According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission     vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and     `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
    This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system     administrator permissions so the host can manually chmod the directories to not have group or world     accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

    containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach     implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in     versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission     controller to control accesses to pods/attach resources.(CVE-2025-64329)

Tenable has extracted the preceding description block directly from the EulerOS docker-engine security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the containerd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach     implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in     versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission     controller to control accesses to pods/attach resources.(CVE-2025-64329)

    containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission     vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and     `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions.
    This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system     administrator permissions so the host can manually chmod the directories to not have group or world     accessible permissions, or to run containerd in rootless mode.(CVE-2024-25621)

Tenable has extracted the preceding description block directly from the EulerOS containerd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7983-1 advisory.

    David Leadbeater discovered that containerd incorrectly set certain directory path permissions. An     attacker could possibly use this issue to achieve unauthorised access to the files. (CVE-2024-25621)

    It was discovered that containerd did not properly handle the execution of the goroutine of container     attach. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-64329)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21213-1 advisory.

    This update for containerd fixes the following issues

    Update to 1.7.33:

    - CVE-2024-25621: overly broad default permission vulnerability (bsc#1253126).
    - CVE-2025-64329: goroutine leaks can lead to memory exhaustion on the host (bsc#1253132).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2     :path pseudo-       header (bsc#1260296).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265794).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262948).
    - CVE-2026-35469: github.com/moby/spdystream: memory amplification in SPDY frame parsing leads to denial     of service       (bsc#1262266).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266640).
    - CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268355).
    - CVE-2026-47262: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268441).
    - CVE-2026-53488: CRI plugin propagates labels from an image config to a container without validation     (bsc#1268430).

    Changes for containerd:

     * https://github.com/containerd/containerd/releases/tag/v1.7.33
     * https://github.com/containerd/containerd/releases/tag/v1.7.32
     * https://github.com/containerd/containerd/releases/tag/v1.7.31
     * https://github.com/containerd/containerd/releases/tag/v1.7.30
     * https://github.com/containerd/containerd/releases/tag/v1.7.29
     * https://github.com/containerd/containerd/releases/tag/v1.7.28

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4467 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4467-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                     Arnaud Rebillout     February 05, 2026                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : containerd     Version        : 1.4.13~ds1-1~deb11u6     CVE ID         : CVE-2024-25621 CVE-2025-64329     Debian Bug     : 1120285 1120343

    Multiple vulnerabilities were discovered in containerd, an open-source     container runtime, used by e.g. Docker or Kubernetes.

    CVE-2024-25621

        Overly broad default permission vulnerability. Directory paths         `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri`         and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were         all created with incorrect permissions.

    CVE-2025-64329

        Bug in the CRI Attach implementation where a user can exhaust memory         on the host due to goroutine leaks.

    For Debian 11 bullseye, these problems have been fixed in version     1.4.13~ds1-1~deb11u6.

    We recommend that you upgrade your containerd packages.

    For the detailed security status of containerd please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/containerd

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the containerd package has been released.

The remote NewStart CGSL host, running version MAIN 7.02, has containerd packages installed that are affected by multiple vulnerabilities:

  - containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and     2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a     container without validation. This may result in executing an arbitrary command on the host, via a plugin     that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2,     2.2.5, 2.1.9, and 2.0.10. (CVE-2026-53488)

  - containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6,     2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach     implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in     versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission     controller to control accesses to pods/attach resources. (CVE-2025-64329)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
301593	EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-1230)	Nessus	Huawei Local Security Checks	2026/3/10	2026/3/10	medium
302460	EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-1384)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	medium
297274	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : containerd vulnerabilities (USN-7983-1)	Nessus	Ubuntu Local Security Checks	2026/1/30	2026/1/30	medium
325038	openSUSE 16 Security Update : containerd (openSUSE-SU-2026:21213-1)	Nessus	SuSE Local Security Checks	2026/7/3	2026/7/3	critical
297981	Debian dla-4467 : containerd - security update	Nessus	Debian Local Security Checks	2026/2/5	2026/2/5	medium
301603	EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-1266)	Nessus	Huawei Local Security Checks	2026/3/10	2026/3/10	medium
302400	EulerOS 2.0 SP12 : containerd (EulerOS-SA-2026-1353)	Nessus	Huawei Local Security Checks	2026/3/16	2026/3/16	medium
276728	Photon OS 5.0: Containerd PHSA-2025-5.0-0682	Nessus	PhotonOS Local Security Checks	2025/11/25	2026/10/14	medium
343597	NewStart CGSL MAIN 7.02 : containerd Multiple Vulnerabilities (NS-SA-2026-0097)	Nessus	NewStart CGSL Local Security Checks	2026/9/8	2026/9/8	critical

检测

插件搜索

medium

medium

medium

critical

medium

medium

medium

medium

critical