リモートの Oracle Linux 8 ホストに、ELSA-2024-3968 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    aardvark-dns [2:1.10.0-1]
    - https://github.com/containers/aardvark-dns/releases/tag/v1.10.0 への更新
    - 関連: Jira:RHEL-2110

    [2:1.9.0-1]
    - https://github.com/containers/aardvark-dns/releases/tag/v1.9.0 への更新
    - 関連: Jira:RHEL-2110

    [2:1.8.0-1]
    - https://github.com/containers/aardvark-dns/releases/tag/v1.8.0 への更新
    - 関連: Jira:RHEL-2110

    buildah [2:1.33.7-2]
    - https://github.com/containers/buildah/tree/release-1.33(https://github.com/containers/buildah/commit/997beea の最新コンテンツに更新してください)
    - 解決: RHEL-28725

    cockpit-podman [84.1-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1 への更新
    - 関連: Jira:RHEL-25557

    [84-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/84 への更新
    - 関連: Jira:RHEL-2110

    [83-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/83 への更新
    - 関連: Jira:RHEL-2110

    [82-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/82 への更新
    - 関連: Jira:RHEL-2110

    [81-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/81 への更新
    - 関連: Jira:RHEL-2110

    [80-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/80 への更新
    - 関連: Jira:RHEL-2110

    [79-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/79 への更新
    - 関連: Jira:RHEL-2110

    [78-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/78 への更新
    - 関連: Jira:RHEL-2110

    [77-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/77 への更新
    - 関連: Jira:RHEL-2110

    [75-1]
    - https://github.com/cockpit-project/cockpit-podman/releases/tag/75 への更新
    - 関連: #2176055

    conmon [3:2.1.10-1]
    - https://github.com/containers/conmon/releases/tag/v2.1.10 への更新
    - 関連: Jira:RHEL-2110

    [3:2.1.8-1]
    - https://github.com/containers/conmon/releases/tag/v2.1.8 への更新
    - 関連: #2176055

    containernetworking-plugins [1:1.4.0-2]
    - 再構築
    - 解決: RHEL-18390

    [1:1.4.0-1]
    - https://github.com/containernetworking/plugins/releases/tag/v1.4.0 への更新
    - 関連: Jira:RHEL-2110

    containers-common [2:1-81.0.1]
    - 削除した参照を更新 [Orabug: 33473101] (Alex Burmashev)
    - registries.conf を調整 (Nikita Gerasimov)
    - RedHat レジストリへの参照を削除 (Nikita Gerasimov)

    [2:1-81]
    - Pyxis から shortnames を更新
    - 関連: Jira:RHEL-2110

    [2:1-80]
    - リリースを更新して、アップグレードパスを保持します
    - 解決: Jira:RHEL-12277

    container-selinux [2:2.229.0-2]
    - RHEL8 以前の watch ステートメントを適切に削除
    - 関連: Jira:RHEL-2110

    [2:2.229.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.229.0 への更新
    - 関連: Jira:RHEL-2110

    [2:2.228.1-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.228.1 への更新
    - 関連: Jira:RHEL-2110

    [2:2.228.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.228.0 への更新
    - 関連: Jira:RHEL-2110

    [2:2.227.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.227.0 への更新
    - 関連: Jira:RHEL-2110

    [2:2.226.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.226.0 への更新
    - python を取り込む際の policycoreutils-python-utils の依存関係を削除
    - 関連: Jira:RHEL-2110

    [2:2.224.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.224.0 への更新
    - 関連: Jira:RHEL-2110

    [2:2.222.0-1]
    - https://github.com/containers/container-selinux/releases/tag/v2.222.0 への更新
    - 関連: Jira:RHEL-2110

    criu [3.18-5]
    - アップグレードパスを保持するための再構築
    - 関連: RHEL-32671

    [3.18-4]
    - 8.9 で egg-info に切り替える
    - 関連: #2176055

    [3.18-3]
    - --progress-bar オプションを削除します
    - 関連: #2176055

    [3.18-2]
    - 3.18 への更新
    - 関連: #2176055

    [3.17-1]
    - 3.17 への更新
    - 解決4: #2175794

    crun [1.14.3-2]
    - BR libgcrypt-devel を削除 (不要になった)
    - 関連: Jira:RHEL-2110

    [1.14.3-1]
    - https://github.com/containers/crun/releases/tag/1.14.3 への更新
    - 関連: Jira:RHEL-2110

    [1.14.1-1]
    - https://github.com/containers/crun/releases/tag/1.14.1 への更新
    - 関連: Jira:RHEL-2110

    [1.14-1]
    - https://github.com/containers/crun/releases/tag/1.14 への更新
    - 関連: Jira:RHEL-2110

    [1.13-1]
    - https://github.com/containers/crun/releases/tag/1.13 への更新
    - 関連: Jira:RHEL-2110

    [1.12-1]
    - https://github.com/containers/crun/releases/tag/1.12 への更新
    - 関連: Jira:RHEL-2110

    [1.11.2-1]
    - https://github.com/containers/crun/releases/tag/1.11.2 への更新
    - 関連: Jira:RHEL-2110

    [1.11.1-1]
    - https://github.com/containers/crun/releases/tag/1.11.1 への更新
    - 関連: Jira:RHEL-2110

    [1.11-1]
    - https://github.com/containers/crun/releases/tag/1.11 への更新
    - 関連: Jira:RHEL-2110

    [1.9.2-1]
    - https://github.com/containers/crun/releases/tag/1.9.2 への更新
    - 関連: Jira:RHEL-2110

    [1.9.1-1]
    - https://github.com/containers/crun/releases/tag/1.9.1 への更新
    - 関連: Jira:RHEL-2110

    [1.9-1]
    - https://github.com/containers/crun/releases/tag/1.9 への更新
    - 関連: Jira:RHEL-2110

    fuse-overlayfs [1.13-1]
    - https://github.com/containers/fuse-overlayfs/releases/tag/v1.13 への更新
    - 関連: Jira:RHEL-2110

    libslirp [4.4.0-2]
    - アップグレードパス 8.9 -> を保持するための再構築 8.10
    - 関連: RHEL-32671

    netavark [2:1.10.3-1]
    - https://github.com/containers/netavark/releases/tag/v1.10.3 への更新
    - 関連: Jira:RHEL-2110

    [2:1.10.2-1]
    - https://github.com/containers/netavark/releases/tag/v1.10.2 への更新
    - 関連: Jira:RHEL-2110

    [2:1.10.1-1]
    - https://github.com/containers/netavark/releases/tag/v1.10.1 への更新
    - 関連: Jira:RHEL-2110

    [2:1.10.0-1]
    - https://github.com/containers/netavark/releases/tag/v1.10.0 への更新
    - 関連: Jira:RHEL-2110

    [2:1.9.0-1]
    - https://github.com/containers/netavark/releases/tag/v1.9.0 への更新
    - 関連: Jira:RHEL-2110

    [2:1.8.0-2]
    - systemd ユニットのディレクトリを修正
    - 関連: Jira:RHEL-2110

    [2:1.8.0-1]
    - https://github.com/containers/netavark/releases/tag/v1.8.0 への更新
    - 関連: Jira:RHEL-2110

    oci-seccomp-bpf-hook [1.2.10-1]
    - https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10 への更新
    - 関連: Jira:RHEL-2110

    podman [4:4.9.4-3.0.1]
    - 作成時ではなく、コンテナの起動時にデバイスを追加します

    [4:4.9.4-3]
    - BR: /usr/bin/man
    - 関連: RHEL-28727

    [4:4.9.4-2]
    - https://github.com/containers/podman/tree/v4.9-rhel(https://github.com/containers/podman/commit/6464b2c の最新コンテンツに更新してください)
    - 解決: RHEL-28727

    python-podman [4.9.0-1]
    - https://github.com/containers/podman-py/releases/tag/v4.9.0 への更新
    - 関連: Jira:RHEL-2110

    [4.8.2-1]
    - https://github.com/containers/podman-py/releases/tag/v4.8.2 への更新
    - 関連: Jira:RHEL-2110

    [4.8.0.post1-1]
    - https://github.com/containers/podman-py/releases/tag/v4.8.0.post1 への更新
    - 関連: Jira:RHEL-2110

    [4.7.0-1]
    - https://github.com/containers/podman-py/releases/tag/v4.7.0 への更新
    - 関連: Jira:RHEL-2110

    runc skopeo [2:1.14.3-2]
    - https://github.com/containers/skopeo/tree/release-1.14(https://github.com/containers/skopeo/commit/5f2b9af の最新コンテンツに更新してください)
    - 解決: RHEL-28728

    [2:1.14.3-1]
    - https://github.com/containers/skopeo/tree/release-1.14(https://github.com/containers/skopeo/commit/4a2bc3a の最新コンテンツに更新してください)
    - 解決: RHEL-28226

    slirp4netns [1.2.3-1]
    - https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.3 への更新
    - 関連: Jira:RHEL-2110

    [1.2.2-1]
    - https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.2 への更新
    - 関連: Jira:RHEL-2110

    udica [0.2.6-21]
    - リリースを更新して、更新パスを保持します
    - 解決: RHEL-32671

    [0.2.6-20]
    - リリースを更新して、更新パスを保持します
    - 関連: #2139052

Tenable は、前述の記述ブロックを Oracle Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

検出

Oracle Linux 8: container-tools:ol8 (ELSA-2024-3968)

medium Nessus プラグイン ID 200721

バージョン 1.4

バージョン 1.3

バージョン 1.2

バージョン 1.1

バージョン 1.4 Nov 2, 2024, 5:10 AM CVSS metrics ("CVSSv2 score" set to 5.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2024-28176, severity decreased from "High" to "Medium") CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin Feed: 202411020510
バージョン 1.3 Sep 23, 2024, 7:12 AM CVSSv3 score source (changed from "CVE-2024-28176" to none) Plugin Feed: 202409230712
バージョン 1.2 Sep 22, 2024, 3:24 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on CVE-2024-28176, severity increased from "Medium" to "High") CVSSv2 severity (based on None, severity decreased from "High" to "Low") CVSSv3 score source (set to "CVE-2024-28176") Plugin metadata Plugin Feed: 202409220324
バージョン 1.1 Jun 19, 2024, 5:22 AM New Plugin Feed: 202406190522