CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
99.6%
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2988 advisory.
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic. (CVE-2021-34558)
The html/template package does not apply the proper rules for handling occurrences of <script,
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Oracle Linux Security Advisory ELSA-2024-2988.
##
include('compat.inc');
if (description)
{
script_id(197998);
script_version("1.3");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/23");
script_cve_id(
"CVE-2018-25091",
"CVE-2021-33198",
"CVE-2021-34558",
"CVE-2022-2879",
"CVE-2022-2880",
"CVE-2022-41715",
"CVE-2023-29409",
"CVE-2023-39318",
"CVE-2023-39319",
"CVE-2023-39321",
"CVE-2023-39322",
"CVE-2023-39326",
"CVE-2023-45287",
"CVE-2023-45803",
"CVE-2023-48795",
"CVE-2024-23650"
);
script_xref(name:"IAVA", value:"2024-A-0071");
script_xref(name:"IAVB", value:"2021-B-0047-S");
script_xref(name:"IAVB", value:"2022-B-0042-S");
script_xref(name:"IAVB", value:"2023-B-0064-S");
script_xref(name:"IAVB", value:"2023-B-0068-S");
script_xref(name:"IAVB", value:"2023-B-0080-S");
script_xref(name:"IAVB", value:"2023-B-0096-S");
script_name(english:"Oracle Linux 8 : container-tools:ol8 (ELSA-2024-2988)");
script_set_attribute(attribute:"synopsis", value:
"The remote Oracle Linux host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the
ELSA-2024-2988 advisory.
- The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an
X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS
server to cause a TLS client to panic. (CVE-2021-34558)
- The html/template package does not apply the proper rules for handling occurrences of <script, <!--,
and </script within JS literals in <script> contexts. This may cause the template parser to improperly
consider script contexts to be terminated early, causing actions to be improperly escaped. This could be
leveraged to perform an XSS attack. (CVE-2023-39319)
- BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to
BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using
BuildKit frontends from untrusted sources. (CVE-2024-23650)
- Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time
verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <=
8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in
circulation with keys larger than this, and all three appear to be test certificates that are not actively
deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so
causing breakage here in the interests of increasing the default safety of users of crypto/tls seems
reasonable. (CVE-2023-29409)
- The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other
products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the
extension negotiation message), and a client and server may consequently end up with a connection for
which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because
the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and
mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of
ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in [email protected] and
(if CBC is used) the [email protected] MAC algorithms. This also affects Maverick Synergy Java SSH API
before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,
AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,
Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,
SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH
through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang
XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd
through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and
LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,
Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server
before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the
mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh
crate before 0.40.2 for Rust. (CVE-2023-48795)
- Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA
blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective.
In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn
could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant
time RSA implementation, which we do not believe exhibits any timing side channels. (CVE-2023-45287)
- In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the
math/big.Rat SetString or UnmarshalText method. (CVE-2021-33198)
- QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake
messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now
consistently reject messages larger than 65KiB in size. (CVE-2023-39322)
- Processing an incomplete post-handshake message for a QUIC connection can cause a panic. (CVE-2023-39321)
- A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response
body to read many more bytes from the network than are in the body. A malicious HTTP client can further
exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a
handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which
permit including additional metadata in a request or response body sent using the chunked encoding. The
net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large
metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real
body to encoded bytes grows too small. (CVE-2023-39326)
- urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP
request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method
changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs.
Although this behavior is not specified in the section for redirects, it can be inferred by piecing
together information from different sections and we have observed the behavior in other major HTTP client
implementations like curl and web browsers. Because the vulnerability requires a previously trusted
service to become compromised in order to have an impact on confidentiality we believe the exploitability
of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request
bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions
must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information
in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts
redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised.
This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve
this issue. Users unable to update should disable redirects for services that aren't expecting to respond
with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle
301, 302, and 303 redirects manually by stripping the HTTP request body. (CVE-2023-45803)
- Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including
unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy
forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in
the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director
function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse
query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)
- The html/template package does not properly handle HTML-like comment tokens, nor hashbang #! comment
tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of
<script> contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS
attack. (CVE-2023-39318)
- urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect
(i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the
authorization header to be exposed to unintended hosts or transmitted in cleartext. NOTE: this issue
exists because of an incomplete fix for CVE-2018-20060 (which was case-sensitive). (CVE-2018-25091)
- Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could
cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)
- Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion
or denial of service. The parsed regexp representation is linear in the size of the input, but in some
cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger
amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular
expressions whose representation would use more space than that are rejected. Normal use of regular
expressions is unaffected. (CVE-2022-41715)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://linux.oracle.com/errata/ELSA-2024-2988.html");
script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-33198");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2023-45287");
script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2023-48795");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2021/07/15");
script_set_attribute(attribute:"patch_publication_date", value:"2024/05/24");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/28");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:23.1.12.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:23.1.13.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:23.1.14.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:23.1.16.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:23.1.17.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:24.1.2.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:exadata_dbserver:24.1.3.0.0::ol8");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:8:10:appstream_base");
script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:linux:8::appstream");
script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:aardvark-dns");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:buildah");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:buildah-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:cockpit-podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:conmon");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:container-selinux");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:containernetworking-plugins");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:containers-common");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:crit");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:criu");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:criu-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:criu-libs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:crun");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:fuse-overlayfs");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libslirp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:libslirp-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:netavark");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:oci-seccomp-bpf-hook");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-catatonit");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-docker");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-gvproxy");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-plugins");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-remote");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:podman-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-criu");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python3-podman");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:runc");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:skopeo");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:skopeo-tests");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:slirp4netns");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:udica");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Oracle Linux Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/local_checks_enabled");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item('Host/OracleLinux')) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_release = get_kb_item("Host/RedHat/release");
if (isnull(os_release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:os_release)) audit(AUDIT_OS_NOT, 'Oracle Linux');
var os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Oracle Linux');
os_ver = os_ver[1];
if (! preg(pattern:"^8([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, 'Oracle Linux 8', 'Oracle Linux ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Oracle Linux', cpu);
var module_ver = get_kb_item('Host/RedHat/appstream/container-tools');
if (isnull(module_ver)) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');
if ('ol8' >!< module_ver) audit(AUDIT_PACKAGE_NOT_AFFECTED, 'Module container-tools:' + module_ver);
var appstreams = {
'container-tools:ol8': [
{'reference':'aardvark-dns-1.10.0-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'buildah-1.33.6-2.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'buildah-tests-1.33.6-2.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'cockpit-podman-84.1-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'allowmaj':TRUE},
{'reference':'conmon-2.1.10-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'container-selinux-2.229.0-2.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'containernetworking-plugins-1.4.0-2.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'containers-common-1-81.0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'crit-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-devel-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-libs-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'crun-1.14.3-2.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fuse-overlayfs-1.13-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-4.4.0-1.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-devel-4.4.0-1.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'netavark-1.10.3-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'podman-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-catatonit-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-docker-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-gvproxy-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-plugins-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-remote-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-tests-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'python3-criu-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'python3-podman-4.9.0-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'runc-1.1.12-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'skopeo-1.14.3-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'skopeo-tests-1.14.3-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'slirp4netns-1.2.3-1.module+el8.10.0+90298+77a9814d', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'udica-0.2.6-20.module+el8.9.0+90147+a4870853', 'cpu':'aarch64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'aardvark-dns-1.10.0-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'buildah-1.33.6-2.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'buildah-tests-1.33.6-2.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'conmon-2.1.10-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'containernetworking-plugins-1.4.0-2.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'containers-common-1-81.0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'crit-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-devel-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'criu-libs-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'crun-1.14.3-2.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'fuse-overlayfs-1.13-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-4.4.0-1.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libslirp-devel-4.4.0-1.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'netavark-1.10.3-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'podman-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-catatonit-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-gvproxy-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-plugins-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-remote-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'podman-tests-4.9.4-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
{'reference':'python3-criu-3.18-4.module+el8.9.0+90147+a4870853', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE},
{'reference':'runc-1.1.12-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
{'reference':'skopeo-1.14.3-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'skopeo-tests-1.14.3-0.1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE, 'epoch':'2'},
{'reference':'slirp4netns-1.2.3-1.module+el8.10.0+90298+77a9814d', 'cpu':'x86_64', 'release':'8', 'rpm_spec_vers_cmp':TRUE}
]
};
var flag = 0;
var appstreams_found = 0;
foreach var module (keys(appstreams)) {
var appstream = NULL;
var appstream_name = NULL;
var appstream_version = NULL;
var appstream_split = split(module, sep:':', keep:FALSE);
if (!empty_or_null(appstream_split)) {
appstream_name = appstream_split[0];
appstream_version = appstream_split[1];
if (!empty_or_null(appstream_name)) appstream = get_one_kb_item('Host/RedHat/appstream/' + appstream_name);
}
if (!empty_or_null(appstream) && appstream_version == appstream || appstream_name == 'all') {
appstreams_found++;
foreach var package_array ( appstreams[module] ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'EL' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (reference && _release) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
}
}
if (!appstreams_found) audit(AUDIT_PACKAGE_NOT_INSTALLED, 'Module container-tools:ol8');
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'aardvark-dns / buildah / buildah-tests / etc');
}
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25091
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33198
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34558
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2879
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2880
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41715
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29409
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39318
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39319
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39326
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45287
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23650
linux.oracle.com/errata/ELSA-2024-2988.html
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
99.6%