According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where attempting to copy files using `docker cp` into a specially-crafted container     can result in Unix file permission changes for existing files in the host's filesystem, widening access to     others. This bug does not directly allow files to be read, modified, or executed without an additional     cooperating process. This bug has been fixed in Moby (Docker Engine) 20.10.9. Users should update to this     version as soon as possible. Running containers do not need to be restarted. (CVE-2021-41089)

  - Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with     insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory     contents and execute programs. When containers included executable programs with extended permission bits     (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed     in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running     containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade     limit access to the host to trusted users. Limit access to host volumes to trusted containers.
    (CVE-2021-41091)

  - Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker     CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file     (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed     would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended     private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as     soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries     in the configuration file reference an installed credential helper that is executable and on the PATH.
    (CVE-2021-41092)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has docker-ce packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

  - Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0,     17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a     Denial of Service via a crafted image layer payload, aka gzip bombing. (CVE-2017-14992)

  - The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block     /proc/scsi pathnames, which allows attackers to trigger data loss (when certain older Linux kernels are     used) by leveraging Docker container access to write a scsi remove-single-device line to     /proc/scsi/scsi, aka SCSI MICDROP. (CVE-2017-16539)

  - libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than     ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall     arguments could bypass intended access restrictions by specifying a single matching argument.
    (CVE-2017-18367)

  - The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block     /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling     bluetooth or turning up/down keyboard brightness. (CVE-2018-10892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5103-1 advisory.

    Lei Wang and Ruizhi Xiao discovered that the Moby Docker engine in Docker incorrectly allowed the docker     cp command to make permissions changes in the host filesystem in some situations. A local attacker could     possibly use to this to expose sensitive information or gain administrative privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the docker package has been released.

The version of docker installed on the remote host is prior to 20.10.7-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2022-017 advisory.

    A file permissions vulnerability was found in Moby (Docker Engine). Copying files by using `docker cp`     into a specially-crafted container can result in Unix file permission changes for existing files in the     host's filesystem, which might lead to permissions escalation and allow an attacker access to restricted     data. (CVE-2021-41089)

    Moby is an open-source project created by Docker to enable software containerization. A bug was found in     Moby (Docker Engine) where the data directory (typically `/var/lib/docker`) contained subdirectories with     insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory     contents and execute programs. When containers included executable programs with extended permission bits     (such as `setuid`), unprivileged Linux users could discover and execute those programs. When the UID of an     unprivileged Linux user on the host collided with the file owner or group inside a container, the     unprivileged Linux user on the host could discover, read, and modify those files. This bug has been fixed     in Moby (Docker Engine) 20.10.9. Users should update to this version as soon as possible. Running     containers should be stopped and restarted for the permissions to be fixed. For users unable to upgrade     limit access to the host to trusted users. Limit access to host volumes to trusted containers.
    (CVE-2021-41091)

    Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker     CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file     (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed     would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended     private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as     soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries     in the configuration file reference an installed credential helper that is executable and on the PATH.
    (CVE-2021-41092)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03545-1 advisory.

    Note this update contains a already fixed references mostly.

    - Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

      This feature is mostly intended for developers ('docker build git://') so       most users already have the dependency installed, and the error when git is       missing is fairly straightforward (so they can easily figure out what they       need to install).

    - Include historical changelog data from before the docker-stable fork. The       initial changelog entry did technically provide all the necessary       information, but our CVE tracking tools do not understand how the package is       forked and so it seems that this package does not include fixes for ~12 years       of updates. So, include a copy of the original package's changelog up until       the fork point. bsc#1250596

    - Update to docker-buildx v0.25.0. Upstream changelog:
      <https://github.com/docker/buildx/releases/tag/v0.25.0>

    - Update to Go 1.23 for building now that upstream has switched their 23.0.x       LTSS to use Go 1.23.

    - Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as       Docker does not have permission to access the host zypper credentials in this       mode (and unprivileged users cannot disable the feature using       /etc/docker/suse-secrets-enable.) bsc#1240150

    - Initial docker-stable fork, forked from Docker 24.0.7-ce release       (packaged on 2024-02-14). The original changelog is included below for       historical reference.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
165024	EulerOS 2.0 SP9 : docker-engine (EulerOS-SA-2022-2311)	Nessus	Huawei Local Security Checks	2022/9/14	2023/10/12	high
301190	NewStart CGSL MAIN 6.06 (SP) : docker-ce Multiple Vulnerabilities (NS-SA-2026-0011)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	high
153866	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : docker.io vulnerability (USN-5103-1)	Nessus	Ubuntu Local Security Checks	2021/10/5	2024/8/28	medium
153946	Photon OS 3.0: Docker PHSA-2021-3.0-0311	Nessus	PhotonOS Local Security Checks	2021/10/8	2025/8/24	medium
160411	Amazon Linux 2 : docker (ALASDOCKER-2022-017)	Nessus	Amazon Linux Local Security Checks	2022/5/2	2024/12/11	high
270307	SUSE SLES15 / openSUSE 15 Security Update : docker-stable (SUSE-SU-2025:03545-1)	Nessus	SuSE Local Security Checks	2025/10/14	2025/10/15	critical

检测

插件搜索

high

high

medium

medium

high

critical