CVE-2022-1227

CVE-2022-1227 describes a privilege-escalation flaw in Podman where an attacker could publish a malicious image to a public registry; when a victim downloads it, running the user command ‘podman top’ could grant access to the host filesystem, enabling information disclosure or DoS. The issue is t...

CVE-2020-14370

CVE-2020-14370 is a Podman information-disclosure vulnerability where environment variables from the first container leak into subsequent containers when using Varlink or Docker-compatible REST API if multiple containers are created quickly. Connected docs indicate a later CVE-2022-2739 reference...

CVE-2021-20188

CVE-2021-20188 affects podman before 1.7.0. The flaw: file permissions for non-root users in privileged containers are not correctly checked, enabling a low-privilege container user to access other files within the same container (even if root-owned). It does not enable direct container escape; h...

CVE-2022-2989

CVE-2022-2989 affects Podman and is caused by incorrect handling of supplementary groups inside a container, enabling potential information disclosure or data modification when an attacker has direct container access and can execute code. Connected documents confirm affected Podman versions older...

CVE-2022-27649

CVE-2022-27649 affects Podman (and related container tooling) where containers could be started with non-empty default/inheritable Linux capabilities. The underlying issue is that default inheritable capabilities for Linux containers were not empty, allowing an attacker with access to programs po...