The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0683 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-9341:
    A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle     certain file paths due to improper validation in the containers/common Go library. This flaw allows an     attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a     container. This issue also allows attackers to access critical host files, bypassing the intended     isolation between containers and the host system.

    CVE-2024-9407:
    A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The     system does not properly validate the input passed to this option, allowing users to pass arbitrary     parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the     host into a container during the build process and, in some cases, modify the contents of those mounted     files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source     directory to be relabeled to give the container access to host files.

    CVE-2024-9675:
    A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for     the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an     arbitrary directory from the host (read/write) into the container as long as those files can be accessed     by the user running Buildah.

    CVE-2024-9676:
    A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the     containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service     via OOM kill when running a malicious image using an automatically assigned user namespace     (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the     container, but does not properly validate if that file is a symlink, which can be used to cause the     library to read an arbitrary file on the host.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0775-1 advisory.

    - CVE-2025-27144: Fixed denial of service in parsing function of embedded library Go JOSE (bsc#1237641)
    - CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the     containers/storage library can cause Denial of Service (DoS) (bsc#1231698)
    - CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)
    - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount     Instruction in buildah (bsc#1231208)
    - CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (bsc#1231230)
    - CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)
    - CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a     malicious Containerfile. (bsc#1236270)
    - CVE-2024-6104: Fixed hashicorp/go-retryablehttp writing sensitive information to log files (bsc#1227052)
    - CVE-2023-45288: Fixed golang.org/x/net/http2 excessive resource consumption when receiving too many     headers (bsc#1236507)


    - Load ip_tables and ip6_tables kernel module (bsc#1214612)
      * Required for rootless mode as a regular user has no permission         to load kernel modules


    - Refactor network backend dependencies:
      * podman requires either netavark or cni-plugins. On ALP, require         netavark, otherwise prefer netavark but don't force it.
      * This fixes missing cni-plugins in some scenarios
      * Default to netavark everywhere where it's available

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:7925 advisory.

  - Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library     (CVE-2024-9341)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
239202	TencentOS Server 4: podman (TSSA-2024:0683)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium
225811	SUSE SLES15 Security Update : podman (SUSE-SU-2025:0775-1)	Nessus	SuSE Local Security Checks	2025/3/5	2025/3/5	high
311903	RHCOS 4 : OpenShift Container Platform 4.17.1 (RHSA-2024:7925)	Nessus	Red Hat Local Security Checks	2026/5/4	2026/5/4	medium

检测

插件搜索

medium

high

medium