17 matches found
CVE-2019-25067
CVE-2019-25067 affects Podman and Varlink 1.5.1, with the vulnerability impacting an unknown part of the component API and enabling Remote Privilege Escalation. Exploitation can be performed remotely, and public exploits exist. The connected documents consistently reference Podman/Varlink, and do...
CVE-2022-1227
CVE-2022-1227 describes a privilege-escalation flaw in Podman where an attacker could publish a malicious image to a public registry; when a victim downloads it, running the user command ‘podman top’ could grant access to the host filesystem, enabling information disclosure or DoS. The issue is t...
CVE-2020-14370
CVE-2020-14370 is a Podman information-disclosure vulnerability where environment variables from the first container leak into subsequent containers when using Varlink or Docker-compatible REST API if multiple containers are created quickly. Connected docs indicate a later CVE-2022-2739 reference...
CVE-2022-2989
CVE-2022-2989 affects Podman and is caused by incorrect handling of supplementary groups inside a container, enabling potential information disclosure or data modification when an attacker has direct container access and can execute code. Connected documents confirm affected Podman versions older...
CVE-2021-20188
CVE-2021-20188 affects podman before 1.7.0. The flaw: file permissions for non-root users in privileged containers are not correctly checked, enabling a low-privilege container user to access other files within the same container (even if root-owned). It does not enable direct container escape; h...
CVE-2022-27649
CVE-2022-27649 affects Podman (and related container tooling) where containers could be started with non-empty default/inheritable Linux capabilities. The underlying issue is that default inheritable capabilities for Linux containers were not empty, allowing an attacker with access to programs po...
CVE-2023-0778
CVE-2023-0778 is a TOCTOU flaw in podman that can let a malicious user replace a normal file in a volume with a symlink during volume export, potentially exposing host files. Connected advisories specify affected software and versions: podman for Linux distributions with podman
CVE-2021-20199
CVE-2021-20199 affects Podman (rootless containers) starting from 1.8.0, where remote traffic to rootless containers is seen as originating from 127.0.0.1. This can allow containerized apps that trust localhost connections to be exposed to untrusted remote traffic without authentication. Connecte...
CVE-2021-4024
CVE-2021-4024 affects Podman: the podman machine function launches gvproxy on the host, exposing an API on port 7777 bound to all IPs. If the host firewall allows this, an attacker could forward ports from the host to the VM, potentially exposing private VM services or disrupting host services. C...
CVE-2022-4123
CVE-2022-4123 involves a flaw in Buildah (used with Podman) where an incorrect absolute path traversal discloses the local path and lowest subdirectory, impacting confidentiality. Connected data shows affected Podman packages (e.g., on Mariner) for versions before 5.6.1-2, with an upgraded packag...
CVE-2022-4122
CVE-2022-4122 affects podman (and the podman-build-related components) via a symlink-following flaw in reading .containerignore and .dockerignore, causing information disclosure. Connected MARINER data specifies: affected podman versions
CVE-2022-2739
The CVE-2022-2739 entry concerns Red Hat Enterprise Linux 7 Extras where an incorrect podman version released via RHSA-2022:2190 did not include the fix for CVE-2020-14370 (environment-variable leakage). Root cause: the shipped podman version omitted the established remediation, allowing potentia...
CVE-2024-3056
CVE-2024-3056 affects Podman. A flaw allows a container that shares IPC with another to create a large number of IPC resources in /dev/shm, exhaust memory, and trigger a memory-based denial of service. The resources remain tied to the IPC namespace even after the container is removed, and a resta...
CVE-2022-2738
CVE-2022-2738 is described in connected MiracleLinux advisories as a security regression of CVE-2020-8945, caused by a source-code-management issue in podman. The affected component is podman in MiracleLinux 7 (AXSA-2022-3718:02), with explicit note that the regression impacts the Go GPGME bindin...
CVE-2026-55686
Summary of CVE-2026-55686 (Podman: WORKDIR symlink traversal) Affects Podman versions 3.0.0 through 5.7.0 where a container image run with a crafted WORKDIR path that contains a symlink can cause a host filesystem change: create a directory or modify ownership. Ownership modification is less like...
CVE-2026-57231
CVE-2026-57231 affects Podman versions 1.8.1 through 5.8.4, where a container image with an Env entry having only a key (and using the * wildcard) can cause host environment variables to be leaked into the container at run time. The PTSecurity document confirms the issue is addressed in Podman 5....