Summary
[5.2.2-9.0.1]
- Add devices on container startup, not on creation
- overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[4:5.2.2-9]
- update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
(https://github.com/containers/podman/commit/6df7dfb)
- Resolves: RHEL-61847
[4:5.2.2-8]
- update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
(https://github.com/containers/podman/commit/c03b5f3)
- Resolves: RHEL-61667
[4:5.2.2-7]
- attempt to fix the TMT testing pipeline
- Resolves: RHEL-59714
[4:5.2.2-6]
- podman gating: test CNI, thanks to Ed Santiago
- Resolves: RHEL-61249
[4:5.2.2-5]
- bump Epoch to 4
- Resolves: RHEL-60963
[2:5.2.2-4]
- update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
(https://github.com/containers/podman/commit/8e693ce)
- Resolves: RHEL-60963
[2:5.2.2-3]
- update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
(https://github.com/containers/podman/commit/5f2c188)
- Resolves: RHEL-59703
[2:5.2.2-2]
- Add cni build tag to podman build
- Resolves: RHEL-59714
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | podman | 4:5.2.2-9.0.1.el9_5 |
| Oracle Linux · 9 | podman-docker | 4:5.2.2-9.0.1.el9_5 |
| Oracle Linux · 9 | podman-plugins | 4:5.2.2-9.0.1.el9_5 |
| Oracle Linux · 9 | podman-remote | 4:5.2.2-9.0.1.el9_5 |
| Oracle Linux · 9 | podman-tests | 4:5.2.2-9.0.1.el9_5 |
Vulnerabilities 7
-
High 7.8
Buildah: buildah allows arbitrary directory mount
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…
-
High 7.5
Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
-
High 7.5
Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
-
Medium 6.5
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…
-
Medium 5.4
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sy…
-
Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exp…
-
Medium 4.3
Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.