远程主机上安装的 runc 版本低于 1.1.5-1。因此，它受到 ALAS2DOCKER-2023-025 公告中提及的多个漏洞影响。

  - runc 是一款用于根据 OCI 规范生成和运行容器的 CLI 工具。在受影响的版本中，无根 runc 使“/sys/fs/cgroup”可在下列条件下写入：1. 在用户命名空间中执行 runc，并且“config.json”未指定要取消共享的 cgroup 命名空间时（例如，“(docker|podman|nerdctl) run --cgroupns=host”，具有 Rootless Docker/ Podman/nerdctl）或 2. 在用户命名空间之外执行 runc，且“/sys”挂载了“rbind, ro”（例如“runc spec --rootless”；此情况非常少见）。容器可能会获得主机上用户拥有的 cgroup 层次“/sys/fs/cgroup/user.slice/...”的写入权限。其他用户的 cgroup 层次结构不受影响。
    建议用户升级至版本 1.1.5。无法升级的用户可能取消共享 cgroup 命名空间 (“(docker|podman|nerdctl) run --cgroupns=private)”。这是 cgroup v2 主机上 Docker/Podman/nerdctl 的默认行为。或将“/sys/fs/cgroup”添加到“maskedPaths”。 (CVE-2023-25809)

  - 1.1.4 及之前的 runc 版本含有导致权限提升的错误访问控制，此问题与 libcontainer/rootfs_linux.go 相关。要利用此问题，攻击者必须能够生成两个具有自定义 volume-mount 配置的容器，并且能够运行自定义图像。注意：存在此问题的原因是 CVE-2019-19921 回归。(CVE-2023-27561)

  - runc 是一款用于根据 OCI 规范生成和运行容器的 CLI 工具。据发现，当容器内的“/proc”与特定挂载配置进行符号链接时，可绕过 AppArmor。通过禁止符号链接“/proc”，此问题已在 runc 1.1.5 版中修复。详情请参阅 PR #3785。我们建议用户进行升级。无法升级的用户应避免使用不受信任的容器映像。(CVE-2023-28642)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Red Hat Enterprise Linux CoreOS 4 主机上安装的程序包受到 RHSA-2023: 4093 公告。

  - 在 kube-apiserver 中发现认证绕过漏洞。此问题可允许已获得更新权限的经过认证的远程攻击者，对 pods/ephemeralcontainers 子资源安装超出默认版本的修补程序。然后，他们需要创建新的 pod 或对其已具有访问权限的 pod 进行修补。这可能允许规避 SCC 准入限制，从而获得对特权 pod 的控制。(CVE-2023-1260)

  - 即使在解析小型输入时，HTTP 和 MIME 标头解析也可能会分配大量内存，从而可能导致拒绝服务。输入数据的某些异常模式可导致用于解析 HTTP 和 MIME 标头的通用函数分配远超所需的内容来保存已解析的标头。攻击者可能会利用此行为，导致 HTTP 服务器通过小型请求分配大量内存，从而可能导致内存耗尽和拒绝服务。
    经修复后，标头解析现在可以正确分配所需内存来保存已解析的标头。
    (CVE-2023-24534)

  - 在处理包含大量部分的表单输入时，多部分表单解析可能会消耗大量 CPU 和内存。此问题由多种原因导致：1. mime/multipart.Reader.ReadForm 限制解析多部分表单可以消耗的总内存。ReadForm 可能会低估所消耗的内存量，导致它接受的输入大于预期。2. 限制总内存的做法并未考虑到包含多个部分的表单中的大量小型分配给垃圾回收器增加的压力。3.
    ReadForm 可以分配大量短效缓冲区，这会进一步加大对垃圾回收器造成的压力。这些因素相结合，攻击者便可让解析多部分表单的程序消耗大量 CPU 和内存，从而可能导致拒绝服务。
    这会影响使用 mime/multipart.Reader.ReadForm 的程序，也会影响使用 Request 方法 FormFile、FormValue、ParseMultipartForm 和 PostFormValue 在 net/http 程序包中进行的表单解析。经修复后，ReadForm 现在可以更好地估算已解析表单的内存消耗量，并大幅减少短效分配。此外，经修复的 mime/multipart.Reader 会对已解析表单的大小施加以下限制：1. 使用 ReadForm 解析的表单包含的部分不超过 1,000 个。此限制可通过环境变量 GODEBUG=multipartmaxparts= 进行调整。2. 使用 NextPart 和 NextRawPart 解析的表单部分包含的标头字段不超过 10,000 个。此外，使用 ReadForm 解析的所有表单部分包含的标头字段不超过 10,000 个。此限制可通过环境变量 GODEBUG=multipartmaxheaders= 进行调整。(CVE-2023-24536)

  - 在包含具有极大行号的 //line 指令的 Go 源代码中，调用任何 Parse 函数都有可能因整数溢出而造成无限循环。(CVE-2023-24537)

  - 模板未正确将反引号 (`) 视为 Javascript 字符串分隔符，也未按预期对其进行转义。自 ES6 起，反引号可用于 JS 模板文本。如果模板的 Javascript 模板文本中包含 Go 模板操作，则此操作的内容可用于停用文本，进而将任意 Javascript 代码注入 Go 模板。ES6 模板文字相当复杂，且其本身可以执行字符串插入操作，因此决定简单地禁止在此类文字中使用 Go 模板操作（例如 var a = {{.}}），因为没有显然安全的方式支持此行为。此方法与 github.com/google/safehtml 相同。经修复后，Template.Parse 在遇到此类模板时会返回一个 ErrorCode 值为 12 的错误。此 ErrorCode 当前并未导出，但将在 Go 1.21 版本中导出。依赖之前行为的用户可以使用 GODEBUG 标记 jstmpllitinterp=1 重新启用它，但需要注意的是现在将对反引号进行转义。应谨慎使用此做法。(CVE-2023-24538)

  - 将尖括号 (<>) 插入到 CSS 上下文中时，不会视其为危险字符。如果使用不受信任的输入执行，包含由“/”字符分隔的多个操作的模板可能会导致意外关闭 CSS 上下文并允许意外注入 HTML。(CVE-2023-24539)

  - 1.1.4 及之前的 runc 版本含有导致权限提升的错误访问控制，此问题与 libcontainer/rootfs_linux.go 相关。要利用此问题，攻击者必须能够生成两个具有自定义 volume-mount 配置的容器，并且能够运行自定义图像。注意：存在此问题的原因是 CVE-2019-19921 回归。(CVE-2023-27561)

  - 由于 HTML 规范化规则，在使用空输入执行未加引号的 HTML 属性（如 attr={{.}}）中包含操作的模板可能会导致在解析时产生意想不到的输出结果。这可能允许向标记中注入任意属性。 (CVE-2023-29400)

  - 在 Red Hat OpenShift Container Platform 中发现合规性问题。Red Hat 发现，在启用 FIPS 模式时，并非所有使用中的加密模块都通过 FIPS 验证。(CVE-2023-3089)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 CentOS Linux 9 主机上安装的一个程序包受到 runc-1.1.7-1.el9 版本变更日志中提及的多个漏洞影响。

  - runc 是一款用于根据 OCI 规范生成和运行容器的 CLI 工具。在受影响的版本中，我们发现 rootless runc 使 `/sys/fs/cgroup` 在以下条件下可写：1. 在用户命名空间中执行 runc，并且 `config.json` 未指定要取消共享的 cgroup 命名空间时（例如 `(docker|podman|nerdctl) run --cgroupns=host`，具有 Rootless Docker/ Podman/nerdctl）或 2. 在用户命名空间之外执行 runc，且 `/sys` 挂载了 `rbind, ro`（例如 `runc spec --rootless`；此情况非常少见）。容器可能会获得主机上用户拥有的 cgroup 层次“/sys/fs/cgroup/user.slice/...”的写入权限。其他用户的 cgroup 层次结构不受影响。
    建议用户升级至版本 1.1.5。无法升级的用户可能取消共享 cgroup 命名空间 (“(docker|podman|nerdctl) run --cgroupns=private)”。这是 cgroup v2 主机上 Docker/Podman/nerdctl 的默认行为。或将“/sys/fs/cgroup”添加到“maskedPaths”。 (CVE-2023-25809)

  - 1.1.4 及之前的 runc 版本含有导致权限提升的错误访问控制，此问题与 libcontainer/rootfs_linux.go 相关。要利用此问题，攻击者必须能够生成两个具有自定义 volume-mount 配置的容器，并且能够运行自定义图像。注意：存在此问题的原因是 CVE-2019-19921 回归。(CVE-2023-27561)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12579 advisory.

    - rootless: fix /sys/fs/cgroup mounts to prevent CVE-2023-25809
    - rootfs: prohibit symlinks that conflicts with readonlyPaths               and/or maskedPaths to prevent CVE-2023-27561
    - Prohibit /proc and /sys to be symlinks to prevent CVE-2023-28642

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6938 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3612 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.13.4. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:3614

    Security Fix(es):

    * golang: html/template: improper handling of JavaScript whitespace     (CVE-2023-24540)

    * golang: net/http: excessive memory growth in a Go server accepting HTTP/2     requests (CVE-2022-41717)

    * golang: crypto/tls: large handshake records may cause panics     (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive     resource consumption (CVE-2022-41725)

    * golang: net/http, net/textproto: denial of service from excessive memory     allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from     excessive resource consumption (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters     (CVE-2023-24538)

    * runc: volume mount race condition (regression of CVE 2019-19921)     (CVE-2023-27561)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the nerdctl package has been released.

An update of the docker package has been released.

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression. (CVE-2023-27561)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the runc package has been released.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1bcbb1db39 advisory.

    Security fix for CVE-2023-27561

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0050 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-27191:
    The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to     crash a server in certain circumstances involving AddHostKey.

    CVE-2022-2989:
    An incorrect handling of the supplementary groups in the Podman container engine might lead to the     sensitive information disclosure or possible data modification if an attacker has direct access to the     affected container where supplementary groups are used to set access permissions and is able to execute a     binary code in that container.

    CVE-2022-3064:
    Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

    CVE-2022-41723:
    A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient     to cause a denial of service from a small number of small requests.

    CVE-2022-41724:
    Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert).

    CVE-2022-41725:
    A denial of service is possible from excessive resource consumption in net/http and mime/multipart.
    Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory     and disk files. This also affects form parsing in the net/http package with the Request methods FormFile,     FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented     as storing up to maxMemory bytes +10MB (reserved for non-file parts) in memory. File parts which cannot     be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file     parts is excessively large and can potentially open a denial of service vector on its own. However,     ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead,     part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In     addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small     request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts     for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory     bytes of memory consumption. Users should still be aware that this limit is high and may still be     hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form     parts into a single temporary file. The mime/multipart.File interface type's documentation states, If     stored on disk, the File's underlying concrete type will be an *os.File.. This is no longer the case when     a form contains more than one file part, due to this coalescing of parts into a single file. The previous     behavior of using distinct files for each form part may be reenabled with the environment variable     GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request     methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the     size of form data with http.MaxBytesReader.

    CVE-2023-24534:
    HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs,     potentially leading to a denial of service. Certain unusual patterns of input data can cause the common     function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold     the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large     amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service.
    With fix, header parsing now correctly allocates only the memory required to hold parsed headers.

    CVE-2023-24536:
    Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing     very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the     total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed,     leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased     pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3.
    ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage     collector. The combination of these factors can permit an attacker to cause an program that parses     multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service.
    This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http     package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix,     ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many     fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits     on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit     may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with     NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with     ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with     the environment variable GODEBUG=multipartmaxheaders=.

    CVE-2023-24537:
    Calling any of the Parse functions on Go source code which contains //line directives with very large line     numbers can cause an infinite loop due to integer overflow.

    CVE-2023-24538:
    Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them     as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template     action within a Javascript template literal, the contents of the action can be used to terminate the     literal, injecting arbitrary Javascript code into the Go template. As ES6 template literals are rather     complex, and themselves can do string interpolation, the decision was made to simply disallow Go template     actions from being used inside of them (e.g. var a = {{.}}), since there is no obviously safe way to     allow this behavior. This takes the same approach as github.com/google/safehtml. With fix, Template.Parse     returns an Error when it encounters templates like this, with an ErrorCode of value 12. This ErrorCode is     currently unexported, but will be exported in the release of Go 1.21. Users who rely on the previous     behavior can re-enable it using the GODEBUG flag jstmpllitinterp=1, with the caveat that backticks will     now be escaped. This should be used with caution.

    CVE-2023-24539:
    Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates     containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS     context and allowing for injection of unexpected HTML, if executed with untrusted input.

    CVE-2023-24540:
    Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing     whitespace characters outside of the character set \t\n\f\r\u0020\u2028\u2029 in JavaScript contexts     that also contain actions may not be properly sanitized during execution.

    CVE-2023-25173:
    containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and     1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct     access to a container and manipulates their supplementary group access, they may be able to use     supplementary group access to bypass primary group restrictions in some cases, potentially gaining access     to sensitive information or gaining the ability to execute code in that container. Downstream applications     that use the containerd client library may be affected as well.
    This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and     recreate containers to resolve this issue. Users who rely on a downstream application that uses     containerd's client library should check that application for a separate advisory and instructions. As a     workaround, ensure that the `USER $USERNAME` Dockerfile instruction is not used. Instead, set the     container entrypoint to a value similar to `ENTRYPOINT [su, -, user]` to allow `su` to properly set     up supplementary groups.

    CVE-2023-25809:
    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected     versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when     runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to     be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or     2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc     spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup     hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected.
    Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace     (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl     on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`.

    CVE-2023-27561:
    runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a     CVE-2019-19921 regression.

    CVE-2023-28642:
    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image.

    CVE-2023-29400:
    Templates containing actions in unquoted HTML attributes (e.g. attr={{.}}) executed with empty input can     result in output with unexpected results when parsed due to HTML normalization rules. This may allow     injection of arbitrary attributes into tags.

    CVE-2023-29406:
    The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host     header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send     requests containing an invalid Request.Host or Request.URL.Host value.

    CVE-2023-3978:
    Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be     escaped to not be. This could lead to an XSS attack.

    CVE-2022-1227:
    A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image     to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered     after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem,     leading to information disclosure or denial of service.

    CVE-2022-21698:
    client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package     in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version     1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential     memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an     instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`;
    not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our     middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`.
    client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including     removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected     promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method     given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow     a limited set of methods.

    CVE-2022-27650:
    A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A     vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty     inheritable Linux process capabilities. This flaw allows an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

    CVE-2024-21626:
    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned     container process (from runc exec) to have a working directory in the host filesystem namespace, allowing     for a container escape by giving access to the host filesystem (attack 2). The same attack could be used     by a malicious image to allow a container process to gain access to the host filesystem through runc run     (attack 1). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries,     allowing for complete container escapes (attack 3a and attack 3b). runc 1.1.12 includes patches for     this issue.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:6938 advisory.

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)
    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)
    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)
    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)
    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
176771	Amazon Linux 2：runc (ALASDOCKER-2023-025)	Nessus	Amazon Linux Local Security Checks	2023/6/6	2024/12/11	high
189410	RHCOS 4：OpenShift Container Platform 4.13.5 (RHSA-2023: 4093)	Nessus	Red Hat Local Security Checks	2024/1/24	2024/1/24	critical
191195	CentOS 9：runc-1.1.7-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
178585	Oracle Linux 8 : aardvark-dns (ELSA-2023-12579)	Nessus	Oracle Linux Local Security Checks	2023/7/20	2025/9/9	high
185685	RHEL 8 : container-tools:4.0 (RHSA-2023:6938)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/7/2	critical
194287	RHEL 8 / 9 : OpenShift Container Platform 4.13.4 (RHSA-2023:3612)	Nessus	Red Hat Local Security Checks	2024/4/28	2025/8/15	critical
203502	Photon OS 5.0: Nerdctl PHSA-2023-5.0-0044	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
203549	Photon OS 5.0: Docker PHSA-2023-5.0-0038	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
204563	Photon OS 4.0: Nerdctl PHSA-2023-4.0-0433	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
188882	EulerOS 2.0 SP11 : docker-runc (EulerOS-SA-2023-2680)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
204003	Photon OS 3.0: Runc PHSA-2023-3.0-0578	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
174595	Fedora 36 : runc (2023-1bcbb1db39)	Nessus	Fedora Local Security Checks	2023/4/21	2024/11/14	high
236060	Alibaba Cloud Linux 3 : 0050: container-tools:rhel8 (ALINUX3-SA-2024:0050)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
241160	AlmaLinux 8 : container-tools:4.0 (ALSA-2023:6938)	Nessus	Alma Linux Local Security Checks	2025/7/2	2025/7/2	critical

检测

插件搜索

high

critical

high

high

critical

critical

high

high

high

high

high

high

critical

critical