Vulnerabilities > CVE-2020-1726 - Files or Directories Accessible to External Parties vulnerability in multiple products

#
# (C) Tenable Network Security, Inc.
#

# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2020:1650. The text
# itself is copyright (C) Red Hat, Inc.
#


include('compat.inc');

if (description)
{
  script_id(136053);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/20");

  script_cve_id("CVE-2019-19921", "CVE-2020-1702", "CVE-2020-1726");
  script_xref(name:"RHSA", value:"2020:1650");

  script_name(english:"RHEL 8 : container-tools:rhel8 (RHSA-2020:1650)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as
referenced in the RHSA-2020:1650 advisory.

  - runc: volume mount race condition with shared mounts
    leads to information leak/integrity manipulation
    (CVE-2019-19921)

  - containers/image: Container images read entire image
    manifest into memory (CVE-2020-1702)

  - podman: incorrectly allows existing files in volumes to
    be overwritten by a container when it is created
    (CVE-2020-1726)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/41.html");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/400.html");
  script_set_attribute(attribute:"see_also", value:"https://cwe.mitre.org/data/definitions/552.html");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2020:1650");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2019-19921");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-1702");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2020-1726");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1792796");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1796107");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/1801152");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-1726");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(41, 400, 552);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/04/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:redhat:enterprise_linux:8::appstream");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:buildah-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:cockpit-podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:conmon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:container-selinux");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containernetworking-plugins-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:containers-common");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:crit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:criu-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:fuse-overlayfs-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-remote");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-podman-api");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python3-criu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:runc-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:skopeo-tests");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:slirp4netns-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:toolbox");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:udica");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('audit.inc');
include('global_settings.inc');
include('misc_func.inc');
include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item('Host/RedHat/release');
if (isnull(release) || 'Red Hat' >!< release) audit(AUDIT_OS_NOT, 'Red Hat');
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Red Hat 8.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

module_ver = get_kb_item('Host/RedHat/appstream/container-tools');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');
if ('rhel8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);

appstreams = {
    'container-tools:rhel8': [
      {'reference':'buildah-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'buildah-debugsource-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-debugsource-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-debugsource-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'buildah-tests-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'buildah-tests-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'s390x', 'release':'8'},
      {'reference':'buildah-tests-1.11.6-7.module+el8.2.0+5856+b8046c6d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'cockpit-podman-12-1.module+el8.2.0+5950+6d183a6a', 'release':'8'},
      {'reference':'conmon-2.0.6-1.module+el8.2.0+5182+3136e5d4', 'cpu':'aarch64', 'release':'8', 'epoch':'2'},
      {'reference':'conmon-2.0.6-1.module+el8.2.0+5182+3136e5d4', 'cpu':'s390x', 'release':'8', 'epoch':'2'},
      {'reference':'conmon-2.0.6-1.module+el8.2.0+5182+3136e5d4', 'cpu':'x86_64', 'release':'8', 'epoch':'2'},
      {'reference':'container-selinux-2.124.0-1.module+el8.2.0+5182+3136e5d4', 'release':'8', 'epoch':'2'},
      {'reference':'containernetworking-plugins-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'aarch64', 'release':'8'},
      {'reference':'containernetworking-plugins-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'s390x', 'release':'8'},
      {'reference':'containernetworking-plugins-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'x86_64', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'aarch64', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'s390x', 'release':'8'},
      {'reference':'containernetworking-plugins-debugsource-0.8.3-5.module+el8.2.0+5201+6b31f0d9', 'cpu':'x86_64', 'release':'8'},
      {'reference':'containers-common-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'containers-common-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'containers-common-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'crit-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'crit-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'s390x', 'release':'8'},
      {'reference':'crit-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'s390x', 'release':'8'},
      {'reference':'criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'criu-debugsource-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'criu-debugsource-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'s390x', 'release':'8'},
      {'reference':'criu-debugsource-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'fuse-overlayfs-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'fuse-overlayfs-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'s390x', 'release':'8'},
      {'reference':'fuse-overlayfs-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'s390x', 'release':'8'},
      {'reference':'fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+6060+9dbc027d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-debugsource-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-debugsource-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-debugsource-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-docker-1.6.4-10.module+el8.2.0+6063+e761893a', 'release':'8'},
      {'reference':'podman-remote-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-remote-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-remote-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'x86_64', 'release':'8'},
      {'reference':'podman-tests-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'aarch64', 'release':'8'},
      {'reference':'podman-tests-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'s390x', 'release':'8'},
      {'reference':'podman-tests-1.6.4-10.module+el8.2.0+6063+e761893a', 'cpu':'x86_64', 'release':'8'},
      {'reference':'python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+5201+6b31f0d9', 'release':'8'},
      {'reference':'python3-criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'python3-criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'s390x', 'release':'8'},
      {'reference':'python3-criu-3.12-9.module+el8.2.0+5029+3ac48e7d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'runc-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'aarch64', 'release':'8'},
      {'reference':'runc-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'s390x', 'release':'8'},
      {'reference':'runc-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'x86_64', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'aarch64', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'s390x', 'release':'8'},
      {'reference':'runc-debugsource-1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb', 'cpu':'x86_64', 'release':'8'},
      {'reference':'skopeo-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-debugsource-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'aarch64', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'s390x', 'release':'8', 'epoch':'1'},
      {'reference':'skopeo-tests-0.1.40-10.module+el8.2.0+5955+6cd70ceb', 'cpu':'x86_64', 'release':'8', 'epoch':'1'},
      {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'s390x', 'release':'8'},
      {'reference':'slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'aarch64', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'s390x', 'release':'8'},
      {'reference':'slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d', 'cpu':'x86_64', 'release':'8'},
      {'reference':'toolbox-0.0.7-1.module+el8.2.0+6096+9c3f08f3', 'release':'8'},
      {'reference':'udica-0.2.1-2.module+el8.2.0+4896+8f613c81', 'release':'8'}
    ],
};

flag = 0;
appstreams_found = 0;
foreach module (keys(appstreams)) {
  appstream = NULL;
  appstream_name = NULL;
  appstream_version = NULL;
  appstream_split = split(module, sep:':', keep:FALSE);
  if (!empty_or_null(appstream_split)) {
    appstream_name = appstream_split[0];
    appstream_version = appstream_split[1];
    appstream = get_kb_item('Host/RedHat/appstream/' + appstream_name);
  }
  if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
    appstreams_found++;
    foreach package_array ( appstreams[module] ) {
      reference = NULL;
      release = NULL;
      sp = NULL;
      cpu = NULL;
      el_string = NULL;
      rpm_spec_vers_cmp = NULL;
      epoch = NULL;
      if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
      if (!empty_or_null(package_array['release'])) release = 'RHEL' + package_array['release'];
      if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
      if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
      if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
      if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
      if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
      if (reference && release) {
        if (rpm_check(release:release, sp:sp, cpu:cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
      }
    }
  }
}

if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:rhel8');

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'buildah / buildah-debugsource / buildah-tests / etc');
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2020:0680. The text 
# itself is copyright (C) Red Hat, Inc.
#

include("compat.inc");

if (description)
{
  script_id(134390);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/13");

  script_cve_id("CVE-2020-1726");
  script_xref(name:"RHSA", value:"2020:0680");

  script_name(english:"RHEL 8 : OpenShift Container Platform 4.3.5 podman (RHSA-2020:0680)");
  script_summary(english:"Checks the rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"An update for podman is now available for Red Hat OpenShift Container
Platform 4.3.

Red Hat Product Security has rated this update as having a security
impact of Low. A Common Vulnerability Scoring System (CVSS) base
score, which gives a detailed severity rating, is available for each
vulnerability from the CVE link (s) in the References section.

The podman tool manages Pods, container images, and containers. It is
part of the libpod library, which is for applications that use
container Pods. Container Pods is a concept in Kubernetes.

Security Fix(es) :

* podman: incorrectly allowed existing files in volumes to be
overwritten by a container when it was created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a
CVSS score, acknowledgments, and other related information, refer to
the CVE page(s) listed in the References section."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2020:0680"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2020-1726"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-docker");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-manpages");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-remote");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-remote-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:podman-tests");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/11");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 8.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2020:0680";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-debuginfo-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-debugsource-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", reference:"podman-docker-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", reference:"podman-manpages-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-remote-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-remote-debuginfo-1.6.4-7.el8")) flag++;
  if (rpm_check(release:"RHEL8", cpu:"x86_64", reference:"podman-tests-1.6.4-7.el8")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "podman / podman-debuginfo / podman-debugsource / podman-docker / etc");
  }
}