The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in     which access to remapped root allows privilege escalation to real root. When using --userns-remap, if     the root user in the remapped namespace has access to the host filesystem they can modify files under     /var/lib/docker/<remapping> that cause writing files with extended privileges. Versions 20.10.3 and     19.03.15 contain patches that prevent privilege escalation from remapped user. (CVE-2021-21284)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues :

Security issues fixed :

CVE-2020-15257: Fixed a privilege escalation in containerd (bsc#1178969).

CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732)

CVE-2021-21285: pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730)

Non-security issues fixed :

Update Docker to 19.03.15-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).

Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE. It appears that SLES doesn't like the patch. (bsc#1180401)

Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and fixes CVE-2020-15257. bsc#1180243

Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
bsc#1176708

Update to Docker 19.03.14-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243 https://github.com/docker/docker-ce/releases/tag/v19.03.14

Enable fish-completion

Add a patch which makes Docker compatible with firewalld with nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548 (bsc#1178801, SLE-16460)

Update to Docker 19.03.13-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708

Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)

Emergency fix: %requires_eq does not work with provide symbols, only effective package names. Convert back to regular Requires.

Update to Docker 19.03.12-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.

Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of spurrious errors due to Go returning -EINTR from I/O syscalls much more often (due to Go 1.14's pre-emptive goroutine support).

Add BuildRequires for all -git dependencies so that we catch missing dependencies much more quickly.

Update to libnetwork 55e924b8a842, which is required for Docker 19.03.14-ce. bsc#1180243

Add patch which makes libnetwork compatible with firewalld with nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548 (bsc#1178801, SLE-16460)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in Docker, a Linux container runtime, which could result in denial of service, an information leak or privilege escalation.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1954-1 advisory.

  - In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in     which access to remapped root allows privilege escalation to real root. When using --userns-remap, if     the root user in the remapped namespace has access to the host filesystem they can modify files under     /var/lib/docker/ that cause writing files with extended privileges. Versions 20.10.3 and     19.03.15 contain patches that prevent privilege escalation from remapped user. (CVE-2021-21284)

  - In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally     malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches     that prevent the daemon from crashing. (CVE-2021-21285)

  - In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers     launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container     client that uses the containerd CRI service) that share the same image may receive incorrect environment     variables, including values that are defined for other containers. If the affected containers have     different security contexts, this may allow sensitive information to be unintentionally shared. If you are     not using containerd's CRI implementation (through one of the mechanisms described above), you are not     vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same     image which have different environment variables, you are not vulnerable to this issue. If you are not     launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced     likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and     containerd 1.4.4. Users should update to these versions. (CVE-2021-21334)

  - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the     vulnerability, an attacker must be able to create multiple containers with a fairly specific mount     configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
    (CVE-2021-30465)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03540-1 advisory.

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. (bsc#1250596)

    - Remove git-core recommends on SLE. Most SLE systems have       installRecommends=yes by default and thus end up installing git with Docker.
      bsc#1250508

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Backport <https://github.com/moby/moby/pull/48517>. bsc#1247362

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the telegraf package has been released.

The remote NewStart CGSL host, running version MAIN 6.06, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
256456	Linux Distros Unpatched Vulnerability : CVE-2021-21284	Nessus	Misc.	2025/8/27	2025/8/27	medium
146460	SUSE SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2021:0435-1)	Nessus	SuSE Local Security Checks	2021/2/12	2024/1/22	medium
146922	Debian DSA-4865-1 : docker.io - security update	Nessus	Debian Local Security Checks	2021/3/1	2024/1/18	medium
151692	openSUSE 15 Security Update : containerd, docker, runc (openSUSE-SU-2021:1954-1)	Nessus	SuSE Local Security Checks	2021/7/16	2021/7/16	high
270099	SUSE SLES12 Security Update : docker-stable (SUSE-SU-2025:03540-1)	Nessus	SuSE Local Security Checks	2025/10/11	2025/10/11	critical
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	2024/7/24	2025/8/21	high
266258	NewStart CGSL MAIN 6.06 : docker-ce Multiple Vulnerabilities (NS-SA-2025-0217)	Nessus	NewStart CGSL Local Security Checks	2025/9/30	2025/9/30	high

检测

插件搜索

medium

medium

medium

high

critical

high

high