Test ID:	1.3.6.1.4.1.25623.1.1.10.2018.0398
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2018-0398)
Summary:	The remote host is missing an update for the 'docker, docker-containerd, golang, opencontainers-runc' package(s) announced via the MGASA-2018-0398 advisory.
Description:	Summary: The remote host is missing an update for the 'docker, docker-containerd, golang, opencontainers-runc' package(s) announced via the MGASA-2018-0398 advisory. Vulnerability Insight: Updated docker packages fix security vulnerabilities: Lack of content verification in docker allowed a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing (CVE-2017-14992). The DefaultLinuxSpec function in oci/defaults.go docker did not block /proc/scsi pathnames, which allowed attackers to trigger data loss (when certain older Linux kernels are used) by leveraging Docker container access to write a 'scsi remove-single-device' line to /proc/scsi/scsi, aka SCSI MICDROP (CVE-2017-16539). Container breakout without selinux in enforcing mode (CVE-2018-10892). The docker package has been updated to version 18.06.1 to fix these issues and other bugs. Also, the golang package was updated to version 1.11.1 to be able to build the update docker software. Additionally, the docker-containerd and opencontainers-runc packages have been updated to work with the updated docker package. Affected Software/OS: 'docker, docker-containerd, golang, opencontainers-runc' package(s) on Mageia 6. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-14992 https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/ Common Vulnerability Exposure (CVE) ID: CVE-2017-16539 https://github.com/moby/moby/pull/35399 https://github.com/moby/moby/pull/35399/commits/a21ecdf3c8a343a7c94e4c4d01b178c87ca7aaa1 https://marc.info/?l=linux-scsi&m=150985062200941&w=2 https://marc.info/?l=linux-scsi&m=150985455801444&w=2 https://twitter.com/ewindisch/status/926443521820774401 Common Vulnerability Exposure (CVE) ID: CVE-2018-10892 RHBA-2018:2796 https://access.redhat.com/errata/RHBA-2018:2796 RHSA-2018:2482 https://access.redhat.com/errata/RHSA-2018:2482 RHSA-2018:2729 https://access.redhat.com/errata/RHSA-2018:2729 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10892 https://github.com/moby/moby/pull/37404 openSUSE-SU-2019:2021 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.