Most recent entries from all

ALSA-2022:1565 — Moderate: container-tools:3.0 security and bug fix update

Affected: AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: crun and 18 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)

* buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* 3.0 stable stream: podman run --pid=host command causes OCI permission error (BZ#2070961)

bdu:2023-03753

Withdrawn: BELL-CVE-2022-27649 — CVE-2022-27649 does not affect BellSoft software

Withdrawn by the publisher.

EUVD-2026-15405

fkie_cve-2022-27649

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

GHSA-qvf8-p83w-v58j — Podman's default inheritable capabilities for linux container not empty

Affected: Go: github.com/containers/podman/v4

A bug was found in Podman where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.

gsd-2022-27649

msrc_CVE-2022-27649 — A flaw was found in Podman where containers were started incorrectly with non-empty default permissions. A vulnerabilit…

msrc_CVE-2022-27649

OESA-2025-1073 — podman security update

Affected: openEuler:22.03-LTS-SP3: podman

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es):

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

openSUSE-SU-2024:11982-1 — podman-4.0.3-1.1 on GA media

podman-4.0.3-1.1 on GA media

RHSA-2022:1407 — Red Hat Security Advisory: container-tools:2.0 security and bug fix update

podman: Default inheritable capabilities for linux container should be empty buildah: Default inheritable capabilities for linux container should be empty

SUSE-SU-2023:0326-1 — Security update for podman

Security update for podman

UBUNTU-CVE-2022-27649

Affected: Ubuntu:Pro:22.04:LTS: libpod, Ubuntu:Pro:24.04:LTS: libpod