An update of the nerdctl package has been released.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6939 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * containerd: Supplementary groups are not set up properly (CVE-2023-25173)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6938 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6938 advisory.

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)

    * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

    * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

    * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)

    * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

    * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

    * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

    * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6088-1 advisory.

    It was discovered that runC incorrectly made /sys/fs/cgroup writable when in rootless mode. An attacker     could possibly use this issue to escalate privileges. (CVE-2023-25809)

    It was discovered that runC incorrectly performed access control when mounting /proc to non-directories.
    An attacker could possibly use this issue to escalate privileges. (CVE-2023-27561)

    It was discovered that runC incorrectly handled /proc and

    /sys mounts inside a container. An attacker could possibly use this issue to bypass AppArmor, and     potentially SELinux. (CVE-2023-28642)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6380 advisory.

    The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides     container runtime.

    Security Fix(es):

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

    * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)

    * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

    * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)

    * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based     container configuration (CVE-2021-43784)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-2.el9 build changelog.

  - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In     runc, netlink is used internally as a serialization system for specifying the relevant container     configuration to the `C` portion of the code (responsible for the based namespace setup of containers). In     all versions of runc prior to 1.0.3, the encoder did not handle the possibility of an integer overflow in     the 16-bit length field for the byte array attribute type, meaning that a large enough malicious byte     array attribute could result in the length overflowing and the attribute contents being parsed as netlink     messages for container configuration. This vulnerability requires the attacker to have some control over     the configuration of the container and would allow the attacker to bypass the namespace restrictions of     the container by simply adding their own netlink payload which disables all namespaces. The main users     impacted are those who allow untrusted images with untrusted configurations to run on their machines (such     as with shared cloud infrastructure). runc version 1.0.3 contains a fix for this bug. As a workaround, one     may try disallowing untrusted namespace paths from your container. It should be noted that untrusted     namespace paths would allow the attacker to disable namespace protections entirely even in the absence of     this bug. (CVE-2021-43784)

  - Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS     handshake records which cause servers and clients, respectively, to panic when attempting to construct     responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption     (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client     certificates (by setting Config.ClientAuth >= RequestClientCert). (CVE-2022-41724)

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the podman package has been released.

An update of the docker package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - runc is a CLI tool for spawning and running containers according to the OCI specification. It was found     that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR     #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted     container image. (CVE-2023-28642)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6674:03 advisory.

    * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
      * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)
      * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
      * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)
      * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based     container configuration (CVE-2021-43784)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7318:02 advisory.

    * go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents     (CVE-2022-3064)
      * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
      * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
      * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
      * golang: net/http, mime/multipart: denial of service from excessive resource consumption     (CVE-2022-41725)
      * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
      * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
      * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption     (CVE-2023-24536)
      * golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
      * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
      * golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
      * containerd: Supplementary groups are not set up properly (CVE-2023-25173)
      * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)
      * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
      * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount     configuration (CVE-2023-28642)
      * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
      * golang: net/[http:](http:) insufficient sanitization of Host header (CVE-2023-29406)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6939 advisory.

    - rebuild for following CVEs:
    CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536     CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539     CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723     CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2023-25173 CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536     CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
    - rebuild for following CVEs:
    CVE-2022-41724
    - rebuild for following CVEs:
    CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723     CVE-2023-24539 CVE-2023-24540 CVE-2023-29400
    - fix 'CVE-2020-14040 skopeo: golang.org/x/text: possibility to trigger an infinite loop in     encoding/unicode could lead to crash [rhel-8]'
    - Fix CVE-2020-1702.
    - rebuild because of CVE-2019-9512 and CVE-2019-9514
    - Fix CVE-2019-10214 (#1734651).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
204563	Photon OS 4.0: Nerdctl PHSA-2023-4.0-0433	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
185675	RHEL 8 : container-tools:rhel8 (RHSA-2023:6939)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/3/6	critical
185685	RHEL 8 : container-tools:4.0 (RHSA-2023:6938)	Nessus	Red Hat Local Security Checks	2023/11/14	2025/7/2	critical
277154	RockyLinux 8 : container-tools:4.0 (RLSA-2023:6938)	Nessus	Rocky Linux Local Security Checks	2025/12/3	2025/12/3	critical
176064	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.04 : runC vulnerabilities (USN-6088-1)	Nessus	Ubuntu Local Security Checks	2023/5/18	2024/8/27	high
185109	RHEL 9 : runc (RHSA-2023:6380)	Nessus	Red Hat Local Security Checks	2023/11/7	2025/3/6	high
191389	CentOS 9 : runc-1.1.7-2.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
203502	Photon OS 5.0: Nerdctl PHSA-2023-5.0-0044	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
203522	Photon OS 4.0: Podman PHSA-2023-4.0-0429	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
203549	Photon OS 5.0: Docker PHSA-2023-5.0-0038	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	high
204567	Photon OS 4.0: Docker PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
227038	Linux Distros Unpatched Vulnerability : CVE-2023-28642	Nessus	Misc.	2025/3/5	2025/9/14	high
293440	MiracleLinux 9 : runc-1.1.9-1.el9 (AXSA:2023-6674:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
293102	MiracleLinux 8 : container-tools:rhel8 (AXSA:2023-7318:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
186122	Oracle Linux 8 : container-tools:ol8 (ELSA-2023-6939)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	critical

检测

插件搜索

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

critical

critical