Skip to content
OpenAdvisories
High ALSA-2024:6194 3 CVEs

Important: podman security update

Published Sep 3, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
* go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
* gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 9 podman 4:4.9.4-10.el9_4
AlmaLinux · 9 podman-docker 4:4.9.4-10.el9_4
AlmaLinux · 9 podman-plugins 4:4.9.4-10.el9_4
AlmaLinux · 9 podman-remote 4:4.9.4-10.el9_4
AlmaLinux · 9 podman-tests 4:4.9.4-10.el9_4

Vulnerabilities 3

  • High 7.5
    CVE-2024-37298

    Potential memory exhaustion attack due to sparse slice deserialization

    gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the spars…

    gorilla schema zot telegraf Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.0
    CVE-2024-6104

    go-retryablehttp can leak basic auth credentials to log files

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

    HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2024-24783

    Verify panics on certificates with an unknown public key algorithm in crypto/x509

    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-24783
  • report
    https://access.redhat.com/security/cve/CVE-2024-37298
  • report
    https://access.redhat.com/security/cve/CVE-2024-6104
  • report
    https://bugzilla.redhat.com/2268019
  • report
    https://bugzilla.redhat.com/2294000
  • report
    https://bugzilla.redhat.com/2295010
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-6194.html