An update of the runc package has been released.

An update of the docker package has been released.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:4074 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the telegraf package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - A malicious container image can consume an unbounded amount of memory when being pulled to a container     runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker     can use this flaw to trick a user, with privileges to pull container images, into crashing the process     responsible for pulling the image. This flaw affects containers-image versions before 5.2.0.
    (CVE-2020-1702)

  - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG     signature verification. (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues :

Security issue fixed :

  - CVE-2019-16884: Fixed incomplete patch for LSM bypass     via malicious Docker image that mount over a /proc     directory (bsc#1152308). 

Bug fixes :

  - Update to Docker 19.03.5-ce (bsc#1158590).

  - Update to Docker 19.03.3-ce (bsc#1153367).

  - Update to Docker 19.03.2-ce (bsc#1150397).

  - Fixed default installation such that
    --userns-remap=default works properly (bsc#1143349).

  - Fixed nginx blocked by apparmor (bsc#1122469).

This update was imported from the SUSE:SLE-15:Update update project.

Resolves: #1757214, #1757290 - CVE-2019-16884

----

add patch for cgroupsv2

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2019_4269 advisory.

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4269 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

    * HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

    * runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

    * backport json-file logging support to 1.4.2 (BZ#1770176)

    * Selinux won't allow SCTP inter pod communication (BZ#1774382)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:4269 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

  - podman: resolving symlink in host filesystem leads to unexpected results of copy operation     (CVE-2019-18466)

  - HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  - HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has docker-ce packages installed that are affected by multiple vulnerabilities:

  - runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory. (CVE-2019-16884)

  - In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in     which access to remapped root allows privilege escalation to real root. When using --userns-remap, if     the root user in the remapped namespace has access to the host filesystem they can modify files under     /var/lib/docker/<remapping> that cause writing files with extended privileges. Versions 20.10.3 and     19.03.15 contain patches that prevent privilege escalation from remapped user. (CVE-2021-21284)

  - runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the     vulnerability, an attacker must be able to create multiple containers with a fairly specific mount     configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
    (CVE-2021-30465)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202003-21 (runC: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in runC. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker, by running a malicious Docker image, could escape the       container, bypass security restrictions, escalate privileges or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0110 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the abilityto execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability isto data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0110 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
332286	Photon OS 5.0: Runc PHSA-2025-5.0-91-0676	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/11/3	high
136552	Photon OS 1.0: Docker PHSA-2020-1.0-0292	Nessus	PhotonOS Local Security Checks	2020/5/13	2024/3/12	high
312489	RHCOS 4 : OpenShift Container Platform 4.2 runc (RHSA-2019:4074)	Nessus	Red Hat Local Security Checks	2026/5/6	2026/5/6	high
333780	Photon OS 5.0: Telegraf PHSA-2023-5.0-91-0041	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	high
208507	CentOS 7 : docker (RHSA-2020:1234)	Nessus	CentOS Local Security Checks	2024/10/9	2024/10/9	high
136576	Photon OS 3.0: Docker PHSA-2020-3.0-0088	Nessus	PhotonOS Local Security Checks	2020/5/13	2025/8/22	high
132914	openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2020-45)	Nessus	SuSE Local Security Checks	2020/1/15	2024/3/29	high
129702	Fedora 31 : 2:runc (2019-bd4843561c)	Nessus	Fedora Local Security Checks	2019/10/8	2024/4/19	high
355433	Rocky Linux 8 [CIQ] Security Update: oci-systemd-hook / oci-systemd-hook-debuginfo / etc Multiple Vulnerabilities (crlsa-2019_4269)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
132234	RHEL 8 : container-tools:rhel8 (RHSA-2019:4269)	Nessus	Red Hat Local Security Checks	2019/12/18	2025/3/15	high
145671	CentOS 8 : container-tools:rhel8 (CESA-2019:4269)	Nessus	CentOS Local Security Checks	2021/1/29	2024/1/25	high
160855	NewStart CGSL CORE 5.05 / MAIN 5.05 : docker-ce Multiple Vulnerabilities (NS-SA-2022-0033)	Nessus	NewStart CGSL Local Security Checks	2022/5/10	2023/10/30	high
299589	Photon OS 4.0: Runc PHSA-2026-4.0-0964	Nessus	PhotonOS Local Security Checks	2026/2/19	2026/11/2	high
134598	GLSA-202003-21 : runC: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/16	2024/3/22	high
204388	Photon OS 5.0: Telegraf PHSA-2023-5.0-0041	Nessus	PhotonOS Local Security Checks	2024/7/24	2026/10/13	high
276379	TencentOS Server 3: container-tools:rhel8 (TSSA-2022:0110)	Nessus	Tencent Local Security Checks	2025/11/20	2026/3/10	high
236506	Alibaba Cloud Linux 3 : 0110: container-tools:rhel8 (ALINUX3-SA-2022:0110)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high