CVE-2023-0778
Medium · 6.8CVSS
6.8
EPSS
0.5%
Published
Mar 27, 2023
CISA due date
—
Cloudanix analysis
A timing flaw in file export handling could let an attacker swap files to secretly read important system files they should not access.
- Exploitation
- Remote Authenticated
- Attacker needs
- Low Privilege
- Complexity
- High
- Impact
- Full Compromise
- Component
- Container Runtime
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition that permits replacing a normal file with a symlink during volume export, resulting in the process following the symlink and granting access to arbitrary files on the host file system.
Why it matters to the business
Attackers could gain unauthorized access to sensitive host files, leading to data exfiltration, privilege escalation, or further system compromise in environments using the affected software.
How an attack unfolds
An attacker with local or container access identifies an active volume export operation, replaces a targeted file with a malicious symlink in the narrow window between check and use phases, and causes the export process to dereference the symlink, exposing arbitrary host filesystem content.
How to fix it
Upgrade rocketchat/rocket.chat (GIT) to the fixed commit aa8f0ec70b2267af55d9ce9a3e3abfe7ff6c0a37.
How to confirm the fix worked
Confirm the deployed codebase contains commit aa8f0ec70b2267af55d9ce9a3e3abfe7ff6c0a37 and re-test volume export operations for symlink handling.
Typical attack path
- Obtain access to a container or environment performing volume exports
- Monitor or trigger a volume export operation
- Replace a file in the volume with a symlink pointing to a desired host file
- Exploit the TOCTOU window to cause the export to follow the symlink
- Read or exfiltrate arbitrary host files
How to detect it
Review application and container runtime logs for volume export events correlated with unexpected symlink operations or accesses to sensitive host paths; inspect audit logs for anomalous file descriptor or symlink activity during export windows.
What your security team should do
- Apply the fixed commit immediately across all instances
- Restrict volume export privileges to trusted users only
- Enable filesystem monitoring for unexpected symlink creations during exports
- Review container runtime configurations to limit host filesystem exposure
The record
A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/containers/podman/v4 | 0 | 4.4.2 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.5.0-2.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | aardvark-dns | 0 | 2:1.0.1-37.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | buildah | 0 | 1:1.29.1-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | buildah | 0 | 1:1.24.6-5.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | buildah-tests | 0 | 1:1.29.1-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | buildah-tests | 0 | 1:1.24.6-5.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | cockpit-podman | 0 | 63.1-1.module_el8.8.0+3557+7ba9cc13 |
| AlmaLinux:8 | cockpit-podman | 0 | 46-1.module_el8.7.0+3344+5bcd850f |
| AlmaLinux:8 | conmon | 0 | 3:2.1.6-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | conmon | 0 | 2:2.1.4-1.module_el8.7.0+3344+5bcd850f |
| AlmaLinux:8 | container-selinux | 0 | 2:2.205.0-2.module_el8.8.0+3557+7ba9cc13 |
| AlmaLinux:8 | container-selinux | 0 | 2:2.199.0-1.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.2.0-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | containernetworking-plugins | 0 | 1:1.1.1-2.module_el8.7.0+3344+5bcd850f |
| AlmaLinux:8 | containers-common | 0 | 2:1-63.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | containers-common | 0 | 2:1-37.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | crit | 0 | 3.15-3.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | crit | 0 | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | crit | 0 | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | criu | 0 | 3.15-3.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | criu | 0 | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | criu | 0 | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | criu-devel | 0 | 3.15-3.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | criu-devel | 0 | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | criu-devel | 0 | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | criu-libs | 0 | 3.15-3.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | criu-libs | 0 | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | criu-libs | 0 | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | crun | 0 | 1.8.1-2.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | crun | 0 | 1.6-1.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.10-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | fuse-overlayfs | 0 | 1.9-1.module_el8.7.0+3344+5bcd850f |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-1.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | libslirp | 0 | 4.4.0-1.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-1.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | libslirp-devel | 0 | 4.4.0-1.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | netavark | 0 | 2:1.5.0-4.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | netavark | 0 | 2:1.0.1-37.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.8-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 0 | 1.2.5-2.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-catatonit | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-catatonit | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-docker | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-docker | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-gvproxy | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-gvproxy | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-plugins | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-plugins | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-remote | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-remote | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | podman-tests | 0 | 3:4.4.1-8.module_el8.8.0+3568+e8578284 |
| AlmaLinux:8 | podman-tests | 0 | 2:4.0.2-20.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | python3-criu | 0 | 3.15-3.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | python3-criu | 0 | 3.15-3.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | python3-criu | 0 | 3.15-3.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | python3-podman | 0 | 4.4.1-1.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | python3-podman | 0 | 4.0.0-1.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | runc | 0 | 1:1.1.4-1.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | runc | 0 | 1:1.1.4-1.module_el8.7.0+3344+5bcd850f |
| AlmaLinux:8 | skopeo | 0 | 2:1.11.2-0.2.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | skopeo | 0 | 2:1.6.2-6.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.11.2-0.2.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | skopeo-tests | 0 | 2:1.6.2-6.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | slirp4netns | 0 | 1.2.0-2.module_el8.7.0+3407+95aa0ca9 |
| AlmaLinux:8 | slirp4netns | 0 | 1.1.8-2.module_el8.6.0+2877+8e437bf5 |
| AlmaLinux:8 | slirp4netns | 0 | 1.1.8-2.module_el8.6.0+3137+d33c3efb |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.3-7.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | toolbox | 0 | 0.0.99.3-7.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.3-7.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | toolbox-tests | 0 | 0.0.99.3-7.module_el8.8.0+3468+16b86c82 |
| AlmaLinux:8 | udica | 0 | 0.2.6-20.module_el8.8.0+3470+252b1910 |
| AlmaLinux:8 | udica | 0 | 0.2.6-3.module_el8.6.0+2886+d33c3efb |
| Debian:12 | libpod | 0 | 4.3.1+ds1-7 |
| Red Hat:enterprise_linux:8::appstream | aardvark-dns | 0 | 2:1.5.0-2.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | aardvark-dns | 0 | 2:1.0.1-37.module+el8.8.0+17954+9046de88 |
| Red Hat:enterprise_linux:8::appstream | buildah | 0 | 1:1.29.1-1.module+el8.8.0+18195+471da4bb |
| Red Hat:enterprise_linux:8::appstream | buildah | 0 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | buildah-debuginfo | 0 | 1:1.29.1-1.module+el8.8.0+18195+471da4bb |
| Red Hat:enterprise_linux:8::appstream | buildah-debuginfo | 0 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | buildah-debugsource | 0 | 1:1.29.1-1.module+el8.8.0+18195+471da4bb |
| Red Hat:enterprise_linux:8::appstream | buildah-debugsource | 0 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | buildah-tests | 0 | 1:1.29.1-1.module+el8.8.0+18195+471da4bb |
| Red Hat:enterprise_linux:8::appstream | buildah-tests | 0 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | buildah-tests-debuginfo | 0 | 1:1.29.1-1.module+el8.8.0+18195+471da4bb |
| Red Hat:enterprise_linux:8::appstream | buildah-tests-debuginfo | 0 | 1:1.24.6-5.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | cockpit-podman | 0 | 0:63.1-1.module+el8.8.0+18286+cd236dce |
| Red Hat:enterprise_linux:8::appstream | cockpit-podman | 0 | 0:46-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | conmon | 0 | 3:2.1.6-1.module+el8.8.0+18098+9b44df5f |
| Red Hat:enterprise_linux:8::appstream | conmon | 0 | 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | conmon-debuginfo | 0 | 3:2.1.6-1.module+el8.8.0+18098+9b44df5f |
| Red Hat:enterprise_linux:8::appstream | conmon-debuginfo | 0 | 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | conmon-debugsource | 0 | 3:2.1.6-1.module+el8.8.0+18098+9b44df5f |
| Red Hat:enterprise_linux:8::appstream | conmon-debugsource | 0 | 2:2.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | container-selinux | 0 | 2:2.205.0-2.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | container-selinux | 0 | 2:2.199.0-1.module+el8.8.0+18113+8b5b6979 |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins | 0 | 1:1.2.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins | 0 | 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins-debuginfo | 0 | 1:1.2.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins-debuginfo | 0 | 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins-debugsource | 0 | 1:1.2.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | containernetworking-plugins-debugsource | 0 | 1:1.1.1-2.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | containers-common | 0 | 2:1-63.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | containers-common | 0 | 2:1-37.module+el8.8.0+17954+9046de88 |
| Red Hat:enterprise_linux:8::appstream | crit | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | crit | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu-debuginfo | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu-debuginfo | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu-debugsource | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu-debugsource | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu-devel | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu-devel | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu-libs | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu-libs | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | criu-libs-debuginfo | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | criu-libs-debuginfo | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | crun | 0 | 0:1.8.1-2.module+el8.8.0+18418+f0e540fe |
| Red Hat:enterprise_linux:8::appstream | crun | 0 | 0:1.6-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | crun-debuginfo | 0 | 0:1.8.1-2.module+el8.8.0+18418+f0e540fe |
| Red Hat:enterprise_linux:8::appstream | crun-debuginfo | 0 | 0:1.6-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | crun-debugsource | 0 | 0:1.8.1-2.module+el8.8.0+18418+f0e540fe |
| Red Hat:enterprise_linux:8::appstream | crun-debugsource | 0 | 0:1.6-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs | 0 | 0:1.10-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs | 0 | 0:1.9-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs-debuginfo | 0 | 0:1.10-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs-debuginfo | 0 | 0:1.9-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs-debugsource | 0 | 0:1.10-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | fuse-overlayfs-debugsource | 0 | 0:1.9-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | libslirp | 0 | 0:4.4.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | libslirp | 0 | 0:4.4.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | libslirp-debuginfo | 0 | 0:4.4.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | libslirp-debuginfo | 0 | 0:4.4.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | libslirp-debugsource | 0 | 0:4.4.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | libslirp-debugsource | 0 | 0:4.4.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | libslirp-devel | 0 | 0:4.4.0-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | libslirp-devel | 0 | 0:4.4.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | netavark | 0 | 2:1.5.0-4.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | netavark | 0 | 2:1.0.1-37.module+el8.8.0+17954+9046de88 |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook | 0 | 0:1.2.8-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook | 0 | 0:1.2.5-2.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debuginfo | 0 | 0:1.2.8-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debuginfo | 0 | 0:1.2.5-2.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debugsource | 0 | 0:1.2.8-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debugsource | 0 | 0:1.2.5-2.module+el8.8.0+18083+cd85596b |
| Red Hat:enterprise_linux:8::appstream | podman | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-catatonit | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-catatonit | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-catatonit-debuginfo | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-catatonit-debuginfo | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-debuginfo | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-debuginfo | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-debugsource | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-debugsource | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-docker | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-docker | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-gvproxy | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-gvproxy | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-gvproxy-debuginfo | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-gvproxy-debuginfo | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-plugins | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-plugins | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-plugins-debuginfo | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-plugins-debuginfo | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-remote | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-remote | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-remote-debuginfo | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-remote-debuginfo | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | podman-tests | 0 | 3:4.4.1-8.module+el8.8.0+18438+15d3aa65 |
| Red Hat:enterprise_linux:8::appstream | podman-tests | 0 | 2:4.0.2-20.module+el8.8.0+18201+6ad7332c |
| Red Hat:enterprise_linux:8::appstream | python-podman | 0 | 0:4.4.1-1.module+el8.8.0+18275+3a56cc62 |
| Red Hat:enterprise_linux:8::appstream | python-podman | 0 | 0:4.0.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | python3-criu | 0 | 0:3.15-3.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | python3-criu | 0 | 0:3.15-3.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | python3-podman | 0 | 0:4.4.1-1.module+el8.8.0+18275+3a56cc62 |
| Red Hat:enterprise_linux:8::appstream | python3-podman | 0 | 0:4.0.0-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | runc | 0 | 1:1.1.4-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | runc | 0 | 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | runc-debuginfo | 0 | 1:1.1.4-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | runc-debuginfo | 0 | 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | runc-debugsource | 0 | 1:1.1.4-1.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | runc-debugsource | 0 | 1:1.1.4-1.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | skopeo | 0 | 2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c |
| Red Hat:enterprise_linux:8::appstream | skopeo | 0 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | skopeo-debuginfo | 0 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | skopeo-debugsource | 0 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | skopeo-tests | 0 | 2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c |
| Red Hat:enterprise_linux:8::appstream | skopeo-tests | 0 | 2:1.6.2-6.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | slirp4netns | 0 | 0:1.2.0-2.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | slirp4netns | 0 | 0:1.1.8-2.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | slirp4netns-debuginfo | 0 | 0:1.2.0-2.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | slirp4netns-debuginfo | 0 | 0:1.1.8-2.module+el8.8.0+17821+de1b53f1 |
| Red Hat:enterprise_linux:8::appstream | slirp4netns-debugsource | 0 | 0:1.2.0-2.module+el8.8.0+18060+3f21f2cc |
| Red Hat:enterprise_linux:8::appstream | slirp4netns-debugsource | 0 | 0:1.1.8-2.module+el8.8.0+17821+de1b53f1 |
Related vulnerabilities
- CVE-2024-3056 A flaw was found in Podman. Also affects github.com/containers/podman/v4
- CVE-2024-1753 A flaw was found in Buildah (and subsequently Podman Build) which allows containers to… Also affects github.com/containers/podman/v4
- CVE-2025-47913 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and… Also affects aardvark-dns
- CVE-2025-52565 container escape due to /dev/console mount and related races Also affects aardvark-dns
- CVE-2025-31133 runc container escape via "masked path" abuse due to mount race conditions Also affects aardvark-dns
- CVE-2025-52881 runc container escape and denial of service due to arbitrary write gadgets and procfs… Also affects aardvark-dns
- CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data… Also affects aardvark-dns
- CVE-2024-9341 A flaw was found in Go. Also affects aardvark-dns