The version of moby-engine installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29018 advisory.

  - Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file May also be used to mark a network _internal_, and     other API clients May specify the `internal` parameter as well. When containers with networking are     created, they are assigned unique network interfaces and IP addresses. The host serves as a router for     non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an     internal network May communicate between each other, but are precluded from communicating with any     networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set     up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately     configured host services) is possible, and the host May communicate with any container IP directly. In     addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS     request for a name that does not correspond to a container is received, the request is forwarded to the     configured upstream resolver. This request is made from the container's network namespace: the level of     access and routing of traffic is the same as if the request was made by the container itself. As a     consequence of this design, containers solely attached to an internal network will be unable to resolve     names using the upstream resolver, as the container itself is unable to communicate with that nameserver.
    Only the names of containers also attached to the internal network are able to be resolved. Many systems     run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a     consequence of the design described above is that containers are unable to resolve names from the host's     configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap,     and to allow containers to properly resolve names even when a local forwarding resolver is used on a     loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework     namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as     expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container     network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS     requests to an external nameserver. By registering a domain for which they control the authoritative     nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in     DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as     Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and     23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run     containers intended to be solely attached to internal networks with a custom upstream address, which will     force all upstream DNS queries to be resolved from the container's network namespace. (CVE-2024-29018)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0992-1 advisory.

    Update to Docker 27.5.1-ce (bsc#1237335):

    - CVE-2024-29018: External DNS requests from 'internal' networks could lead to data exfiltration     (bsc#1234089).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of moby-engine installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29018 advisory.

  - Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file May also be used to mark a network _internal_, and     other API clients May specify the `internal` parameter as well. When containers with networking are     created, they are assigned unique network interfaces and IP addresses. The host serves as a router for     non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an     internal network May communicate between each other, but are precluded from communicating with any     networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set     up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately     configured host services) is possible, and the host May communicate with any container IP directly. In     addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS     request for a name that does not correspond to a container is received, the request is forwarded to the     configured upstream resolver. This request is made from the container's network namespace: the level of     access and routing of traffic is the same as if the request was made by the container itself. As a     consequence of this design, containers solely attached to an internal network will be unable to resolve     names using the upstream resolver, as the container itself is unable to communicate with that nameserver.
    Only the names of containers also attached to the internal network are able to be resolved. Many systems     run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a     consequence of the design described above is that containers are unable to resolve names from the host's     configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap,     and to allow containers to properly resolve names even when a local forwarding resolver is used on a     loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework     namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as     expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container     network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS     requests to an external nameserver. By registering a domain for which they control the authoritative     nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in     DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as     Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and     23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run     containers intended to be solely attached to internal networks with a custom upstream address, which will     force all upstream DNS queries to be resolved from the container's network namespace. (CVE-2024-29018)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-042 advisory.

    2025-01-04: CVE-2024-36620 was added to this advisory.

    2025-01-04: CVE-2024-36623 was added to this advisory.

    When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial     domain, an http.Client does not forward sensitive headers such as Authorization or Cookie. For     example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to     bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly     forwarded. (CVE-2023-45289)

    The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid     JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any     value, or when the UnmarshalOptions.DiscardUnknown option is set. (CVE-2024-24786)

    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6     addresses, returning false for addresses which would return true in their traditional IPv4 forms.
    (CVE-2024-24790)

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well.

    When containers with networking are created, they are assigned unique network interfaces and IP addresses.
    The host serves as a router for non-internal networks, with a gateway IP that provides SNAT/DNAT to/from     container IPs.

    Containers on an internal network may communicate between each other, but are precluded from communicating     with any networks the host has access to (LAN or WAN) as no default route is configured, and firewall     rules are set up to drop all outgoing traffic. Communication with the gateway IP address (and thus     appropriately configured host services) is possible, and the host may communicate with any container IP     directly.

    In addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver.

    When a DNS request for a name that does not correspond to a container is received, the request is     forwarded to the configured upstream resolver. This request is made from the container's network     namespace: the level of access and routing of traffic is the same as if the request was made by the     container itself.

    As a consequence of this design, containers solely attached to an internal network will be unable to     resolve names using the upstream resolver, as the container itself is unable to communicate with that     nameserver. Only the names of containers also attached to the internal network are able to be resolved.

    Many systems run a local forwarding DNS resolver. As the host and any containers have separate loopback     devices, a consequence of the design described above is that containers are unable to resolve names from     the host's configured resolver, as they cannot reach these addresses on the host loopback device. To     bridge this gap, and to allow containers to properly resolve names even when a local forwarding resolver     is used on a loopback address, `dockerd` detects this scenario and instead forward DNS requests from the     host namework namespace. The loopback resolver then forwards the requests to its configured upstream     resolvers, as expected.

    Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container network     namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS requests to     an external nameserver. By registering a domain for which they control the authoritative nameservers, an     attacker could arrange for a compromised container to exfiltrate data by encoding it in DNS queries that     will eventually be answered by their nameservers.

    Docker Desktop is not affected, as Docker Desktop always runs an internal resolver on a RFC 1918 address.

    Moby releases 26.0.0, 25.0.4, and 23.0.11 are patched to prevent forwarding any DNS requests from internal     networks. As a workaround, run containers intended to be solely attached to internal networks with a     custom upstream address, which will force all upstream DNS queries to be resolved from the container's     network namespace. (CVE-2024-29018)

    moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.
    (CVE-2024-36620)

    moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to     trigger multiple concurrent write operations resulting in data corruption or application crashes.
    (CVE-2024-36623)

    AWS is aware of CVE-2024-41110, an issue affecting the Moby open source project, packaged in Amazon Linux     as docker. Docker is a component of several open source container management systems.

    This issue does not affect the default configuration of docker. If an authorization plugin is enabled, a     specially-crafted API request to the docker daemon will be forwarded to the authorization plugin in a way     that could lead to unintended actions, such as privilege escalation. Enabling an authorization plugin is     an atypical configuration. The affected API endpoint is not exposed to the network in either the default,     typical, or recommended configurations. The default EKS and ECS configurations do not expose the API     endpoint to the network. Enabling a Docker authorization plugin is not supported when using ECS. Finally,     docker is not installed on EKS AMIs newer than 1.24. Although Docker is installed in EKS 1.24 and earlier,     EKS does not support authorization plugins.

    Updated docker packages addressing the issue are available for Amazon Linux 2 (docker-20.10.25-1.amzn2.0.5     and docker-25.0.6-1.amzn2.0.1) and for Amazon Linux 2023 (docker-25.0.6-1amzn2023.0.1). AWS recommends     that customers using docker upgrade to these or later versions. (CVE-2024-41110)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well. When containers with networking are     created, they are assigned unique network interfaces and IP addresses. The host serves as a router for     non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an     internal network may communicate between each other, but are precluded from communicating with any     networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set     up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately     configured host services) is possible, and the host may communicate with any container IP directly. In     addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS     request for a name that does not correspond to a container is received, the request is forwarded to the     configured upstream resolver. This request is made from the container's network namespace: the level of     access and routing of traffic is the same as if the request was made by the container itself. As a     consequence of this design, containers solely attached to an internal network will be unable to resolve     names using the upstream resolver, as the container itself is unable to communicate with that nameserver.
    Only the names of containers also attached to the internal network are able to be resolved. Many systems     run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a     consequence of the design described above is that containers are unable to resolve names from the host's     configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap,     and to allow containers to properly resolve names even when a local forwarding resolver is used on a     loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework     namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as     expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container     network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS     requests to an external nameserver. By registering a domain for which they control the authoritative     nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in     DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as     Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and     23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run     containers intended to be solely attached to internal networks with a custom upstream address, which will     force all upstream DNS queries to be resolved from the container's network namespace.(CVE-2024-29018)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and     other distributions of container tooling or runtimes. Moby's networking implementation allows for many     networks, each with their own IP address range and gateway, to be defined. This feature is frequently     referred to as custom networks, as each network can have a different driver, set of parameters and thus     behaviors. When creating a network, the `--internal` flag is used to designate a network as _internal_.
    The `internal` attribute in a docker-compose.yml file may also be used to mark a network _internal_, and     other API clients may specify the `internal` parameter as well. When containers with networking are     created, they are assigned unique network interfaces and IP addresses. The host serves as a router for     non-internal networks, with a gateway IP that provides SNAT/DNAT to/from container IPs. Containers on an     internal network may communicate between each other, but are precluded from communicating with any     networks the host has access to (LAN or WAN) as no default route is configured, and firewall rules are set     up to drop all outgoing traffic. Communication with the gateway IP address (and thus appropriately     configured host services) is possible, and the host may communicate with any container IP directly. In     addition to configuring the Linux kernel's various networking features to enable container networking,     `dockerd` directly provides some services to container networks. Principal among these is serving as a     resolver, enabling service discovery, and resolution of names from an upstream resolver. When a DNS     request for a name that does not correspond to a container is received, the request is forwarded to the     configured upstream resolver. This request is made from the container's network namespace: the level of     access and routing of traffic is the same as if the request was made by the container itself. As a     consequence of this design, containers solely attached to an internal network will be unable to resolve     names using the upstream resolver, as the container itself is unable to communicate with that nameserver.
    Only the names of containers also attached to the internal network are able to be resolved. Many systems     run a local forwarding DNS resolver. As the host and any containers have separate loopback devices, a     consequence of the design described above is that containers are unable to resolve names from the host's     configured resolver, as they cannot reach these addresses on the host loopback device. To bridge this gap,     and to allow containers to properly resolve names even when a local forwarding resolver is used on a     loopback address, `dockerd` detects this scenario and instead forward DNS requests from the host namework     namespace. The loopback resolver then forwards the requests to its configured upstream resolvers, as     expected. Because `dockerd` forwards DNS requests to the host loopback device, bypassing the container     network namespace's normal routing semantics entirely, internal networks can unexpectedly forward DNS     requests to an external nameserver. By registering a domain for which they control the authoritative     nameservers, an attacker could arrange for a compromised container to exfiltrate data by encoding it in     DNS queries that will eventually be answered by their nameservers. Docker Desktop is not affected, as     Docker Desktop always runs an internal resolver on a RFC 1918 address. Moby releases 26.0.0, 25.0.4, and     23.0.11 are patched to prevent forwarding any DNS requests from internal networks. As a workaround, run     containers intended to be solely attached to internal networks with a custom upstream address, which will     force all upstream DNS queries to be resolved from the container's network namespace. (CVE-2024-29018)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
207259	CBL Mariner 2.0 Security Update: moby-engine (CVE-2024-29018)	Nessus	MarinerOS Local Security Checks	2024/9/14	2025/4/10	high
233309	SUSE SLES12 Security Update : docker (SUSE-SU-2025:0992-1)	Nessus	SuSE Local Security Checks	2025/3/25	2025/3/25	medium
234116	Azure Linux 3.0 Security Update: moby-engine (CVE-2024-29018)	Nessus	Azure Linux Local Security Checks	2025/4/10	2025/9/15	high
206635	Amazon Linux 2 : docker (ALASECS-2024-042)	Nessus	Amazon Linux Local Security Checks	2024/9/5	2025/3/13	critical
205973	EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2024-2209)	Nessus	Huawei Local Security Checks	2024/8/21	2025/4/10	high
227624	Linux Distros Unpatched Vulnerability : CVE-2024-29018	Nessus	Misc.	2025/3/5	2025/10/28	high

检测

插件搜索

high

medium

high

critical

high

high