The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-8431 advisory.

    [4.2.0-7.0.1]
    - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

    [2:4.2.0-7]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/35c0df3)
    - Resolves: #2120436

    [2:4.2.0-6]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/d520a5c)
    - Resolves: #2136845

    [2:4.2.0-5]
    - properly obsolete catatonit
    - Resolves: #2123319

    [2:4.2.0-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/4978898)
    - Resolves: #2124676

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4099-1 advisory.

    - CVE-2022-2990: Fixed a flaw which might allow sensitive information disclosure or possible data     modification. (bsc#1202812)

    - buildah is also rebuilt against go1.21.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0263 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-2990:
      An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3655-1 advisory.

    Buildah was updated to version 1.27.1:

    - CVE-2021-20206: Fixed an issue in libcni that could allow an attacker       to execute arbitrary binaries on the host (bsc#1181961).
    - CVE-2020-10696: Fixed an issue that could lead to files being       overwritten during the image building process (bsc#1167864).
    - CVE-2022-2990: Fixed a possible information disclosure and modification (bsc#1202812).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4349-1 advisory.

    Version update to 1.28.2.

    - CVE-2022-2990: Fixed a possible information disclosure and modification vulnerability (bsc#1202812).
    - CVE-2020-10696: Fixed an issue with a crafted input tar file that may lead to a local file overwriting     during image build process (bsc#1167864).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7822 advisory.

    * podman: possible information disclosure and modification (CVE-2022-2989)
    * buildah: possible information disclosure and modification (CVE-2022-2990)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7822 advisory.

    aardvark-dns     [2:1.1.0-5]
    - fix 'Two aardvark-dns instances trying to use the same port       on the same interface'
    - Resolves: #2130234

    buildah     [1:1.27.2-2]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.27       (https://github.com/containers/buildah/commit/c43a389)
    - Resolves: #2136438

    [1:1.27.2-1]
    - update to the latest content of https://github.com/containers/buildah/tree/release-1.27       (https://github.com/containers/buildah/commit/13622b1)
    - Resolves: #2129767

    cockpit-podman     conmon     containernetworking-plugins     containers-common     [1-43.0.1]
    - Updated removed references [Orabug: 33473101] (Alex Burmashev)
    - Adjust registries.conf (Nikita Gerasimov)
    - remove references to RedHat registry (Nikita Gerasimov)

    [2:1-43]
    - update vendored components and configuration files
    - Resolves: #2136438

    [2:1-42]
    - add beta GPG key
    - Resolves: #2125686

    [2:1-41]
    - update vendored components and configuration files
    - Resolves: #2125241

    container-selinux     criu     crun     fuse-overlayfs     libslirp     netavark     [2:1.1.0-7]
    - fix 'Two aardvark-dns instances trying to use the same port       on the same interface'
    - Resolves: #2130234

    oci-seccomp-bpf-hook     podman     [3:4.2.0-4]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/35c0df3)
    - Resolves: #2125645

    [3:4.2.0-3]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/d520a5c)
    - Resolves: #2136433

    [3:4.2.0-2]
    - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel       (https://github.com/containers/podman/commit/4978898)
    - Resolves: #2125241

    python-podman     [4.2.1-1]
    - update to 4.2.1 release
    - Resolves: #2132360

    [4.2.0-2]
    - fix '[RFE] python-podman: Podman support to perform custom actions on unhealthy containers'
    - Resolves: #2132360

    runc     skopeo     [2:1.9.3-1]
    - update to https://github.com/containers/skopeo/releases/tag/v1.9.3
    - Related: #2135973

    slirp4netns     udica

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:8008 advisory.

  - A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a     container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid     `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits     for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a     malicious image, which when downloaded and stored by an application using containers/storage, would then     cause a deadlock leading to a Denial of Service (DoS). (CVE-2021-20291)

  - Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from     DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to     the RFC1035 format. (CVE-2021-33195)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from     net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
    (CVE-2021-33197)

  - In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the     math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)

  - An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2989)

  - An incorrect handling of the supplementary groups in the Buildah container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container. (CVE-2022-2990)

  - The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey. (CVE-2022-27191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5056:01 advisory.

    * golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u-     extension (CVE-2020-28851)
      * golang.org/x/text: Panic in language.ParseAcceptLanguage while processing     bcp47 tag (CVE-2020-28852)
      * podman: podman machine spawns gvproxy with port bound to all IPs     (CVE-2021-4024)
      * podman: Remote traffic to rootless containers is seen as orginating from     localhost (CVE-2021-20199)
      * containers/storage: DoS via malicious image (CVE-2021-20291)
      * golang: net/http/httputil: ReverseProxy forwards connection headers if first     one is empty (CVE-2021-33197)
      * golang: crypto/tls: certificate of wrong type is causing TLS client to panic     (CVE-2021-34558)
      * golang: net: lookup functions may return invalid host names (CVE-2021-33195)
      * golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if     passed inputs with very large exponents (CVE-2021-33198)
      * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
      * podman: possible information disclosure and modification (CVE-2022-2989)
      * buildah: possible information disclosure and modification (CVE-2022-2990)
      * golang: net/[http:](http:) improper sanitization of Transfer-Encoding header (CVE-2022-1705)
      * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
      * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
      * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)     CVE(s):
    CVE-2020-28851     CVE-2020-28852     CVE-2021-20199     CVE-2021-20291     CVE-2021-33195     CVE-2021-33197     CVE-2021-33198     CVE-2021-34558     CVE-2021-4024     CVE-2022-1705     CVE-2022-2989     CVE-2022-2990     CVE-2022-27191     CVE-2022-30630     CVE-2022-30631     CVE-2022-30632

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
168170	Oracle Linux 9 : podman (ELSA-2022-8431)	Nessus	Oracle Linux Local Security Checks	2022/11/24	2024/10/22	high
183286	SUSE SLES15 Security Update : buildah (SUSE-SU-2023:4099-1)	Nessus	SuSE Local Security Checks	2023/10/18	2026/6/26	high
239886	TencentOS Server 3: buildah (TSSA-2022:0263)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	high
166296	SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2022:3655-1)	Nessus	SuSE Local Security Checks	2022/10/20	2026/6/25	high
168490	SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2022:4349-1)	Nessus	SuSE Local Security Checks	2022/12/8	2026/6/26	high
167441	AlmaLinux 8 : container-tools:rhel8 (ALSA-2022:7822)	Nessus	Alma Linux Local Security Checks	2022/11/14	2025/1/13	high
168133	Oracle Linux 8 : container-tools:ol8 (ELSA-2022-7822)	Nessus	Oracle Linux Local Security Checks	2022/11/23	2024/10/23	high
167960	AlmaLinux 9 : buildah (ALSA-2022:8008)	Nessus	Alma Linux Local Security Checks	2022/11/19	2023/10/3	high
292898	MiracleLinux 9 : container-tools, python-podman-4.2.0-1.el9, toolbox-0.0.99.3-5.el9 (AXSA:2023-5056:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/2/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high