSA:2022-4425:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
293749	MiracleLinux 8 : container-tools:rhel8 (AXSA:2022-4470:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
203522	Photon OS 4.0: Podman PHSA-2023-4.0-0429	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	high
167293	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7457)	Nessus	Alma Linux Local Security Checks	11/12/2022	1/13/2025	high
167843	AlmaLinux 9 : podman (ALSA-2022:8431)	Nessus	Alma Linux Local Security Checks	11/18/2022	10/3/2023	high
168170	Oracle Linux 9 : podman (ELSA-2022-8431)	Nessus	Oracle Linux Local Security Checks	11/24/2022	10/22/2024	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high

high