The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1762 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * crun: Default inheritable capabilities for linux container should be empty (CVE-2022-27650)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4816 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * psgo: Privilege escalation in 'podman top' (CVE-2022-1227)

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0033 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2022-27649:
    A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

    CVE-2022-27651:
    A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2022_1566 advisory.

    * podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

    * buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1762 advisory.

    - switch to RHEL maintenance branch which fixes CVE-2022-27651
    - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
    - fix CVE-2022-21698

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1762 advisory.

  - A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image     to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered     after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem,     leading to information disclosure or denial of service. (CVE-2022-1227)

  - client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods. (CVE-2022-21698)

  - A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions.
    A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-     empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27649)

  - A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A     vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty     inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
    (CVE-2022-27650)

  - A flaw was found in buildah where containers were incorrectly started with non-empty default permissions.
    A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty     inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file     capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the     potential to impact confidentiality and integrity. (CVE-2022-27651)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
161023	RHEL 8 : container-tools:rhel8 (RHSA-2022:1762)	Nessus	Red Hat Local Security Checks	2022/5/11	2025/8/15	high
170750	SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2023:0187-1)	Nessus	SuSE Local Security Checks	2023/1/28	2026/6/26	high
161719	RHEL 8 : container-tools:3.0 (RHSA-2022:4816)	Nessus	Red Hat Local Security Checks	2022/5/31	2024/11/7	high
276296	TencentOS Server 3: container-tools:3.0 (TSSA-2022:0033)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/4	high
357424	Rocky Linux 8 [CIQ] Security Update: buildah / buildah-debuginfo / buildah-debugsource / buildah-tests / etc Multiple Vulnerabilities (crlsa-2022_1566)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
161275	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-1762)	Nessus	Oracle Linux Local Security Checks	2022/5/18	2024/11/2	high
184630	Rocky Linux 8 : container-tools:rhel8 (RLSA-2022:1762)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high

检测

插件搜索

high

high

high

high

high

high

high