This update for containerd, docker, docker-runc and golang-github-docker-libnetwork fixes the following issues :

Security issues fixed for containerd, docker, docker-runc and golang-github-docker-libnetwork :

CVE-2018-16873: cmd/go: remote command execution during 'go get -u' (bsc#1118897)

CVE-2018-16874: cmd/go: directory traversal in 'go get' via curly braces in import paths (bsc#1118898)

CVE-2018-16875: crypto/x509: CPU denial of service (bsc#1118899)

Non-security issues fixed for docker: Disable leap based builds for kubic flavor (bsc#1121412)

Allow users to explicitly specify the NIS domainname of a container (bsc#1001161)

Update docker.service to match upstream and avoid rlimit problems (bsc#1112980)

Allow docker images larger then 23GB (bsc#1118990)

Docker version update to version 18.09.0-ce (bsc#1115464)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for containerd, docker and go fixes the following issues :

containerd and docker :

  - Add backport for building containerd (bsc#1102522,     bsc#1113313)

  - Upgrade to containerd v1.1.2, which is required for     Docker v18.06.1-ce. (bsc#1102522)

  - Enable seccomp support (fate#325877)

  - Update to containerd v1.1.1, which is the required     version for the Docker v18.06.0-ce upgrade.
    (bsc#1102522)

  - Put containerd under the podruntime slice (bsc#1086185) 

  - 3rd party registries used the default Docker certificate     (bsc#1084533)

  - Handle build breakage due to missing 'export GOPATH'     (caused by resolution of boo#1119634). I believe Docker     is one of the only packages with this problem.

go :

  - golang: arbitrary command execution via VCS path     (bsc#1081495, CVE-2018-7187)

  - Make profile.d/go.sh no longer set GOROOT=, in order to     make switching between versions no longer break. This     ends up removing the need for go.sh entirely (because     GOPATH is also set automatically) (boo#1119634)

  - Fix a regression that broke go get for import path     patterns containing '...' (bsc#1119706)

Additionally, the package go1.10 has been added.

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-201812-09 (Go: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Go. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause arbitrary code execution by passing       specially crafted Go packages the &lsquo;go get -u&rsquo; command.
    The remote attacker could also craft pathological inputs causing a CPU       based Denial of Service condition via the crypto/x509 package.
  Workaround :

    There is no known workaround at this time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work     performed for each chain verification, which might allow attackers to craft pathological inputs leading to     a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
    (CVE-2018-16875)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: containerd: Fixing container breakout     vulnerability (bsc#1121967).

  - CVE-2019-6486: go security release, fixing     crypto/elliptic CPU DoS vulnerability affecting P-521     and P-384 (bsc#1123013).

  - CVE-2018-16873: go secuirty release, fixing cmd/go     remote command execution (bsc#1118897).

  - CVE-2018-16874: go security release, fixing cmd/go     directory traversal (bsc#1118898).

  - CVE-2018-16875: go security release, fixing crypto/x509     CPU denial of service (bsc#1118899).

Other changes and bug fixes :

  - Update to containerd v1.2.5, which is required for     v18.09.5-ce (bsc#1128376, bsc#1134068).

  - Update to runc 2b18fe1d885e, which is required for     Docker v18.09.5-ce (bsc#1128376, bsc#1134068).

  - Update to Docker 18.09.5-ce see upstream changelog in     the packaged (bsc#1128376, bsc#1134068).

  - docker-test: Improvements to test packaging     (bsc#1128746).

  - Move daemon.json file to /etc/docker directory     (bsc#1114832).

  - Revert golang(API) removal since it turns out this     breaks >= requires in certain cases (bsc#1114209).

  - Fix go build failures (bsc#1121397).

This update was imported from the SUSE:SLE-15:Update update project.

This update for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork fixes the following issues :

Security issues fixed :

CVE-2019-5736: containerd: Fixing container breakout vulnerability (bsc#1121967).

CVE-2019-6486: go security release, fixing crypto/elliptic CPU DoS vulnerability affecting P-521 and P-384 (bsc#1123013).

CVE-2018-16873: go secuirty release, fixing cmd/go remote command execution (bsc#1118897).

CVE-2018-16874: go security release, fixing cmd/go directory traversal (bsc#1118898).

CVE-2018-16875: go security release, fixing crypto/x509 CPU denial of service (bsc#1118899).

Other changes and bug fixes: Update to containerd v1.2.5, which is required for v18.09.5-ce (bsc#1128376, bsc#1134068).

Update to runc 2b18fe1d885e, which is required for Docker v18.09.5-ce (bsc#1128376, bsc#1134068).

Update to Docker 18.09.5-ce see upstream changelog in the packaged (bsc#1128376, bsc#1134068).

docker-test: Improvements to test packaging (bsc#1128746).

Move daemon.json file to /etc/docker directory (bsc#1114832).

Revert golang(API) removal since it turns out this breaks >= requires in certain cases (bsc#1114209).

Fix go build failures (bsc#1121397).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Arista Networks EOS running on the remote device is affected by a denial of service (DoS) vulnerability in the client certificate authentication process, due to the crypto/x509 package in Go not limiting the amount of work performed for each chain verification. A remote, unauthenticated attacker can exploit this, by sending a crafted certificate to cause the system to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the go package has been released.

This update for helm-mirror to version 0.2.1 fixes the following issues :

Security issues fixed :

CVE-2018-16873: Fixed a remote command execution (bsc#1118897)

CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path (bsc#1118898)

CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899)

Non-security issue fixed: Update to v0.2.1 (bsc#1120762)

Include helm-mirror into the containers module (bsc#1116182)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Rebase to go1.11.4

  - Security fix for CVE-2018-16875, CVE-2018-16874 and     CVE-2018-16873

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This new package for go1.11 fixes the following issues: Security issues fixed :

  - CVE-2018-16873: Fixed a remote code execution in go get,     when executed with the -u flag (bsc#1118897)

  - CVE-2018-16874: Fixed an arbitrary filesystem write in     go get, which could lead to code execution (bsc#1118898)

  - CVE-2018-16875: Fixed a Denial of Service in the     crypto/x509 package during certificate chain     validation(bsc#1118899)

Non-security issues fixed :

  - Fixed build error with PIE linker flags on ppc64le     (bsc#1113978 bsc#1098017)

  - Make profile.d/go.sh no longer set GOROOT=, in order to     make switching between versions no longer break. This     ends up removing the need for go.sh entirely (because     GOPATH is also set automatically) (bsc#1119634) The     following tracked regression fix is included :

  - Fix a regression that broke go get for import path     patterns containing '...' (bsc#1119706)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues :

Security issues fixed :

CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).

CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).

CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).

CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967).

Other changes and fixes: Update shell completion to use Group:
System/Shells.

Add daemon.json file with rotation logs configuration (bsc#1114832)

Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84.
See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.

Update go requirements to >= go1.10

Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).

Remove the usage of 'cp -r' to reduce noise in the build logs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3656-1 advisory.

    Update to version 3.5.12:

    Security fixes:

    - CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
    - CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
    - CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
    - CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled     (bsc#1121850)
    - CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
    - CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
    - CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
    - CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
    - CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
    - CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
    - CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in     crypto/ssh (bsc#1217950, bsc#1218150)

    Other changes:

    - Added hardening to systemd service(s) (bsc#1181400)
    - Fixed static /tmp file issue (bsc#1199031)
    - Fixed systemd service not starting (bsc#1183703)

    Full changelog:

    https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
122050	SUSE SLED15 / SLES15 Security Update : docker (SUSE-SU-2019:0286-1)	Nessus	SuSE Local Security Checks	2019/2/8	2021/1/13	high
123165	openSUSE Security Update : containerd / docker and go (openSUSE-2019-1044)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/12	high
119852	GLSA-201812-09 : Go: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2018/12/24	2020/3/25	high
222121	Linux Distros Unpatched Vulnerability : CVE-2018-16875	Nessus	Misc.	2025/3/4	2025/8/20	high
125697	openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2019-1499)	Nessus	SuSE Local Security Checks	2019/6/4	2024/5/17	high
125920	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork (SUSE-SU-2019:1234-2)	Nessus	SuSE Local Security Checks	2019/6/14	2022/1/26	high
134116	Arista Networks EOS DoS (SA0039)	Nessus	Misc.	2020/2/28	2020/3/6	high
202845	Photon OS 2.0: Go PHSA-2019-2.0-0167	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/22	high
121058	SUSE SLES15 Security Update : helm-mirror (SUSE-SU-2019:0048-1)	Nessus	SuSE Local Security Checks	2019/1/10	2020/2/26	high
121075	Fedora 29 : golang (2019-1198005e1f)	Nessus	Fedora Local Security Checks	2019/1/11	2020/2/26	high
123157	openSUSE Security Update : go1.11 (openSUSE-2019-1018)	Nessus	SuSE Local Security Checks	2019/3/27	2021/1/19	high
126492	SUSE SLES15 Security Update : helm-mirror (SUSE-SU-2019:0048-2)	Nessus	SuSE Local Security Checks	2019/7/5	2020/1/8	high
122472	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork, runc (SUSE-SU-2019:0495-1)	Nessus	SuSE Local Security Checks	2019/2/27	2022/1/26	high
209193	openSUSE 15 Security Update : etcd (SUSE-SU-2024:3656-1)	Nessus	SuSE Local Security Checks	2024/10/17	2024/10/18	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

critical