Summary
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
* buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
* Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | podman | 4:4.9.4-16.el9_4 |
| AlmaLinux · 9 | podman-docker | 4:4.9.4-16.el9_4 |
| AlmaLinux · 9 | podman-plugins | 4:4.9.4-16.el9_4 |
| AlmaLinux · 9 | podman-remote | 4:4.9.4-16.el9_4 |
| AlmaLinux · 9 | podman-tests | 4:4.9.4-16.el9_4 |
Vulnerabilities 3
-
High 7.8
Buildah: buildah allows arbitrary directory mount
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…
-
Medium 6.5
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…
-
Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exp…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-9407
-
report
https://access.redhat.com/security/cve/CVE-2024-9675
-
report
https://access.redhat.com/security/cve/CVE-2024-9676
-
report
https://bugzilla.redhat.com/2315887
-
report
https://bugzilla.redhat.com/2317458
-
report
https://bugzilla.redhat.com/2317467
-
advisory
https://errata.almalinux.org/9/ALSA-2024-9051.html