Vulnerabilities > CVE-2020-10696 - Path Traversal vulnerability in multiple products

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
buildah-project
redhat
CWE-22
nessus

Summary

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Vulnerable Configurations

Part Description Count
Application
Buildah_Project
52
Application
Redhat
1
OS
Redhat
2

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Relative Path Traversal
    An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
  • Directory Traversal
    An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic
    This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1926.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1926 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-21
    modified2020-04-29
    plugin id136064
    published2020-04-29
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136064
    titleRHEL 8 : container-tools:1.0 (RHSA-2020:1926)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:1926. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    
    include('compat.inc');
    
    if (description)
    {
      script_id(136064);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/20");
    
      script_cve_id("CVE-2020-10696");
      script_xref(name:"RHSA", value:"2020:1926");
    
      script_name(english:"RHEL 8 : container-tools:1.0 (RHSA-2020:1926)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Red Hat host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in
    the RHSA-2020:1926 advisory.
    
      - buildah: Crafted input tar file may lead to local file
        overwrite during image build process (CVE-2020-10696)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/22.html");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1926");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-10696");
      script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1817651");
      script_set_attribute(attribute:"solution", value:
    "Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-10696");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_cwe_id(22);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8::appstream");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:container-selinux");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containers-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:crit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-systemd-hook");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-systemd-hook-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-umount");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:oci-umount-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-criu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns-debugsource");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Red Hat Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('rpm.inc');
    
    if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item('Host/RedHat/release');
    if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
    os_ver = os_ver[1];
    if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);
    
    if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item('Host/cpu');
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    module_ver = get_kb_item('Host/RedHat/appstream/container-tools');
    if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:1.0');
    if ('1.0' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);
    
    appstreams = {
        'container-tools:1.0': [
          {'reference':'buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'buildah-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'buildah-debugsource-1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'container-selinux-2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca', 'release':'8', 'epoch':'2'},
          {'reference':'containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'containernetworking-plugins-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'containernetworking-plugins-debugsource-0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
          {'reference':'containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
          {'reference':'containers-common-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
          {'reference':'crit-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'crit-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'crit-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'criu-debugsource-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'fuse-overlayfs-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'fuse-overlayfs-debugsource-0.3-5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
          {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
          {'reference':'oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
          {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
          {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
          {'reference':'oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
          {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},
          {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'2'},
          {'reference':'oci-umount-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},
          {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},
          {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'2'},
          {'reference':'oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},
          {'reference':'podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'podman-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'podman-debugsource-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'podman-docker-1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca', 'release':'8'},
          {'reference':'python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'python3-criu-3.12-9.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'runc-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'runc-debugsource-1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
          {'reference':'skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
          {'reference':'skopeo-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
          {'reference':'skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
          {'reference':'skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
          {'reference':'skopeo-debugsource-0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
          {'reference':'slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'slirp4netns-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'},
          {'reference':'slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'aarch64', 'release':'8'},
          {'reference':'slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'s390x', 'release':'8'},
          {'reference':'slirp4netns-debugsource-0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca', 'cpu':'x86_64', 'release':'8'}
        ],
    };
    
    flag = 0;
    appstreams_found = 0;
    foreach module (keys(appstreams)) {
      appstream = NULL;
      appstream_name = NULL;
      appstream_version = NULL;
      appstream_split = split(module, sep:':', keep:FALSE);
      if (!empty_or_null(appstream_split)) {
        appstream_name = appstream_split[0];
        appstream_version = appstream_split[1];
        appstream = get_kb_item('Host/RedHat/appstream/' + appstream_name);
      }
      if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
        appstreams_found++;
        foreach package_array ( appstreams[module] ) {
          reference = NULL;
          release = NULL;
          sp = NULL;
          cpu = NULL;
          el_string = NULL;
          rpm_spec_vers_cmp = NULL;
          epoch = NULL;
          if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
          if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
          if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
          if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
          if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
          if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
          if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
          if (reference && release) {
            if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
          }
        }
      }
    }
    
    if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:1.0');
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-debugsource / container-selinux / etc');
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1401.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1401 advisory. - buildah: crafted input tar file may lead to local file overwriting during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-23
    modified2020-04-14
    plugin id135414
    published2020-04-14
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135414
    titleRHEL 8 : OpenShift Container Platform 4.2.28 (RHSA-2020:1401)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:1401. The text
    # itself is copyright (C) Red Hat, Inc.
    #
    
    
    include('compat.inc');
    
    if (description)
    {
      script_id(135414);
      script_version("1.2");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/21");
    
      script_cve_id("CVE-2020-10696");
      script_xref(name:"RHSA", value:"2020:1401");
    
      script_name(english:"RHEL 8 : OpenShift Container Platform 4.2.28 (RHSA-2020:1401)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Red Hat host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in
    the RHSA-2020:1401 advisory.
    
      - buildah: crafted input tar file may lead to local file
        overwriting during image build process (CVE-2020-10696)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/22.html");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1401");
      script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-10696");
      script_set_attribute(attribute:"solution", value:
    "Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-10696");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_cwe_id(22);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/04/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/14");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:openshift:4.2");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:openshift:4.2::el8");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-manpages");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Red Hat Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('rpm.inc');
    
    if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item('Host/RedHat/release');
    if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
    os_ver = os_ver[1];
    if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);
    
    if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item('Host/cpu');
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
    
    pkgs = [
        {'reference':'podman-1.4.2-6.rhaos4.2.el8', 'cpu':'s390x', 'release':'8'},
        {'reference':'podman-1.4.2-6.rhaos4.2.el8', 'cpu':'x86_64', 'release':'8'},
        {'reference':'podman-debugsource-1.4.2-6.rhaos4.2.el8', 'cpu':'s390x', 'release':'8'},
        {'reference':'podman-debugsource-1.4.2-6.rhaos4.2.el8', 'cpu':'x86_64', 'release':'8'},
        {'reference':'podman-docker-1.4.2-6.rhaos4.2.el8', 'release':'8'},
        {'reference':'podman-manpages-1.4.2-6.rhaos4.2.el8', 'release':'8'}
    ];
    
    flag = 0;
    foreach package_array ( pkgs ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (reference && release) {
        if (rpm_spec_vers_cmp) {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:TRUE)) flag++;
        }
        else
        {
          if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch)) flag++;
        }
      }
    }
    
    if (flag)
    {
      security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'podman / podman-debugsource / podman-docker / etc');
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-1931.NASL
    descriptionFrom Red Hat Security Advisory 2020:1931 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1931 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-05-14
    plugin id136597
    published2020-05-14
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136597
    titleOracle Linux 8 : container-tools:2.0 (ELSA-2020-1931)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2020:1931 and 
    # Oracle Linux Security Advisory ELSA-2020-1931 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(136597);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/05");
    
      script_cve_id("CVE-2020-10696");
      script_xref(name:"RHSA", value:"2020:1931");
    
      script_name(english:"Oracle Linux 8 : container-tools:2.0 (ELSA-2020-1931)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2020:1931 :
    
    The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in
    the RHSA-2020:1931 advisory.
    
      - buildah: Crafted input tar file may lead to local file
        overwrite during image build process (CVE-2020-10696)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2020-May/009915.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected container-tools:2.0 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:buildah");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:buildah-tests");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cockpit-podman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:conmon");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:container-selinux");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:containernetworking-plugins");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:containers-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:crit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:criu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fuse-overlayfs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-docker");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-remote");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-tests");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-podman-api");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-criu");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:runc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:skopeo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:skopeo-tests");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:slirp4netns");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:udica");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/31");
      script_set_attribute(attribute:"patch_publication_date", value:"2020/05/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/14");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 8", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"buildah-1.11.6-7.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"buildah-tests-1.11.6-7.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"cockpit-podman-11-1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"conmon-2.0.6-1.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"container-selinux-2.124.0-1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"containernetworking-plugins-0.8.3-4.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"containers-common-0.1.40-9.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"crit-3.12-9.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"criu-3.12-9.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"fuse-overlayfs-0.7.2-5.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"podman-1.6.4-11.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"podman-docker-1.6.4-11.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"podman-remote-1.6.4-11.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"podman-tests-1.6.4-11.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"python3-criu-3.12-9.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"runc-1.0.0-64.rc10.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"skopeo-0.1.40-9.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"skopeo-tests-0.1.40-9.0.1.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+7618+3a616245")) flag++;
    if (rpm_check(release:"EL8", cpu:"x86_64", reference:"udica-0.2.1-2.module+el8.2.0+7618+3a616245")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "buildah / buildah-tests / cockpit-podman / conmon / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1449.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1449 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-04-30
    modified2020-04-22
    plugin id135912
    published2020-04-22
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/135912
    titleRHEL 8 : OpenShift Container Platform 4.1.41 (RHSA-2020:1449)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-1926.NASL
    descriptionFrom Red Hat Security Advisory 2020:1926 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1926 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-05-15
    plugin id136644
    published2020-05-15
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136644
    titleOracle Linux 8 : container-tools:1.0 (ELSA-2020-1926)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2116.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) - containers/image: Container images read entire image manifest into memory (CVE-2020-1702) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-15
    modified2020-05-12
    plugin id136521
    published2020-05-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136521
    titleRHEL 7 : buildah (RHSA-2020:2116)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2020-1932.NASL
    descriptionFrom Red Hat Security Advisory 2020:1932 : The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1932 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-06
    modified2020-05-14
    plugin id136598
    published2020-05-14
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136598
    titleOracle Linux 8 : container-tools:ol8 (ELSA-2020-1932)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-2117.NASL
    descriptionThe remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2117 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-15
    modified2020-05-12
    plugin id136522
    published2020-05-12
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136522
    titleRHEL 7 : podman (RHSA-2020:2117)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1932.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1932 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-21
    modified2020-04-29
    plugin id136063
    published2020-04-29
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136063
    titleRHEL 8 : container-tools:rhel8 (RHSA-2020:1932)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2020-1931.NASL
    descriptionThe remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1931 advisory. - buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-05-21
    modified2020-04-29
    plugin id136061
    published2020-04-29
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136061
    titleRHEL 8 : container-tools:2.0 (RHSA-2020:1931)

Redhat

advisories
  • bugzilla
    id1817651
    titleCVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 8 is installed
        ovaloval:com.redhat.rhba:tst:20193384074
      • commentModule container-tools:1.0 is enabled
        ovaloval:com.redhat.rhsa:tst:20193494043
      • OR
        • AND
          • commentslirp4netns-debugsource is earlier than 0:0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926001
          • commentslirp4netns-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975002
        • AND
          • commentslirp4netns is earlier than 0:0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926003
          • commentslirp4netns is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975004
        • AND
          • commentskopeo-debugsource is earlier than 1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926005
          • commentskopeo-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975006
        • AND
          • commentskopeo is earlier than 1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926007
          • commentskopeo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975008
        • AND
          • commentrunc-debugsource is earlier than 0:1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926009
          • commentrunc-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975010
        • AND
          • commentrunc is earlier than 0:1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926011
          • commentrunc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975012
        • AND
          • commentpython3-criu is earlier than 0:3.12-9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926013
          • commentpython3-criu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650038
        • AND
          • commentpodman-debugsource is earlier than 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926015
          • commentpodman-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975014
        • AND
          • commentpodman is earlier than 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926017
          • commentpodman is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975016
        • AND
          • commentoci-umount-debugsource is earlier than 2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926019
          • commentoci-umount-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975018
        • AND
          • commentoci-umount is earlier than 2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926021
          • commentoci-umount is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975020
        • AND
          • commentoci-systemd-hook-debugsource is earlier than 1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926023
          • commentoci-systemd-hook-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975022
        • AND
          • commentoci-systemd-hook is earlier than 1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926025
          • commentoci-systemd-hook is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975024
        • AND
          • commentfuse-overlayfs-debugsource is earlier than 0:0.3-5.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926027
          • commentfuse-overlayfs-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975026
        • AND
          • commentfuse-overlayfs is earlier than 0:0.3-5.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926029
          • commentfuse-overlayfs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975028
        • AND
          • commentcriu-debugsource is earlier than 0:3.12-9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926031
          • commentcriu-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650004
        • AND
          • commentcriu is earlier than 0:3.12-9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926033
          • commentcriu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650006
        • AND
          • commentcrit is earlier than 0:3.12-9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926035
          • commentcrit is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650008
        • AND
          • commentcontainers-common is earlier than 1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926037
          • commentcontainers-common is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975030
        • AND
          • commentcontainernetworking-plugins-debugsource is earlier than 0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926039
          • commentcontainernetworking-plugins-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975032
        • AND
          • commentcontainernetworking-plugins is earlier than 0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926041
          • commentcontainernetworking-plugins is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975034
        • AND
          • commentbuildah-debugsource is earlier than 0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926043
          • commentbuildah-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975036
        • AND
          • commentbuildah is earlier than 0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926045
          • commentbuildah is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975038
        • AND
          • commentpodman-docker is earlier than 0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926047
          • commentpodman-docker is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975040
        • AND
          • commentcontainer-selinux is earlier than 2:2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca
            ovaloval:com.redhat.rhsa:tst:20201926049
          • commentcontainer-selinux is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975042
    rhsa
    idRHSA-2020:1926
    released2020-04-28
    severityImportant
    titleRHSA-2020:1926: container-tools:1.0 security and bug fix update (Important)
  • bugzilla
    id1817651
    titleCVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 8 is installed
        ovaloval:com.redhat.rhba:tst:20193384074
      • commentModule container-tools:2.0 is enabled
        ovaloval:com.redhat.rhsa:tst:20201931061
      • OR
        • AND
          • commentslirp4netns-debugsource is earlier than 0:0.4.2-3.git21fdece.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931001
          • commentslirp4netns-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975002
        • AND
          • commentslirp4netns is earlier than 0:0.4.2-3.git21fdece.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931003
          • commentslirp4netns is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975004
        • AND
          • commentskopeo-tests is earlier than 1:0.1.40-9.module+el8.2.0+6373+4950d421
            ovaloval:com.redhat.rhsa:tst:20201931005
          • commentskopeo-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403008
        • AND
          • commentskopeo-debugsource is earlier than 1:0.1.40-9.module+el8.2.0+6373+4950d421
            ovaloval:com.redhat.rhsa:tst:20201931007
          • commentskopeo-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975006
        • AND
          • commentskopeo is earlier than 1:0.1.40-9.module+el8.2.0+6373+4950d421
            ovaloval:com.redhat.rhsa:tst:20201931009
          • commentskopeo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975008
        • AND
          • commentrunc-debugsource is earlier than 0:1.0.0-64.rc10.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931011
          • commentrunc-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975010
        • AND
          • commentrunc is earlier than 0:1.0.0-64.rc10.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931013
          • commentrunc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975012
        • AND
          • commentpython3-criu is earlier than 0:3.12-9.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931015
          • commentpython3-criu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650038
        • AND
          • commentpodman-tests is earlier than 0:1.6.4-11.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931017
          • commentpodman-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403018
        • AND
          • commentpodman-remote is earlier than 0:1.6.4-11.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931019
          • commentpodman-remote is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403020
        • AND
          • commentpodman-debugsource is earlier than 0:1.6.4-11.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931021
          • commentpodman-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975014
        • AND
          • commentpodman is earlier than 0:1.6.4-11.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931023
          • commentpodman is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975016
        • AND
          • commentfuse-overlayfs-debugsource is earlier than 0:0.7.2-5.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931025
          • commentfuse-overlayfs-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975026
        • AND
          • commentfuse-overlayfs is earlier than 0:0.7.2-5.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931027
          • commentfuse-overlayfs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975028
        • AND
          • commentcriu-debugsource is earlier than 0:3.12-9.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931029
          • commentcriu-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650004
        • AND
          • commentcriu is earlier than 0:3.12-9.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931031
          • commentcriu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650006
        • AND
          • commentcrit is earlier than 0:3.12-9.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931033
          • commentcrit is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650008
        • AND
          • commentcontainers-common is earlier than 1:0.1.40-9.module+el8.2.0+6373+4950d421
            ovaloval:com.redhat.rhsa:tst:20201931035
          • commentcontainers-common is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975030
        • AND
          • commentcontainernetworking-plugins-debugsource is earlier than 0:0.8.3-4.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931037
          • commentcontainernetworking-plugins-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975032
        • AND
          • commentcontainernetworking-plugins is earlier than 0:0.8.3-4.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931039
          • commentcontainernetworking-plugins is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975034
        • AND
          • commentconmon is earlier than 2:2.0.6-1.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931041
          • commentconmon is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200348036
        • AND
          • commentbuildah-tests is earlier than 0:1.11.6-7.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931043
          • commentbuildah-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403044
        • AND
          • commentbuildah-debugsource is earlier than 0:1.11.6-7.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931045
          • commentbuildah-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975036
        • AND
          • commentbuildah is earlier than 0:1.11.6-7.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931047
          • commentbuildah is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975038
        • AND
          • commentudica is earlier than 0:0.2.1-2.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931049
          • commentudica is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200348044
        • AND
          • commenttoolbox is earlier than 0:0.0.7-1.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931051
          • commenttoolbox is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403002
        • AND
          • commentpython-podman-api is earlier than 0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931053
          • commentpython-podman-api is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403050
        • AND
          • commentpodman-docker is earlier than 0:1.6.4-11.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931055
          • commentpodman-docker is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975040
        • AND
          • commentcontainer-selinux is earlier than 2:2.124.0-1.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931057
          • commentcontainer-selinux is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975042
        • AND
          • commentcockpit-podman is earlier than 0:11-1.module+el8.2.0+6369+1f4293b4
            ovaloval:com.redhat.rhsa:tst:20201931059
          • commentcockpit-podman is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403058
    rhsa
    idRHSA-2020:1931
    released2020-04-28
    severityImportant
    titleRHSA-2020:1931: container-tools:2.0 security update (Important)
  • bugzilla
    id1817651
    titleCVE-2020-10696 buildah: Crafted input tar file may lead to local file overwrite during image build process
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 8 is installed
        ovaloval:com.redhat.rhba:tst:20193384074
      • commentModule container-tools:rhel8 is enabled
        ovaloval:com.redhat.rhsa:tst:20190975043
      • OR
        • AND
          • commentslirp4netns-debugsource is earlier than 0:0.4.2-3.git21fdece.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932001
          • commentslirp4netns-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975002
        • AND
          • commentslirp4netns is earlier than 0:0.4.2-3.git21fdece.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932003
          • commentslirp4netns is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975004
        • AND
          • commentskopeo-tests is earlier than 1:0.1.40-11.module+el8.2.0+6374+67f43e89
            ovaloval:com.redhat.rhsa:tst:20201932005
          • commentskopeo-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403008
        • AND
          • commentskopeo-debugsource is earlier than 1:0.1.40-11.module+el8.2.0+6374+67f43e89
            ovaloval:com.redhat.rhsa:tst:20201932007
          • commentskopeo-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975006
        • AND
          • commentskopeo is earlier than 1:0.1.40-11.module+el8.2.0+6374+67f43e89
            ovaloval:com.redhat.rhsa:tst:20201932009
          • commentskopeo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975008
        • AND
          • commentrunc-debugsource is earlier than 0:1.0.0-65.rc10.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932011
          • commentrunc-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975010
        • AND
          • commentrunc is earlier than 0:1.0.0-65.rc10.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932013
          • commentrunc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975012
        • AND
          • commentpython3-criu is earlier than 0:3.12-9.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932015
          • commentpython3-criu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650038
        • AND
          • commentpodman-tests is earlier than 0:1.6.4-11.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932017
          • commentpodman-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403018
        • AND
          • commentpodman-remote is earlier than 0:1.6.4-11.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932019
          • commentpodman-remote is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403020
        • AND
          • commentpodman-debugsource is earlier than 0:1.6.4-11.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932021
          • commentpodman-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975014
        • AND
          • commentpodman is earlier than 0:1.6.4-11.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932023
          • commentpodman is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975016
        • AND
          • commentfuse-overlayfs-debugsource is earlier than 0:0.7.2-5.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932025
          • commentfuse-overlayfs-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975026
        • AND
          • commentfuse-overlayfs is earlier than 0:0.7.2-5.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932027
          • commentfuse-overlayfs is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975028
        • AND
          • commentcriu-debugsource is earlier than 0:3.12-9.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932029
          • commentcriu-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650004
        • AND
          • commentcriu is earlier than 0:3.12-9.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932031
          • commentcriu is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650006
        • AND
          • commentcrit is earlier than 0:3.12-9.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932033
          • commentcrit is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20201650008
        • AND
          • commentcontainers-common is earlier than 1:0.1.40-11.module+el8.2.0+6374+67f43e89
            ovaloval:com.redhat.rhsa:tst:20201932035
          • commentcontainers-common is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975030
        • AND
          • commentcontainernetworking-plugins-debugsource is earlier than 0:0.8.3-5.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932037
          • commentcontainernetworking-plugins-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975032
        • AND
          • commentcontainernetworking-plugins is earlier than 0:0.8.3-5.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932039
          • commentcontainernetworking-plugins is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975034
        • AND
          • commentconmon is earlier than 2:2.0.6-1.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932041
          • commentconmon is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200348036
        • AND
          • commentbuildah-tests is earlier than 0:1.11.6-8.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932043
          • commentbuildah-tests is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403044
        • AND
          • commentbuildah-debugsource is earlier than 0:1.11.6-8.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932045
          • commentbuildah-debugsource is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975036
        • AND
          • commentbuildah is earlier than 0:1.11.6-8.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932047
          • commentbuildah is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975038
        • AND
          • commentudica is earlier than 0:0.2.1-2.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932049
          • commentudica is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20200348044
        • AND
          • commenttoolbox is earlier than 0:0.0.7-1.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932051
          • commenttoolbox is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403002
        • AND
          • commentpython-podman-api is earlier than 0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932053
          • commentpython-podman-api is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403050
        • AND
          • commentpodman-docker is earlier than 0:1.6.4-11.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932055
          • commentpodman-docker is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975040
        • AND
          • commentcontainer-selinux is earlier than 2:2.124.0-1.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932057
          • commentcontainer-selinux is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20190975042
        • AND
          • commentcockpit-podman is earlier than 0:12-1.module+el8.2.0+6368+cf16aa14
            ovaloval:com.redhat.rhsa:tst:20201932059
          • commentcockpit-podman is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20193403058
    rhsa
    idRHSA-2020:1932
    released2020-04-28
    severityImportant
    titleRHSA-2020:1932: container-tools:rhel8 security update (Important)
rpms
  • podman-0:1.6.4-10.rhaos4.3.el8
  • podman-debuginfo-0:1.6.4-10.rhaos4.3.el8
  • podman-debugsource-0:1.6.4-10.rhaos4.3.el8
  • podman-docker-0:1.6.4-10.rhaos4.3.el8
  • podman-manpages-0:1.6.4-10.rhaos4.3.el8
  • podman-remote-0:1.6.4-10.rhaos4.3.el8
  • podman-remote-debuginfo-0:1.6.4-10.rhaos4.3.el8
  • podman-tests-0:1.6.4-10.rhaos4.3.el8
  • podman-0:1.4.2-6.rhaos4.2.el8
  • podman-debuginfo-0:1.4.2-6.rhaos4.2.el8
  • podman-debugsource-0:1.4.2-6.rhaos4.2.el8
  • podman-docker-0:1.4.2-6.rhaos4.2.el8
  • podman-manpages-0:1.4.2-6.rhaos4.2.el8
  • podman-remote-debuginfo-0:1.4.2-6.rhaos4.2.el8
  • podman-0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8
  • podman-debuginfo-0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8
  • podman-debugsource-0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8
  • podman-docker-0:1.0.2-4.dev.git96ccc2e.rhaos4.1.el8
  • buildah-0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca
  • buildah-debuginfo-0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca
  • buildah-debugsource-0:1.5-4.gite94b4f9.module+el8.2.0+6370+6fb6c8ca
  • container-selinux-2:2.124.0-1.gitf958d0c.module+el8.2.0+6370+6fb6c8ca
  • containernetworking-plugins-0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca
  • containernetworking-plugins-debuginfo-0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca
  • containernetworking-plugins-debugsource-0:0.7.4-3.git9ebe139.module+el8.2.0+6370+6fb6c8ca
  • containers-common-1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
  • crit-0:3.12-9.module+el8.2.0+6370+6fb6c8ca
  • criu-0:3.12-9.module+el8.2.0+6370+6fb6c8ca
  • criu-debuginfo-0:3.12-9.module+el8.2.0+6370+6fb6c8ca
  • criu-debugsource-0:3.12-9.module+el8.2.0+6370+6fb6c8ca
  • fuse-overlayfs-0:0.3-5.module+el8.2.0+6370+6fb6c8ca
  • fuse-overlayfs-debuginfo-0:0.3-5.module+el8.2.0+6370+6fb6c8ca
  • fuse-overlayfs-debugsource-0:0.3-5.module+el8.2.0+6370+6fb6c8ca
  • oci-systemd-hook-1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
  • oci-systemd-hook-debuginfo-1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
  • oci-systemd-hook-debugsource-1:0.1.15-2.git2d0b8a3.module+el8.2.0+6370+6fb6c8ca
  • oci-umount-2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
  • oci-umount-debuginfo-2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
  • oci-umount-debugsource-2:2.3.4-2.git87f9237.module+el8.2.0+6370+6fb6c8ca
  • podman-0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
  • podman-debuginfo-0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
  • podman-debugsource-0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
  • podman-docker-0:1.0.0-4.git921f98f.module+el8.2.0+6370+6fb6c8ca
  • python3-criu-0:3.12-9.module+el8.2.0+6370+6fb6c8ca
  • runc-0:1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca
  • runc-debuginfo-0:1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca
  • runc-debugsource-0:1.0.0-56.rc5.dev.git2abd837.module+el8.2.0+6370+6fb6c8ca
  • skopeo-1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
  • skopeo-debuginfo-1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
  • skopeo-debugsource-1:0.1.32-4.git1715c90.module+el8.2.0+6370+6fb6c8ca
  • slirp4netns-0:0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca
  • slirp4netns-debuginfo-0:0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca
  • slirp4netns-debugsource-0:0.1-5.dev.gitc4e1bc5.module+el8.2.0+6370+6fb6c8ca
  • buildah-0:1.11.6-7.module+el8.2.0+6369+1f4293b4
  • buildah-debuginfo-0:1.11.6-7.module+el8.2.0+6369+1f4293b4
  • buildah-debugsource-0:1.11.6-7.module+el8.2.0+6369+1f4293b4
  • buildah-tests-0:1.11.6-7.module+el8.2.0+6369+1f4293b4
  • buildah-tests-debuginfo-0:1.11.6-7.module+el8.2.0+6369+1f4293b4
  • cockpit-podman-0:11-1.module+el8.2.0+6369+1f4293b4
  • conmon-2:2.0.6-1.module+el8.2.0+6369+1f4293b4
  • container-selinux-2:2.124.0-1.module+el8.2.0+6369+1f4293b4
  • containernetworking-plugins-0:0.8.3-4.module+el8.2.0+6369+1f4293b4
  • containernetworking-plugins-debuginfo-0:0.8.3-4.module+el8.2.0+6369+1f4293b4
  • containernetworking-plugins-debugsource-0:0.8.3-4.module+el8.2.0+6369+1f4293b4
  • containers-common-1:0.1.40-9.module+el8.2.0+6373+4950d421
  • crit-0:3.12-9.module+el8.2.0+6369+1f4293b4
  • criu-0:3.12-9.module+el8.2.0+6369+1f4293b4
  • criu-debuginfo-0:3.12-9.module+el8.2.0+6369+1f4293b4
  • criu-debugsource-0:3.12-9.module+el8.2.0+6369+1f4293b4
  • fuse-overlayfs-0:0.7.2-5.module+el8.2.0+6369+1f4293b4
  • fuse-overlayfs-debuginfo-0:0.7.2-5.module+el8.2.0+6369+1f4293b4
  • fuse-overlayfs-debugsource-0:0.7.2-5.module+el8.2.0+6369+1f4293b4
  • podman-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-debuginfo-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-debugsource-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-docker-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-remote-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-remote-debuginfo-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • podman-tests-0:1.6.4-11.module+el8.2.0+6369+1f4293b4
  • python-podman-api-0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+6369+1f4293b4
  • python3-criu-0:3.12-9.module+el8.2.0+6369+1f4293b4
  • runc-0:1.0.0-64.rc10.module+el8.2.0+6369+1f4293b4
  • runc-debuginfo-0:1.0.0-64.rc10.module+el8.2.0+6369+1f4293b4
  • runc-debugsource-0:1.0.0-64.rc10.module+el8.2.0+6369+1f4293b4
  • skopeo-1:0.1.40-9.module+el8.2.0+6373+4950d421
  • skopeo-debuginfo-1:0.1.40-9.module+el8.2.0+6373+4950d421
  • skopeo-debugsource-1:0.1.40-9.module+el8.2.0+6373+4950d421
  • skopeo-tests-1:0.1.40-9.module+el8.2.0+6373+4950d421
  • slirp4netns-0:0.4.2-3.git21fdece.module+el8.2.0+6369+1f4293b4
  • slirp4netns-debuginfo-0:0.4.2-3.git21fdece.module+el8.2.0+6369+1f4293b4
  • slirp4netns-debugsource-0:0.4.2-3.git21fdece.module+el8.2.0+6369+1f4293b4
  • toolbox-0:0.0.7-1.module+el8.2.0+6369+1f4293b4
  • udica-0:0.2.1-2.module+el8.2.0+6369+1f4293b4
  • buildah-0:1.11.6-8.module+el8.2.0+6368+cf16aa14
  • buildah-debuginfo-0:1.11.6-8.module+el8.2.0+6368+cf16aa14
  • buildah-debugsource-0:1.11.6-8.module+el8.2.0+6368+cf16aa14
  • buildah-tests-0:1.11.6-8.module+el8.2.0+6368+cf16aa14
  • buildah-tests-debuginfo-0:1.11.6-8.module+el8.2.0+6368+cf16aa14
  • cockpit-podman-0:12-1.module+el8.2.0+6368+cf16aa14
  • conmon-2:2.0.6-1.module+el8.2.0+6368+cf16aa14
  • container-selinux-2:2.124.0-1.module+el8.2.0+6368+cf16aa14
  • containernetworking-plugins-0:0.8.3-5.module+el8.2.0+6368+cf16aa14
  • containernetworking-plugins-debuginfo-0:0.8.3-5.module+el8.2.0+6368+cf16aa14
  • containernetworking-plugins-debugsource-0:0.8.3-5.module+el8.2.0+6368+cf16aa14
  • containers-common-1:0.1.40-11.module+el8.2.0+6374+67f43e89
  • crit-0:3.12-9.module+el8.2.0+6368+cf16aa14
  • criu-0:3.12-9.module+el8.2.0+6368+cf16aa14
  • criu-debuginfo-0:3.12-9.module+el8.2.0+6368+cf16aa14
  • criu-debugsource-0:3.12-9.module+el8.2.0+6368+cf16aa14
  • fuse-overlayfs-0:0.7.2-5.module+el8.2.0+6368+cf16aa14
  • fuse-overlayfs-debuginfo-0:0.7.2-5.module+el8.2.0+6368+cf16aa14
  • fuse-overlayfs-debugsource-0:0.7.2-5.module+el8.2.0+6368+cf16aa14
  • podman-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-debuginfo-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-debugsource-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-docker-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-remote-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-remote-debuginfo-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • podman-tests-0:1.6.4-11.module+el8.2.0+6368+cf16aa14
  • python-podman-api-0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+6368+cf16aa14
  • python3-criu-0:3.12-9.module+el8.2.0+6368+cf16aa14
  • runc-0:1.0.0-65.rc10.module+el8.2.0+6368+cf16aa14
  • runc-debuginfo-0:1.0.0-65.rc10.module+el8.2.0+6368+cf16aa14
  • runc-debugsource-0:1.0.0-65.rc10.module+el8.2.0+6368+cf16aa14
  • skopeo-1:0.1.40-11.module+el8.2.0+6374+67f43e89
  • skopeo-debuginfo-1:0.1.40-11.module+el8.2.0+6374+67f43e89
  • skopeo-debugsource-1:0.1.40-11.module+el8.2.0+6374+67f43e89
  • skopeo-tests-1:0.1.40-11.module+el8.2.0+6374+67f43e89
  • slirp4netns-0:0.4.2-3.git21fdece.module+el8.2.0+6368+cf16aa14
  • slirp4netns-debuginfo-0:0.4.2-3.git21fdece.module+el8.2.0+6368+cf16aa14
  • slirp4netns-debugsource-0:0.4.2-3.git21fdece.module+el8.2.0+6368+cf16aa14
  • toolbox-0:0.0.7-1.module+el8.2.0+6368+cf16aa14
  • udica-0:0.2.1-2.module+el8.2.0+6368+cf16aa14
  • buildah-0:1.11.6-11.el7_8
  • buildah-debuginfo-0:1.11.6-11.el7_8
  • podman-0:1.6.4-18.el7_8
  • podman-debuginfo-0:1.6.4-18.el7_8
  • podman-docker-0:1.6.4-18.el7_8