Vulnerabilities > CVE-2019-10214 - Insufficiently Protected Credentials vulnerability in multiple products

047910
CVSS 5.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
high complexity
redhat
skopeo-project
buildah-project
libpod-project
opensuse
CWE-522
nessus
NVD
Published: 2019-11-25
Updated: 2024-11-21

Summary

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

Vulnerable Configurations

Part Description Count
OS
Redhat
1
OS
Opensuse
1
Application
Redhat
1
Application
Skopeo_Project
1
Application
Buildah_Project
1
Application
Libpod_Project
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Session Sidejacking
    Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
  • Lifting credential(s)/key material embedded in client distributions (thick or thin)
    An attacker examines a target application's code or configuration files to find credential or key material that has been embedded within the application or its files. Many services require authentication with their users for the various purposes including billing, access control or attribution. Some client applications store the user's authentication credentials or keys to accelerate the login process. Some clients may have built-in keys or credentials (in which case the server is authenticating with the client, rather than the user). If the attacker is able to locate where this information is stored, they may be able to retrieve these credentials. The attacker could then use these stolen credentials to impersonate the user or client, respectively, in interactions with the service or use stolen keys to eavesdrop on nominally secure communications between the client and server.
  • Password Recovery Exploitation
    An attacker may take advantage of the application feature to help users recover their forgotten passwords in order to gain access into the system with the same privileges as the original user. Generally password recovery schemes tend to be weak and insecure. Most of them use only one security question . For instance, mother's maiden name tends to be a fairly popular one. Unfortunately in many cases this information is not very hard to find, especially if the attacker knows the legitimate user. These generic security questions are also re-used across many applications, thus making them even more insecure. An attacker could for instance overhear a coworker talking to a bank representative at the work place and supplying their mother's maiden name for verification purposes. An attacker can then try to log in into one of the victim's accounts, click on "forgot password" and there is a good chance that the security question there will be to provide mother's maiden name. A weak password recovery scheme totally undermines the effectiveness of a strong password scheme.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-377.NASL
    descriptionThis update for skopeo fixes the following issues : Update to skopeo v0.1.41 (bsc#1165715) : - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 - Bump github.com/containers/common from 0.0.7 to 0.1.4 - Remove the reference to openshift/api - vendor github.com/containers/image/[email protected] - Manually update buildah to v1.13.1 - add specific authfile options to copy (and sync) command. - Bump github.com/containers/buildah from 1.11.6 to 1.12.0 - Add context to --encryption-key / --decryption-key processing failures - Bump github.com/containers/storage from 1.15.2 to 1.15.3 - Bump github.com/containers/buildah from 1.11.5 to 1.11.6 - remove direct reference on c/image/storage - Makefile: set GOBIN - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 - Bump github.com/containers/storage from 1.15.1 to 1.15.2 - Introduce the sync command - openshift cluster: remove .docker directory on teardown - Bump github.com/containers/storage from 1.14.0 to 1.15.1 - document installation via apk on alpine - Fix typos in doc for image encryption - Image encryption/decryption support in skopeo - make vendor-in-container - Bump github.com/containers/buildah from 1.11.4 to 1.11.5 - Travis: use go v1.13 - Use a Windows Nano Server image instead of Server Core for multi-arch testing - Increase test timeout to 15 minutes - Run the test-system container without --net=host - Mount /run/systemd/journal/socket into test-system containers - Don
    last seen2020-03-31
    modified2020-03-26
    plugin id134933
    published2020-03-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134933
    titleopenSUSE Security Update : skopeo (openSUSE-2020-377)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2020-377.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(134933);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/30");

  script_cve_id("CVE-2019-10214");

  script_name(english:"openSUSE Security Update : skopeo (openSUSE-2020-377)");
  script_summary(english:"Check for the openSUSE-2020-377 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for skopeo fixes the following issues :

Update to skopeo v0.1.41 (bsc#1165715) :

  - Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1

  - Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8

  - Bump github.com/containers/common from 0.0.7 to 0.1.4

  - Remove the reference to openshift/api

  - vendor github.com/containers/image/[email protected]

  - Manually update buildah to v1.13.1

  - add specific authfile options to copy (and sync)
    command.

  - Bump github.com/containers/buildah from 1.11.6 to 1.12.0

  - Add context to --encryption-key / --decryption-key
    processing failures

  - Bump github.com/containers/storage from 1.15.2 to 1.15.3

  - Bump github.com/containers/buildah from 1.11.5 to 1.11.6

  - remove direct reference on c/image/storage

  - Makefile: set GOBIN

  - Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7

  - Bump github.com/containers/storage from 1.15.1 to 1.15.2

  - Introduce the sync command

  - openshift cluster: remove .docker directory on teardown

  - Bump github.com/containers/storage from 1.14.0 to 1.15.1

  - document installation via apk on alpine

  - Fix typos in doc for image encryption

  - Image encryption/decryption support in skopeo

  - make vendor-in-container

  - Bump github.com/containers/buildah from 1.11.4 to 1.11.5

  - Travis: use go v1.13

  - Use a Windows Nano Server image instead of Server Core
    for multi-arch testing

  - Increase test timeout to 15 minutes

  - Run the test-system container without --net=host

  - Mount /run/systemd/journal/socket into test-system
    containers

  - Don't unnecessarily filter out vendor from (go list
    ./...) output

  - Use -mod=vendor in (go (list,test,vet))

  - Bump github.com/containers/buildah from 1.8.4 to 1.11.4

  - Bump github.com/urfave/cli from 1.20.0 to 1.22.1

  - skopeo: drop support for ostree

  - Don't critically fail on a 403 when listing tags

  - Revert 'Temporarily work around auth.json location
    confusion'

  - Remove references to atomic

  - Remove references to storage.conf

  - Dockerfile: use golang-github-cpuguy83-go-md2man

  - bump version to v0.1.41-dev

  - systemtest: inspect container image different from
    current platform arch

Changes in v0.1.40 :

  - vendor containers/image v5.0.0

  - copy: add a --all/-a flag

  - System tests: various fixes

  - Temporarily work around auth.json location confusion

  - systemtest: copy: docker->storage->oci-archive

  - systemtest/010-inspect.bats: require only PATH

  - systemtest: add simple env test in inspect.bats

  - bash completion: add comments to keep scattered options
    in sync

  - bash completion: use read -r instead of disabling SC2207

  - bash completion: support --opt arg completion

  - bash-completion: use replacement instead of sed

  - bash completion: disable shellcheck SC2207

  - bash completion: double-quote to avoid re-splitting

  - bash completions: use bash replacement instead of sed

  - bash completion: remove unused variable

  - bash-completions: split decl and assignment to avoid
    masking retvals

  - bash completion: double-quote fixes

  - bash completion: hard-set PROG=skopeo

  - bash completion: remove unused variable

  - bash completion: use `||` instead of `-o`

  - bash completion: rm eval on assigned variable

  - copy: add --dest-compress-format and
    --dest-compress-level

  - flag: add optionalIntValue

  - Makefile: use go proxy

  - inspect --raw: skip the NewImage() step

  - update OCI image-spec to
    775207bd45b6cb8153ce218cc59351799217451f

  - inspect.go: inspect env variables

  - ostree: use both image and & storage buildtags

Update to skopeo v0.1.39 (bsc#1159530) :

  - inspect: add a --config flag

  - Add --no-creds flag to skopeo inspect

  - Add --quiet option to skopeo copy

  - New progress bars

  - Parallel Pulls and Pushes for major speed improvements

  - containers/image moved to a new progress-bar library to
    fix various issues related to overlapping bars and
    redundant entries.

  - enforce blocking of registries

  - Allow storage-multiple-manifests

  - When copying images and the output is not a tty (e.g.,
    when piping to a file) print single lines instead of
    using progress bars. This avoids long and hard to parse
    output

  - man pages: add --dest-oci-accept-uncompressed-layers

  - completions :

  - Introduce transports completions

  - Fix bash completions when a option requires a argument

  - Use only spaces in indent

  - Fix completions with a global option

  - add --dest-oci-accept-uncompressed-layers

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1159530"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1165715"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected skopeo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.1", reference:"skopeo-0.1.41-lp151.2.6.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"skopeo-debuginfo-0.1.41-lp151.2.6.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "skopeo / skopeo-debuginfo");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2138.NASL
    descriptionThis update for skopeo fixes the following issues : Security issues fixed : - CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id128868
    published2019-09-16
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128868
    titleopenSUSE Security Update : skopeo (openSUSE-2019-2138)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-2138.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(128868);
  script_version("1.3");
  script_cvs_date("Date: 2019/12/27");

  script_cve_id("CVE-2019-10214");

  script_name(english:"openSUSE Security Update : skopeo (openSUSE-2019-2138)");
  script_summary(english:"Check for the openSUSE-2019-2138 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for skopeo fixes the following issues :

Security issues fixed :

  - CVE-2019-10214: Fixed missing enforcement of TLS
    connections (bsc#1144065).

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1144065"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected skopeo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/16");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.1", reference:"skopeo-0.1.32-lp151.2.3.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"skopeo-debuginfo-0.1.32-lp151.2.3.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "skopeo / skopeo-debuginfo");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-3403.NASL
    descriptionAn update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es) : * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378) * containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
    last seen2020-05-23
    modified2019-11-06
    plugin id130536
    published2019-11-06
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130536
    titleRHEL 8 : container-tools:rhel8 (RHSA-2019:3403)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2019:3403. The text
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(130536);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/22");

  script_cve_id("CVE-2019-10214", "CVE-2019-14378");
  script_xref(name:"RHSA", value:"2019:3403");

  script_name(english:"RHEL 8 : container-tools:rhel8 (RHSA-2019:3403)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis",
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description",
    value:
"An update for the container-tools:rhel8 module is now available for
Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security
impact of Important. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

The container-tools module contains tools for working with containers,
notably podman, buildah, skopeo, and runc.

Security Fix(es) :

* QEMU: slirp: heap buffer overflow during packet reassembly
(CVE-2019-14378)

* containers/image: not enforcing TLS when sending username+password
credentials to token servers leading to credential disclosure
(CVE-2019-10214)

For more details about the security issue(s), including the impact, a
CVSS score, acknowledgments, and other related information, refer to
the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.1 Release Notes linked from the References section."
  );
  # https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?774148ae"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2019:3403"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2019-10214"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2019-14378"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-14378");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cockpit-podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:container-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containers-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-systemd-hook");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-systemd-hook-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-umount");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-umount-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-manpages");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-remote");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-podman-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:toolbox");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8::appstream");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/06");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

module_ver = get_kb_item('Host/RedHat/appstream/container-tools');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);

appstreams = {
    'container-tools:rhel8': [
      {'reference':'buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'cockpit-podman-4-1.module+el8.1.0+4081+b29780af', 'release':'8'},
      {'reference':'container-selinux-2.107-2.module+el8.1.0+4081+b29780af', 'release':'8', 'epoch':'2'},
      {'reference':'containernetworking-plugins-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'containernetworking-plugins-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'containernetworking-plugins-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.1-2.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'containers-common-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'containers-common-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'containers-common-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},
      {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8', 'epoch':'2'},
      {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},
      {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},
      {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8', 'epoch':'2'},
      {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},
      {'reference':'podman-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-debugsource-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-debugsource-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-debugsource-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-docker-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'release':'8'},
      {'reference':'podman-manpages-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'release':'8'},
      {'reference':'podman-remote-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-remote-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-remote-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-tests-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-tests-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-tests-1.4.2-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8'},
      {'reference':'python-podman-api-1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af', 'release':'8'},
      {'reference':'runc-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'runc-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'runc-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-60.rc8.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'},
      {'reference':'skopeo-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.37-5.module+el8.1.0+4240+893c1ab8', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'aarch64', 'release':'8'},
      {'reference':'slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'s390x', 'release':'8'},
      {'reference':'slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'x86_64', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'aarch64', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'s390x', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805', 'cpu':'x86_64', 'release':'8'},
      {'reference':'toolbox-0.0.4-1.module+el8.1.0+4081+b29780af', 'cpu':'aarch64', 'release':'8'},
      {'reference':'toolbox-0.0.4-1.module+el8.1.0+4081+b29780af', 'cpu':'s390x', 'release':'8'},
      {'reference':'toolbox-0.0.4-1.module+el8.1.0+4081+b29780af', 'cpu':'x86_64', 'release':'8'}
    ],
};

flag = 0;
appstreams_found = 0;
foreach module (keys(appstreams)) {
  appstream = NULL;
  appstream_name = NULL;
  appstream_version = NULL;
  appstream_split = split(module, sep:':', keep:FALSE);
  if (!empty_or_null(appstream_split)) {
    appstream_name = appstream_split[0];
    appstream_version = appstream_split[1];
    if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);
  }
  if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
    appstreams_found++;
    foreach package_array ( appstreams[module] ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (reference && release) {
        if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
      }
    }
  }
}

if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-debugsource / buildah-tests / etc');
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-3812.NASL
    descriptionAn update for cri-o is now available for Red Hat OpenShift Container Platform 3.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat OpenShift Container Platform is Red Hat
    last seen2020-06-01
    modified2020-06-02
    plugin id130748
    published2019-11-08
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130748
    titleRHEL 7 : OpenShift Container Platform 3.9 cri-o (RHSA-2019:3812)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2019:3812. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(130748);
  script_version("1.2");
  script_cvs_date("Date: 2019/12/16");

  script_cve_id("CVE-2019-10214");
  script_xref(name:"RHSA", value:"2019:3812");

  script_name(english:"RHEL 7 : OpenShift Container Platform 3.9 cri-o (RHSA-2019:3812)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update for cri-o is now available for Red Hat OpenShift Container
Platform 3.9.

Red Hat Product Security has rated this update as having a security
impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or
private cloud deployments.

This advisory contains the cri-o RPM package for Red Hat OpenShift
Container Platform 3.9.102.

Security Fix(es) :

* containers/image: not enforcing TLS when sending username+password
credentials to token servers leading to credential disclosure
(CVE-2019-10214)

For more details about the security issue(s), including the impact, a
CVSS score, acknowledgments, and other related information, refer to
the CVE page(s) listed in the References section."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2019:3812"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2019-10214"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected cri-o and / or cri-o-debuginfo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cri-o");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cri-o-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/11/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/08");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2019:3812";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"cri-o-1.9.16-5.git858756d.el7")) flag++;
  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"cri-o-debuginfo-1.9.16-5.git858756d.el7")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cri-o / cri-o-debuginfo");
  }
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2020-0712-1.NASL
    descriptionThis update for skopeo fixes the following issues : Update to skopeo v0.1.41 (bsc#1165715) : Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1 Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8 Bump github.com/containers/common from 0.0.7 to 0.1.4 Remove the reference to openshift/api vendor github.com/containers/image/[email protected] Manually update buildah to v1.13.1 add specific authfile options to copy (and sync) command. Bump github.com/containers/buildah from 1.11.6 to 1.12.0 Add context to --encryption-key / --decryption-key processing failures Bump github.com/containers/storage from 1.15.2 to 1.15.3 Bump github.com/containers/buildah from 1.11.5 to 1.11.6 remove direct reference on c/image/storage Makefile: set GOBIN Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7 Bump github.com/containers/storage from 1.15.1 to 1.15.2 Introduce the sync command openshift cluster: remove .docker directory on teardown Bump github.com/containers/storage from 1.14.0 to 1.15.1 document installation via apk on alpine Fix typos in doc for image encryption Image encryption/decryption support in skopeo make vendor-in-container Bump github.com/containers/buildah from 1.11.4 to 1.11.5 Travis: use go v1.13 Use a Windows Nano Server image instead of Server Core for multi-arch testing Increase test timeout to 15 minutes Run the test-system container without --net=host Mount /run/systemd/journal/socket into test-system containers Don
    last seen2020-03-24
    modified2020-03-19
    plugin id134697
    published2020-03-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134697
    titleSUSE SLES15 Security Update : skopeo (SUSE-SU-2020:0712-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2020:0712-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(134697);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/23");

  script_cve_id("CVE-2019-10214");

  script_name(english:"SUSE SLES15 Security Update : skopeo (SUSE-SU-2020:0712-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for skopeo fixes the following issues :

Update to skopeo v0.1.41 (bsc#1165715) :

Bump github.com/containers/image/v5 from 5.2.0 to 5.2.1

Bump gopkg.in/yaml.v2 from 2.2.7 to 2.2.8

Bump github.com/containers/common from 0.0.7 to 0.1.4

Remove the reference to openshift/api

vendor github.com/containers/image/[email protected]

Manually update buildah to v1.13.1

add specific authfile options to copy (and sync) command.

Bump github.com/containers/buildah from 1.11.6 to 1.12.0

Add context to --encryption-key / --decryption-key processing failures

Bump github.com/containers/storage from 1.15.2 to 1.15.3

Bump github.com/containers/buildah from 1.11.5 to 1.11.6

remove direct reference on c/image/storage

Makefile: set GOBIN

Bump gopkg.in/yaml.v2 from 2.2.2 to 2.2.7

Bump github.com/containers/storage from 1.15.1 to 1.15.2

Introduce the sync command

openshift cluster: remove .docker directory on teardown

Bump github.com/containers/storage from 1.14.0 to 1.15.1

document installation via apk on alpine

Fix typos in doc for image encryption

Image encryption/decryption support in skopeo

make vendor-in-container

Bump github.com/containers/buildah from 1.11.4 to 1.11.5

Travis: use go v1.13

Use a Windows Nano Server image instead of Server Core for multi-arch
testing

Increase test timeout to 15 minutes

Run the test-system container without --net=host

Mount /run/systemd/journal/socket into test-system containers

Don't unnecessarily filter out vendor from (go list ./...) output

Use -mod=vendor in (go {list,test,vet})

Bump github.com/containers/buildah from 1.8.4 to 1.11.4

Bump github.com/urfave/cli from 1.20.0 to 1.22.1

skopeo: drop support for ostree

Don't critically fail on a 403 when listing tags

Revert 'Temporarily work around auth.json location confusion'

Remove references to atomic

Remove references to storage.conf

Dockerfile: use golang-github-cpuguy83-go-md2man

bump version to v0.1.41-dev

systemtest: inspect container image different from current platform
arch

Changes in v0.1.40: vendor containers/image v5.0.0

copy: add a --all/-a flag

System tests: various fixes

Temporarily work around auth.json location confusion

systemtest: copy: docker->storage->oci-archive

systemtest/010-inspect.bats: require only PATH

systemtest: add simple env test in inspect.bats

bash completion: add comments to keep scattered options in sync

bash completion: use read -r instead of disabling SC2207

bash completion: support --opt arg completion

bash-completion: use replacement instead of sed

bash completion: disable shellcheck SC2207

bash completion: double-quote to avoid re-splitting

bash completions: use bash replacement instead of sed

bash completion: remove unused variable

bash-completions: split decl and assignment to avoid masking retvals

bash completion: double-quote fixes

bash completion: hard-set PROG=skopeo

bash completion: remove unused variable

bash completion: use `||` instead of `-o`

bash completion: rm eval on assigned variable

copy: add --dest-compress-format and --dest-compress-level

flag: add optionalIntValue

Makefile: use go proxy

inspect --raw: skip the NewImage() step

update OCI image-spec to 775207bd45b6cb8153ce218cc59351799217451f

inspect.go: inspect env variables

ostree: use both image and & storage buildtags

Update to skopeo v0.1.39 (bsc#1159530): inspect: add a --config flag

Add --no-creds flag to skopeo inspect

Add --quiet option to skopeo copy

New progress bars

Parallel Pulls and Pushes for major speed improvements

containers/image moved to a new progress-bar library to fix various
issues related to overlapping bars and redundant entries.

enforce blocking of registries

Allow storage-multiple-manifests

When copying images and the output is not a tty (e.g., when piping to
a file) print single lines instead of using progress bars. This avoids
long and hard to parse output

man pages: add --dest-oci-accept-uncompressed-layers

completions :

  - Introduce transports completions

  - Fix bash completions when a option requires a argument

  - Use only spaces in indent

  - Fix completions with a global option

  - add --dest-oci-accept-uncompressed-layers

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1159530"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1165715"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-10214/"
  );
  # https://www.suse.com/support/update/announcement/2020/suse-su-20200712-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?3b5c5e74"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Server Applications 15-SP1:zypper in
-t patch SUSE-SLE-Module-Server-Applications-15-SP1-2020-712=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:skopeo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/19");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP1", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES15", sp:"1", reference:"skopeo-0.1.41-4.11.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"skopeo-debuginfo-0.1.41-4.11.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "skopeo");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2341-1.NASL
    descriptionThis update for buildah fixes the following issues : Security issue fixed : CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128674
    published2019-09-11
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128674
    titleSUSE SLES15 Security Update : buildah (SUSE-SU-2019:2341-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:2341-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(128674);
  script_version("1.3");
  script_cvs_date("Date: 2019/12/27");

  script_cve_id("CVE-2019-10214");

  script_name(english:"SUSE SLES15 Security Update : buildah (SUSE-SU-2019:2341-1)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for buildah fixes the following issues :

Security issue fixed :

CVE-2019-10214: Fixed missing enforcement of TLS connections.
(bsc#1144065)

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1144065"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-10214/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20192341-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?16bdac62"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Containers 15-SP1:zypper in -t patch
SUSE-SLE-Module-Containers-15-SP1-2019-2341=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:buildah");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP1", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES15", sp:"1", reference:"buildah-1.7.1-3.3.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "buildah");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2159.NASL
    descriptionThis update for skopeo fixes the following issues : Security issues fixed : - CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065). This update was imported from the SUSE:SLE-15:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id129335
    published2019-09-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129335
    titleopenSUSE Security Update : skopeo (openSUSE-2019-2159)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-2159.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(129335);
  script_version("1.3");
  script_cvs_date("Date: 2019/12/23");

  script_cve_id("CVE-2019-10214");

  script_name(english:"openSUSE Security Update : skopeo (openSUSE-2019-2159)");
  script_summary(english:"Check for the openSUSE-2019-2159 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for skopeo fixes the following issues :

Security issues fixed :

  - CVE-2019-10214: Fixed missing enforcement of TLS
    connections (bsc#1144065).

This update was imported from the SUSE:SLE-15:Update update project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1144065"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected skopeo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:skopeo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.0)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.0", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.0", reference:"skopeo-0.1.32-lp150.8.1") ) flag++;
if ( rpm_check(release:"SUSE15.0", reference:"skopeo-debuginfo-0.1.32-lp150.8.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "skopeo / skopeo-debuginfo");
}
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2340-1.NASL
    descriptionThis update for skopeo fixes the following issues : Security issues fixed : CVE-2019-10214: Fixed missing enforcement of TLS connections (bsc#1144065). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128673
    published2019-09-11
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128673
    titleSUSE SLES15 Security Update : skopeo (SUSE-SU-2019:2340-1)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2019:2340-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(128673);
  script_version("1.3");
  script_cvs_date("Date: 2019/12/27");

  script_cve_id("CVE-2019-10214");

  script_name(english:"SUSE SLES15 Security Update : skopeo (SUSE-SU-2019:2340-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for skopeo fixes the following issues :

Security issues fixed :

CVE-2019-10214: Fixed missing enforcement of TLS connections
(bsc#1144065).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=1144065"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2019-10214/"
  );
  # https://www.suse.com/support/update/announcement/2019/suse-su-20192340-1/
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?b082656f"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use the SUSE recommended
installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Server Applications 15-SP1:zypper in
-t patch SUSE-SLE-Module-Server-Applications-15-SP1-2019-2340=1

SUSE Linux Enterprise Module for Server Applications 15:zypper in -t
patch SUSE-SLE-Module-Server-Applications-15-2019-2340=1"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:skopeo-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES15" && (! preg(pattern:"^(0|1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0/1", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES15", sp:"1", reference:"skopeo-0.1.32-4.8.1")) flag++;
if (rpm_check(release:"SLES15", sp:"1", reference:"skopeo-debuginfo-0.1.32-4.8.1")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"skopeo-0.1.32-4.8.1")) flag++;
if (rpm_check(release:"SLES15", sp:"0", reference:"skopeo-debuginfo-0.1.32-4.8.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "skopeo");
}
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2825.NASL
    descriptionAn update for cri-o is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat OpenShift Container Platform is Red Hat
    last seen2020-06-01
    modified2020-06-02
    plugin id129331
    published2019-09-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129331
    titleRHEL 7 / 8 : OpenShift Container Platform 4.1.17 cri-o (RHSA-2019:2825)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2019:2825. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(129331);
  script_version("1.7");
  script_cvs_date("Date: 2019/12/23");

  script_cve_id("CVE-2019-10214");
  script_xref(name:"RHSA", value:"2019:2825");

  script_name(english:"RHEL 7 / 8 : OpenShift Container Platform 4.1.17 cri-o (RHSA-2019:2825)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update for cri-o is now available for Red Hat OpenShift Container
Platform 4.1.

Red Hat Product Security has rated this update as having a security
impact of Moderate. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or
private cloud deployments.

This advisory contains cri-o RPM packages for Red Hat OpenShift
Container Platform 4.1.17.

Security Fix(es) :

* containers/image: not enforcing TLS when sending username+password
credentials to token servers leading to credential disclosure
(CVE-2019-10214)

For more details about the security issue(s), including the impact, a
CVSS score, acknowledgments, and other related information, refer to
the CVE page(s) listed in the References section."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2019:2825"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2019-10214"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected cri-o and / or cri-o-debuginfo packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cri-o");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cri-o-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^(7|8)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.x / 8.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2019:2825";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"cri-o-1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7")) flag++;
  if (rpm_check(release:"RHEL7", cpu:"x86_64", reference:"cri-o-debuginfo-1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7")) flag++;

  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"cri-o-1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cri-o / cri-o-debuginfo");
  }
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2143.NASL
    descriptionThis update for podman fixes the following issues : Security issue fixed : - CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065) This update was imported from the SUSE:SLE-15-SP1:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id128965
    published2019-09-17
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128965
    titleopenSUSE Security Update : podman (openSUSE-2019-2143)
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2019-2143.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(128965);
  script_version("1.3");
  script_cvs_date("Date: 2019/12/27");

  script_cve_id("CVE-2019-10214");

  script_name(english:"openSUSE Security Update : podman (openSUSE-2019-2143)");
  script_summary(english:"Check for the openSUSE-2019-2143 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update for podman fixes the following issues :

Security issue fixed :

  - CVE-2019-10214: Fixed missing enforcement of TLS
    connections. (bsc#1144065)

This update was imported from the SUSE:SLE-15-SP1:Update update
project."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1144065"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected podman packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:podman-cni-config");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:15.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/11/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/09/17");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE15\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "15.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE15.1", reference:"podman-1.4.4-lp151.3.6.1") ) flag++;
if ( rpm_check(release:"SUSE15.1", reference:"podman-cni-config-1.4.4-lp151.3.6.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "podman / podman-cni-config");
}
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2020-554.NASL
    descriptionThis update introduces kubernetes version 1.14.1 and cri-o 1.17.1 to Leap 15.1.
    last seen2020-04-30
    modified2020-04-27
    plugin id136011
    published2020-04-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136011
    titleopenSUSE Security Update : kubernetes (openSUSE-2020-554) (Dirty COW)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-2137.NASL
    descriptionThis update for buildah fixes the following issues : Security issue fixed : - CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065) This update was imported from the SUSE:SLE-15-SP1:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id128867
    published2019-09-16
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128867
    titleopenSUSE Security Update : buildah (openSUSE-2019-2137)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-2346-1.NASL
    descriptionThis update for podman fixes the following issues : Security issue fixed : CVE-2019-10214: Fixed missing enforcement of TLS connections. (bsc#1144065) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id128676
    published2019-09-11
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/128676
    titleSUSE SLES15 Security Update : podman (SUSE-SU-2019:2346-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2817.NASL
    descriptionAn update for cri-o is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat OpenShift Container Platform is Red Hat
    last seen2020-06-01
    modified2020-06-02
    plugin id129265
    published2019-09-24
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129265
    titleRHEL 7 : OpenShift Container Platform 3.11 (RHSA-2019:2817) (Ping Flood) (Reset Flood)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2989.NASL
    descriptionAn update for atomic-openshift kube-apiserver is now available for Red Hat OpenShift Container Platform 3.10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat OpenShift Container Platform is Red Hat
    last seen2020-06-01
    modified2020-06-02
    plugin id129859
    published2019-10-15
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129859
    titleRHEL 7 : OpenShift Container Platform 3.10 atomic-openshift kube-apiserver (RHSA-2019:2989)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-3494.NASL
    descriptionAn update for the container-tools:1.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es) : * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378) * containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure (CVE-2019-10214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
    last seen2020-05-23
    modified2019-11-06
    plugin id130544
    published2019-11-06
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130544
    titleRHEL 8 : container-tools:1.0 (RHSA-2019:3494)

Redhat

rpms
  • cri-o-0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7
  • cri-o-debuginfo-0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7
  • cri-o-0:1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7
  • cri-o-0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8
  • cri-o-debuginfo-0:1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7
  • cri-o-debuginfo-0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8
  • cri-o-debugsource-0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8
  • atomic-openshift-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-clients-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-clients-redistributable-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-docker-excluder-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-excluder-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-hyperkube-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-hypershift-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-master-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-node-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-pod-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-sdn-ovs-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-template-service-broker-0:3.10.175-1.git.0.f9f0e81.el7
  • atomic-openshift-tests-0:3.10.175-1.git.0.f9f0e81.el7
  • cri-o-0:1.10.6-2.rhaos3.10.git56d7d9a.el7
  • buildah-0:1.9.0-5.module+el8.1.0+4240+893c1ab8
  • buildah-debuginfo-0:1.9.0-5.module+el8.1.0+4240+893c1ab8
  • buildah-debugsource-0:1.9.0-5.module+el8.1.0+4240+893c1ab8
  • buildah-tests-0:1.9.0-5.module+el8.1.0+4240+893c1ab8
  • buildah-tests-debuginfo-0:1.9.0-5.module+el8.1.0+4240+893c1ab8
  • cockpit-podman-0:4-1.module+el8.1.0+4081+b29780af
  • container-selinux-2:2.107-2.module+el8.1.0+4081+b29780af
  • containernetworking-plugins-0:0.8.1-2.module+el8.1.0+4081+b29780af
  • containernetworking-plugins-debuginfo-0:0.8.1-2.module+el8.1.0+4081+b29780af
  • containernetworking-plugins-debugsource-0:0.8.1-2.module+el8.1.0+4081+b29780af
  • containers-common-1:0.1.37-5.module+el8.1.0+4240+893c1ab8
  • fuse-overlayfs-0:0.4.1-1.module+el8.1.0+4081+b29780af
  • fuse-overlayfs-debuginfo-0:0.4.1-1.module+el8.1.0+4081+b29780af
  • fuse-overlayfs-debugsource-0:0.4.1-1.module+el8.1.0+4081+b29780af
  • oci-systemd-hook-1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
  • oci-systemd-hook-debuginfo-1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
  • oci-systemd-hook-debugsource-1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af
  • oci-umount-2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
  • oci-umount-debuginfo-2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
  • oci-umount-debugsource-2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af
  • podman-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-debuginfo-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-debugsource-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-docker-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-manpages-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-remote-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-remote-debuginfo-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • podman-tests-0:1.4.2-5.module+el8.1.0+4240+893c1ab8
  • python-podman-api-0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af
  • runc-0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
  • runc-debuginfo-0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
  • runc-debugsource-0:1.0.0-60.rc8.module+el8.1.0+4081+b29780af
  • skopeo-1:0.1.37-5.module+el8.1.0+4240+893c1ab8
  • skopeo-debuginfo-1:0.1.37-5.module+el8.1.0+4240+893c1ab8
  • skopeo-debugsource-1:0.1.37-5.module+el8.1.0+4240+893c1ab8
  • skopeo-tests-1:0.1.37-5.module+el8.1.0+4240+893c1ab8
  • slirp4netns-0:0.3.0-4.module+el8.1.0+4306+1d917805
  • slirp4netns-debuginfo-0:0.3.0-4.module+el8.1.0+4306+1d917805
  • slirp4netns-debugsource-0:0.3.0-4.module+el8.1.0+4306+1d917805
  • toolbox-0:0.0.4-1.module+el8.1.0+4081+b29780af
  • buildah-0:1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183
  • buildah-debuginfo-0:1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183
  • buildah-debugsource-0:1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183
  • container-selinux-2:2.94-1.git1e99f1d.module+el8.1.0+3468+011f0ab0
  • containernetworking-plugins-0:0.7.4-3.git9ebe139.module+el8.1.0+3468+011f0ab0
  • containernetworking-plugins-debuginfo-0:0.7.4-3.git9ebe139.module+el8.1.0+3468+011f0ab0
  • containernetworking-plugins-debugsource-0:0.7.4-3.git9ebe139.module+el8.1.0+3468+011f0ab0
  • containers-common-1:0.1.32-5.git1715c90.module+el8.1.0+4241+a7060183
  • fuse-overlayfs-0:0.3-5.module+el8.1.0+3468+011f0ab0
  • fuse-overlayfs-debuginfo-0:0.3-5.module+el8.1.0+3468+011f0ab0
  • fuse-overlayfs-debugsource-0:0.3-5.module+el8.1.0+3468+011f0ab0
  • oci-systemd-hook-1:0.1.15-2.git2d0b8a3.module+el8.1.0+3468+011f0ab0
  • oci-systemd-hook-debuginfo-1:0.1.15-2.git2d0b8a3.module+el8.1.0+3468+011f0ab0
  • oci-systemd-hook-debugsource-1:0.1.15-2.git2d0b8a3.module+el8.1.0+3468+011f0ab0
  • oci-umount-2:2.3.4-2.git87f9237.module+el8.1.0+3468+011f0ab0
  • oci-umount-debuginfo-2:2.3.4-2.git87f9237.module+el8.1.0+3468+011f0ab0
  • oci-umount-debugsource-2:2.3.4-2.git87f9237.module+el8.1.0+3468+011f0ab0
  • podman-0:1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • podman-debuginfo-0:1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • podman-debugsource-0:1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • podman-docker-0:1.0.0-3.git921f98f.module+el8.1.0+4241+a7060183
  • runc-0:1.0.0-55.rc5.dev.git2abd837.module+el8.1.0+3468+011f0ab0
  • runc-debuginfo-0:1.0.0-55.rc5.dev.git2abd837.module+el8.1.0+3468+011f0ab0
  • runc-debugsource-0:1.0.0-55.rc5.dev.git2abd837.module+el8.1.0+3468+011f0ab0
  • skopeo-1:0.1.32-5.git1715c90.module+el8.1.0+4241+a7060183
  • skopeo-debuginfo-1:0.1.32-5.git1715c90.module+el8.1.0+4241+a7060183
  • skopeo-debugsource-1:0.1.32-5.git1715c90.module+el8.1.0+4241+a7060183
  • slirp4netns-0:0.1-3.dev.gitc4e1bc5.module+el8.1.0+4308+9d868e48
  • slirp4netns-debuginfo-0:0.1-3.dev.gitc4e1bc5.module+el8.1.0+4308+9d868e48
  • slirp4netns-debugsource-0:0.1-3.dev.gitc4e1bc5.module+el8.1.0+4308+9d868e48
  • cri-o-0:1.9.16-5.git858756d.el7
  • cri-o-debuginfo-0:1.9.16-5.git858756d.el7

References